System-aware contextual digital twin for ICS anomaly diagnosis

• URL: http://arxiv.org/abs/2604.24051v1
• Date: Mon, 27 Apr 2026 05:17:44 GMT
• Title: System-aware contextual digital twin for ICS anomaly diagnosis
• Abstract summary: We propose a system-aware unsupervised framework for ICS anomaly diagnosis.<n>The proposed framework achieves real-time detection efficiency and provides consistent, interpretable anomaly diagnoses.
• Score: 6.47954540420163
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Industrial Control Systems (ICS) integrate computing, physical processes, and communication to operate critical infrastructures such as power grids, water treatment plants, and oil and gas facilities. As ICS become increasingly targeted by cyberattacks, timely and reliable anomaly diagnosis is essential for protecting operational safety. However, existing ICS anomaly detection approaches face practical limitations: supervised methods require extensive labeled attack data and suffer from class imbalance, while model-based detectors often lack the ability to provide deep insight into the root causes of anomalies, leading to elevated false alarms and making it difficult for operators to initiate a timely response. In this work, we propose a system-aware unsupervised framework for ICS anomaly diagnosis that combines lightweight online detection with contextual explanation. The system identifies deviations from observed normal behaviors without prior knowledge of system topology. To support actionable response, we further concatenate a contextual digital twin augmented with an Large Language Model (LLM) to enhance interpretability, which translates detection evidence into grounded diagnostic hypotheses and verification steps for operators. Experiments on public ICS benchmarks demonstrate that the proposed framework achieves real-time detection efficiency and provides consistent, interpretable anomaly diagnoses, enabling low-latency warning and practical deployment in complex industrial environments.

