ICS anomaly detection based on sensor patterns and actuator rules in spatiotemporal dependency

The dataset distribution for operational-consistency-oriented methods shows evaluation across a relatively diverse set of CPS domains, including water-treatment testbeds (SWaT, WADI), vehicle OBD-II datasets, and power-system simulations.

“Finally, the dataset distribution shows that operational-consistency-oriented methods are evaluated across a relatively diverse set of CPS domains, including water-treatment testbeds (SWaT, WADI), vehicle OBD-II datasets, and power-system simulations [111-118].”

Operational-consistency-based methods explicitly encode process constraints, control logic, and admissible state transitions, and treat violations of such rules as primary anomaly cues, unlike purely data-driven prediction-residual or reconstruction-error approaches.

“First, unlike purely data-driven prediction-residual or reconstruction-error approaches, these methods explicitly encode process constraints, control logic, and admissible state transitions, and treat violations of such rules as primary anomaly cues [111-118].”

Several studies emphasize the importance of automatic rule extraction, adaptive updating of operational profiles, and careful coordination between rule-based and ML-based components.

“Several studies therefore emphasize the importance of automatic rule extraction, adaptive updating of operational profiles, and careful coordination between rule-based and ML-based components [113,114,117].”

By checking whether actuator commands, sensor responses, and event sequences are physically feasible and logically consistent, operational-consistency-based methods can detect cyber-physical attacks and stealthy manipulations that only slightly perturb statistical patterns but induce clear inconsistencies with process and control laws (e.g., false data injection, command and control tampering, re

“By checking whether actuator commands, sensor responses, and event sequences are physically feasible and logically consistent. they can detect cyber-physical attacks and stealthy manipulations that only slightly perturb statistical patterns but induce clear inconsistencies with process and control laws-such as false data injection, command and control tampering, replay, ramp-style stealth attacks,”

Because operational-consistency-based detectors focus on physical and logical feasibility rather than specific attack signatures, they can flag previously unseen attacks that violate process interlocks, causal relationships, or power-balance constraints.

“Because they focus on physical and logical feasibility rather than on specific attack signatures, they can flag previously unseen attacks that nevertheless violate process interlocks, causal relationships, or power-balance constraints [113,114,117,118].”

Hybrid operational-consistency frameworks combine rule-based consistency checks with supervised learners (e.g., decision trees, XGBoost, CNN-LSTM, DNNs), using operational rules either as a first-stage filter or as additional features to improve the robustness of data-driven classifiers.

“On the other side, hybrid frameworks combine these rule-based consistency checks with supervised learners such as decision trees, XGBoost, CNN-LSTM, and DNNs, using operational rules either as a first-stage filter or as additional features to improve the robustness of data-driven classifiers [112-114,117,118].”

Rule-centric operational-consistency approaches (e.g., Bayesian-network/FSM models, PLC-command validation tools, process-monitoring modules with explicit sensor/actuator rules) leverage hand-crafted or automatically extracted constraints to reject logically impossible operations and abnormal event sequences.

“On one side, Bayesian-network/FSM models, PLC-command validation tools, and process-monitoring modules with explicit sensor/actuator rules leverage hand-crafted or automatically extracted constraints to reject logically impossible operations and abnormal event sequences [111-113,117].”