💻 computer science

System-aware contextual digital twin for ICS anomaly diagnosis

This paper proposes a system-aware, unsupervised framework for Industrial Control System anomaly diagnosis that combines lightweight online detection with a contextual digital twin augmented by a Large Language Model to provide real-time, interpretable root cause analysis without requiring prior system topology knowledge or labeled attack data.

Original authors: Eungyu Woo, Yooshin Kim, Wonje Heo, Donghoon Shin

Published 2026-04-28

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Eungyu Woo, Yooshin Kim, Wonje Heo, Donghoon Shin

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a massive industrial factory, like a water treatment plant or a power grid, as a giant, complex orchestra. In this orchestra, the sensors are the musicians listening to the music, and the actuators (like valves and pumps) are the conductors telling them what to play.

For the orchestra to sound good, the musicians and conductors must follow a strict, predictable pattern. If a conductor suddenly signals a violinist to play a loud note when the music calls for silence, something is wrong.

The Problem
Currently, security systems for these factories are like a very strict, but confused, music critic.

Old methods either need a library of every possible "bad note" (attacks) to recognize them (which is impossible because hackers invent new ones constantly), or they just look at the volume of the music. If the music gets too loud, they scream "ERROR!" but they can't tell why it's loud or who is playing the wrong note. This leads to too many false alarms, and operators get overwhelmed.
The Gap: When an alarm goes off, human experts have to spend hours staring at raw data charts to figure out if a valve is broken, a sensor is lying, or if it's just a normal change in the process. By the time they figure it out, the damage might be done.

The Solution: SCDT (The "Smart Conductor's Assistant")
The authors propose a new system called SCDT (System-Aware Contextual Digital Twin). Think of it as a super-smart assistant that understands the context of the music, not just the volume.

Here is how it works, broken down into simple steps:

1. Learning the "Normal" Patterns (The Context)

Instead of just memorizing what "normal" looks like in a vacuum, SCDT learns what is normal specifically when the conductors are in a certain position.

The Analogy: Imagine a traffic light. If the light is Green, it is "normal" for cars to move fast. If the light is Red, it is "normal" for cars to stop.
SCDT's Job: It learns that "Fast cars" are fine when the light is Green, but "Fast cars" are a disaster when the light is Red. It groups these situations into "Contexts." It doesn't need to know about hackers; it just learns the rules of the road for every possible traffic light color.

2. The Fast Check (The Digital Twin)

When the system is running, it constantly checks the current situation against these learned rules.

The Analogy: It's like a bouncer at a club who checks your ID against a list of allowed outfits.
How it works: If the "Green Light" (actuator setting) is on, but the "cars" (sensors) are moving at a speed that doesn't match the "Green Light" rule, the system flags it immediately.
Safety First: If the system sees a situation it has never seen before (a new combination of lights), it doesn't guess. It says, "I'm not sure, this is ambiguous," and passes the buck to the next step rather than raising a false alarm.

3. The "Explainable" Brain (The LLM)

This is the magic part. When the system finds a problem, it doesn't just shout "ERROR." It uses a Large Language Model (LLM)—think of this as a highly trained, logical detective—to explain why.

The Analogy: Instead of just saying "The engine is hot," the detective says, "The engine is hot because the cooling fan (Actuator A) is off, but the thermostat (Sensor B) is reading 200 degrees. This combination is impossible under normal rules."
The Process:
1. The system gathers the evidence: "The sensor is high, the valve is closed, and the trend is rising."
2. It asks the LLM: "Based on our rules, what does this mean?"
3. The LLM translates the math into plain English: "This looks like a stuck valve causing a tank to overflow. Check Valve 101."

Why This Matters

The paper claims that this system does two things better than existing tools:

It's Fast: It can catch problems in real-time without needing a supercomputer.
It's Understandable: It gives human operators a clear, logical story about what went wrong, so they can fix it immediately instead of guessing.

In Summary
SCDT is like a smart assistant for factory managers. It learns the specific rules of how the factory should behave in every different situation. When something breaks the rules, it doesn't just panic; it points a finger at the specific part of the machine that is misbehaving and explains the reason in plain language, helping humans fix the problem before it becomes a disaster.

1. Problem Statement

Industrial Control Systems (ICS) are critical for infrastructure (power grids, water treatment) but are increasingly vulnerable to cyberattacks. Existing anomaly detection methods face two primary limitations:

Supervised Methods: Require extensive labeled attack data, which is scarce, imbalanced, and quickly outdated due to evolving attack strategies.
Unsupervised/Model-Based Methods: While they avoid label dependence, they often rely on global statistical deviations. They fail to account for the context-dependent nature of ICS, where a sensor reading is "normal" under one actuator configuration but "abnormal" under another. Consequently, these methods produce high false alarm rates and lack the interpretability needed for operators to diagnose root causes quickly.

The core challenge is bridging the gap between statistical detection and actionable, context-aware diagnosis without relying on labeled attack data.

