Between Zeros and Ones: Behavioral Characterization Beyond Binary Labeling Across Public ICS Datasets

• URL: http://arxiv.org/abs/2606.30493v1
• Date: Mon, 29 Jun 2026 15:58:34 GMT
• Title: Between Zeros and Ones: Behavioral Characterization Beyond Binary Labeling Across Public ICS Datasets
• Abstract summary: Intrusion detection in Industrial Control Systems is typically evaluated on a small set of public benchmarks using binary normal'' versus attack'' labels.<n>We propose a behavioral characterization framework that maps raw multivariate process traces into five interpretable physical primitives.<n>We show that attack windows exhibit clear behavioral shifts relative to normal operation while the three datasets occupy largely distinct regions of the behavioral space.
• Score: 0.12249546377051435
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Intrusion detection in Industrial Control Systems (ICS) is typically evaluated on a small set of public benchmarks using binary ``normal'' versus ``attack'' labels, a practice that can mask the behavioral diversity of cyber-physical attacks. To address this limitation, we propose a behavioral characterization framework that maps raw multivariate process traces into five interpretable physical primitives: drift, spike, oscillation, repetition, and switching. We apply the framework to three widely used ICS benchmarks, namely, SWaT, WADI, and HAI, and show that attack windows exhibit clear behavioral shifts relative to normal operation while the three datasets occupy largely distinct regions of the behavioral space, revealing both cross-dataset bias and intra-dataset diversity. In particular, WADI is dominated by repetition, HAI emphasizes sustained drift and oscillation, and SWaT is characterized by stealthier frozen-telemetry behavior. To examine the evaluation implications, we use an indicative Random Forest baseline and show that aggregate binary metrics can limit visibility into performance across different behavioral proxies. For example, in SWaT, macro F1 drops from 85.44% under binary evaluation to 37.84% under behavior-proxy multiclass prediction, with similar degradations observed on WADI and HAI. Based on these findings, we argue for complementing conventional binary benchmarking with behavior-stratified evaluation to expose blind spots that aggregate scores leave hidden and to better support targeted incident response.