Related papers

• Spatio-Temporal Attention Graph Neural Network: Explaining Causalities With Attention [0.0]
  Industrial Control Systems underpin critical infrastructure and face growing cyber-physical threats.<n>Machine learning-based anomaly detection approaches in ICS shows strong theoretical performance.<n>We propose a Spatio-Temporal Attention Graph Neural Network (STA-GNN) for unsupervised and explainable anomaly detection in ICS.
  arXiv  Detail & Related papers  (2026-03-11T11:41:38Z)
• HVR-Met: A Hypothesis-Verification-Replaning Agentic System for Extreme Weather Diagnosis [45.18017161777437]
  HVR-Met is a meteorological diagnostic system characterized by the deep integration of expert knowledge.<n>Its central innovation is the Hypothesis-Verification-Replanning'' closed-loop mechanism.<n>We introduce a novel benchmark focused on atomic-level subtasks.
  arXiv  Detail & Related papers  (2026-03-01T14:13:11Z)
• Multi-Agent Collaborative Intrusion Detection for Low-Altitude Economy IoT: An LLM-Enhanced Agentic AI Framework [60.72591149679355]
  The rapid expansion of low-altitude economy Internet of Things (LAE-IoT) networks has created unprecedented security challenges.<n>Traditional intrusion detection systems fail to tackle the unique characteristics of aerial IoT environments.<n>We introduce a large language model (LLM)-enabled agentic AI framework for enhancing intrusion detection in LAE-IoT networks.
  arXiv  Detail & Related papers  (2026-01-25T12:47:25Z)
• zkSTAR: A zero knowledge system for time series attack detection enforcing regulatory compliance in critical infrastructure networks [0.9558392439655014]
  Industrial control systems (ICS) form the operational backbone of critical infrastructure networks.<n>Regulators are imposing stricter compliance requirements to ensure system-wide security and reliability.<n>A central challenge is enabling regulators to verify the effectiveness of detection mechanisms without requiring utilities to disclose sensitive operational data.<n>We introduce zkSTAR, a cyberattack detection framework that leverages zk-SNARKs to reconcile these requirements and enable provable detection guarantees.
  arXiv  Detail & Related papers  (2025-10-27T06:45:11Z)
• GiBy: A Giant-Step Baby-Step Classifier For Anomaly Detection In Industrial Control Systems [1.450261153230204]
  We propose an anomaly detection method that involves accurate linearization of the non-linear forms arising from sensor-actuator(s) relationships.<n>We accomplish this by using a well-known water treatment testbed as a use case.
  arXiv  Detail & Related papers  (2025-04-29T16:24:11Z)
• Hybrid Temporal Differential Consistency Autoencoder for Efficient and Sustainable Anomaly Detection in Cyber-Physical Systems [0.0]
  Cyberattacks on critical infrastructure, particularly water distribution systems, have increased due to rapid digitalization.<n>This study addresses key challenges in anomaly detection by leveraging time correlations in sensor data.<n>We propose a hybrid autoencoder-based approach, referred to as hybrid TDC-AE, which extends TDC by incorporating both deterministic nodes and conventional statistical nodes.
  arXiv  Detail & Related papers  (2025-04-08T09:22:44Z)
• Convolutional Neural Network Design and Evaluation for Real-Time Multivariate Time Series Fault Detection in Spacecraft Attitude Sensors [41.94295877935867]
  This paper presents a novel approach to detecting stuck values within the Accelerometer and Inertial Measurement Unit of a drone-like spacecraft. A multi-channel Convolutional Neural Network (CNN) is used to perform multi-target classification and independently detect faults in the sensors. An integration methodology is proposed to enable the network to effectively detect anomalies and trigger recovery actions at the system level.
  arXiv  Detail & Related papers  (2024-10-11T09:36:38Z)
• Effective Intrusion Detection in Heterogeneous Internet-of-Things Networks via Ensemble Knowledge Distillation-based Federated Learning [52.6706505729803]
  We introduce Federated Learning (FL) to collaboratively train a decentralized shared model of Intrusion Detection Systems (IDS) FLEKD enables a more flexible aggregation method than conventional model fusion techniques. Experiment results show that the proposed approach outperforms local training and traditional FL in terms of both speed and performance.
  arXiv  Detail & Related papers  (2024-01-22T14:16:37Z)
• A Hierarchical Framework with Spatio-Temporal Consistency Learning for Emergence Detection in Complex Adaptive Systems [41.055298739292695]
  Emergence, a global property of complex adaptive systems, is prevalent in real-world dynamic systems, e.g., network-level traffic congestions. This paper proposes a hierarchical framework with CAS-temporal consistency to solve these two problems by learning the system representation and agent representations. Our method achieves more detection than traditional methods and deep learning methods on three datasets with well-known yet hard-to-detect emergent behaviors.
  arXiv  Detail & Related papers  (2024-01-18T08:55:05Z)
• Interactive System-wise Anomaly Detection [66.3766756452743]
  Anomaly detection plays a fundamental role in various applications. It is challenging for existing methods to handle the scenarios where the instances are systems whose characteristics are not readily observed as data. We develop an end-to-end approach which includes an encoder-decoder module that learns system embeddings.
  arXiv  Detail & Related papers  (2023-04-21T02:20:24Z)
• Monitoring and Diagnosability of Perception Systems [21.25149064251918]
  We propose a mathematical model for runtime monitoring and fault detection and identification in perception systems. We demonstrate our monitoring system, dubbed PerSyS, in realistic simulations using the LGSVL self-driving simulator and the Apollo Auto autonomy software stack.
  arXiv  Detail & Related papers  (2020-11-11T23:03:14Z)
• Adversarial vs behavioural-based defensive AI with joint, continual and active learning: automated evaluation of robustness to deception, poisoning and concept drift [62.997667081978825]
  Recent advancements in Artificial Intelligence (AI) have brought new capabilities to behavioural analysis (UEBA) for cyber-security. In this paper, we present a solution to effectively mitigate this attack by improving the detection process and efficiently leveraging human expertise.
  arXiv  Detail & Related papers  (2020-01-13T13:54:36Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.