2. Methodology: The SCDT Framework

The authors propose SCDT (System-aware Contextual Digital Twin), a two-stage, unsupervised framework that combines lightweight online detection with Large Language Model (LLM)-driven reasoning.

A. Core Concept: Sensor-Actuator Combination (S-AC)

SCDT recognizes that ICS behavior is governed by closed-loop control. A sensor's trajectory is normal only relative to a specific actuator configuration. The system defines the "context" as the joint actuator state observed at the start of a time window.

B. Stage 1: Unsupervised Detection (The "Digital Twin" Core)

This stage learns "behavioral envelopes" of normal operation without attack labels.

Feature Extraction:
- Core Features (8D): Statistical metrics (mean, amplitude, std, RMSE, first/second differences, negative jumps, spectral energy) used for efficient clustering.
- Extended Descriptors (13D): Includes min/max values and segment-wise slopes (early/mid/late trends) used for detailed rule construction and explanation.
Multi-Stage Rule Clustering:
- Level-Grouping: Partitions data by operating levels (e.g., tank height) to prevent mixing distinct regimes.
- UMAP & HDBSCAN: Uses dimensionality reduction (UMAP) followed by density-based clustering (HDBSCAN) to identify distinct operational modes within each level group.
- Rule Construction: For each cluster (mode), the system builds a quantile envelope (defining acceptable ranges) and a robust diagonal distance model (using median and IQR) to measure deviation.
Inference & Screening:
- Retrieval: Matches the current window's actuator state to learned rules. If an exact match is missing, it falls back to an Actuator-Sensor (S-A) index, aggregating rules based on individual actuator states.
- Decision: A window is flagged as normal if it falls within the quantile envelope or within a relaxed distance threshold. Ambiguous cases (unseen contexts) are explicitly marked for LLM arbitration rather than forced classification.

C. Stage 2: LLM-Driven Diagnosis (The "Contextual" Layer)

This stage translates numerical detection evidence into human-readable, grounded hypotheses.

Primary LLM (Rule Generation):
- Analyzes the statistical features of each cluster to generate semantic rules (e.g., "When Valve A is open, Tank Level should be stable with low variability").
- These rules are stored as natural language text alongside numerical envelopes.
Secondary LLM (Diagnosis & Arbitration):
- Diagnosis Mode: When an anomaly is detected, the LLM receives the current actuator states, the specific violated rule, and the deviation metrics. It generates a narrative explaining why the behavior is anomalous (e.g., "Tank level is rising rapidly, inconsistent with the closed-valve state").
- Arbitration Mode: If the deterministic detector is ambiguous (e.g., an unseen actuator combination), the LLM acts as a judge, comparing the current window against aggregated S-A expectations to make a final decision.

3. Key Contributions

System-Aware Unsupervised Diagnosis: Formulates anomaly detection around Sensor-Actuator Contexts, enabling the system to learn invariant rules of closed-loop control without attack labels.
LLM-Grounded Explanations: Introduces a novel pipeline where LLMs convert statistical deviations into actionable, grounded hypotheses and verification steps, rather than just providing anomaly scores.
Robust Ambiguity Handling: Explicitly treats low-confidence context matching as "ambiguous" rather than forcing a decision, enhancing safety. It uses a hierarchical retrieval strategy (Exact S-AC $\to$ Partial S-A) to handle unseen scenarios.
Real-Time Design: Utilizes lightweight statistical screening (envelopes/distance) for speed, reserving LLM inference only for diagnosis or arbitration, ensuring deployment feasibility.

4. Experimental Results

The framework was evaluated on three public ICS benchmarks: SWaT (Water Treatment), WADI (Water Distribution), and HAI (Hardware-in-the-Loop).

Performance:
- SWaT: Achieved the best Recall (83.09%) and F1-score (89.17%) among baselines, demonstrating high sensitivity to anomalies in stable contexts.
- WADI & HAI: Achieved top-tier Precision (89.68% and 90.07% respectively) and second-best F1-scores.
- Trade-off: SCDT is more conservative than some high-recall baselines, resulting in fewer false alarms (high precision) while maintaining robust detection quality.
Interpretability:
- Case studies (e.g., SWaT Process 1) showed that SCDT correctly identified the root cause (e.g., a compromised valve forcing a tank overflow) and provided a coherent narrative linking the sensor anomaly to the specific actuator failure.
- The LLM successfully distinguished between normal and abnormal regimes based on actuator states, even when raw sensor data appeared ambiguous.

5. Significance

Bridging the Gap: SCDT solves the "black box" problem of traditional unsupervised detectors by providing explainable AI tailored to industrial control logic.
Operational Safety: By explicitly handling ambiguous contexts and providing grounded hypotheses, it reduces operator cognitive load and prevents delayed responses to critical incidents.
Scalability: The modular design allows the LLM diagnostic layer to be attached to other detection backbones, making it a versatile tool for improving interpretability in complex industrial environments without requiring labeled attack data.
Future-Proofing: The approach moves beyond static statistical models to dynamic, context-aware reasoning, which is essential for adapting to evolving industrial processes and novel attack vectors.