Related papers

• ControlledShifts: Towards Standardizing Robustness Evaluation in Trajectory Prediction Under Distribution Shifts [12.370065954075299]
  Trajectory prediction is central to safety in autonomous driving.<n>Many methods attempt to mitigate distribution shift degradation through data-centric or test-time adaptation approaches.<n>We introduce ControlledShifts, a framework that systematically re-splits existing trajectory datasets into in-distribution and out-of-distribution partitions.
  arXiv  Detail & Related papers  (2026-08-18T15:16:52Z)
• Domain Adaptive Object Detection via Dual-Stream Bilevel-Cycle Optimization [64.83565413108789]
  Cycle self-training (CST) breaks the shared classifier assumption of the standard self-training framework.<n>CST exploits unlabeled target data by training with target pseudo-labels.
  arXiv  Detail & Related papers  (2026-06-30T09:05:30Z)
• PerceptionRubrics: Calibrating Multimodal Evaluation to Human Perception [75.70273182182397]
  PerceptionRubrics is a rubric-based evaluation framework.<n>It addresses the gap between saturated benchmark scores and real-world brittleness.<n>It pairs 1,038 information-dense images with over 12,000 instance-specific rubrics.
  arXiv  Detail & Related papers  (2026-06-26T17:59:15Z)
• Dual-Branch Cross-Projection Debiasing through Diffusion-based Disentanglement [66.67463557274358]
  Foundation models trained on biased datasets often rely on spurious correlations between target labels and non-causal attributes.<n>We introduce Confidence-guided Concept Mining (CBCM) to identify reliable spurious attributes without attribute annotations.<n>We propose Dual-branch Cross-projection Debiasing (DCD), a prompt-tuning framework that separates target and spurious representations into two branches.
  arXiv  Detail & Related papers  (2026-06-23T05:28:47Z)
• BLADE: Behavior-Level Anomaly Detection Using Network Traffic in Web Services [7.024862094862467]
  BLADE is a novel unsupervised traffic anomaly detection system for web services.<n> BLADE exploits a flow autoencoder to learn a latent feature representation and calculates its reconstruction losses per flow.<n> BLADE is extensively evaluated on both the custom dataset and the CIC-IDS 2017 dataset.
  arXiv  Detail & Related papers  (2025-11-07T12:25:39Z)
• Human-Centric Anomaly Detection in Surveillance Videos Using YOLO-World and Spatio-Temporal Deep Learning [0.1019561860229868]
  Anomaly detection in surveillance videos remains a challenging task due to the diversity of abnormal events, class imbalance, and scene-dependent visual clutter.<n>We propose a robust deep learning framework that integrates human-weighted preprocessing withtemporal modeling for multi-class anomaly classification.<n>Our method achieves a mean test accuracy of 92.41% across three independent trials, with per-class F1-scores consistently exceeding 0.85.
  arXiv  Detail & Related papers  (2025-10-24T22:38:17Z)
• Distributed Detection of Adversarial Attacks in Multi-Agent Reinforcement Learning with Continuous Action Space [6.649910168731417]
  We address the problem of detecting adversarial attacks against cooperative multi-agent reinforcement learning with continuous action space.<n>We propose a decentralized detector that relies solely on the local observations of the agents and makes use of a statistical characterization of the normal behavior of observable agents.<n>We evaluate our scheme on various multi-agent PettingZoo benchmarks against different state-of-the-art attack methods, and our results demonstrate the effectiveness of our method in detecting impactful adversarial attacks.
  arXiv  Detail & Related papers  (2025-08-21T17:58:36Z)
• Anomalous Decision Discovery using Inverse Reinforcement Learning [3.3675535571071746]
  Anomaly detection plays a critical role in Autonomous Vehicles (AVs) by identifying unusual behaviors through perception systems.<n>Current approaches, which often rely on predefined thresholds or supervised learning paradigms, exhibit reduced efficacy when confronted with unseen scenarios.<n>We present Trajectory-Reward Guided Adaptive Pre-training (TRAP), a novel IRL framework for anomaly detection.
  arXiv  Detail & Related papers  (2025-07-06T17:01:02Z)
• A Dataset for Semantic Segmentation in the Presence of Unknowns [49.795683850385956]
  Existing datasets allow evaluation of only knowns or unknowns - but not both.<n>We propose a novel anomaly segmentation dataset, ISSU, that features a diverse set of anomaly inputs from cluttered real-world environments.<n>The dataset is twice larger than existing anomaly segmentation datasets.
  arXiv  Detail & Related papers  (2025-03-28T10:31:01Z)
• CBW: Towards Dataset Ownership Verification for Speaker Verification via Clustering-based Backdoor Watermarking [85.68235482145091]
  Large-scale speech datasets have become valuable intellectual property.<n>We propose a novel dataset ownership verification method.<n>Our approach introduces a clustering-based backdoor watermark (CBW)<n>We conduct extensive experiments on benchmark datasets, verifying the effectiveness and robustness of our method against potential adaptive attacks.
  arXiv  Detail & Related papers  (2025-03-02T02:02:57Z)
• Frequency-driven Imperceptible Adversarial Attack on Semantic Similarity [22.28011382580367]
  adversarial attack research reveals the vulnerability of learning-based classifiers against carefully crafted perturbations. We propose a novel algorithm that attacks semantic similarity on feature representations. For imperceptibility, we introduce the low-frequency constraint to limit perturbations within high-frequency components.
  arXiv  Detail & Related papers  (2022-03-10T04:46:51Z)
• Learning from Aggregate Observations [82.44304647051243]
  We study the problem of learning from aggregate observations where supervision signals are given to sets of instances. We present a general probabilistic framework that accommodates a variety of aggregate observations. Simple maximum likelihood solutions can be applied to various differentiable models.
  arXiv  Detail & Related papers  (2020-04-14T06:18:50Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.