PhaseNet++: Phase-Aware Frequency-Domain Anomaly Detection for Industrial Control Systems via Phase Coherence Graphs

1. Problem Statement

Industrial Control Systems (ICS) are critical infrastructure components (e.g., water treatment, power grids) vulnerable to cyber-physical attacks. Existing anomaly detection methods primarily rely on time-domain amplitude values of sensor data, using architectures like Graph Neural Networks (GNNs), Transformers, or Variational Autoencoders (VAEs).

The Core Gap: These methods typically discard the Fourier phase spectrum during preprocessing. However, in physical systems, sensors are coupled; their interactions are defined not just by similar value magnitudes but by consistent timing relationships and synchronization.

• The Challenge: Attacks such as replay attacks (replaying old data) or delay injection can maintain realistic amplitude profiles while disrupting the precise phase synchronization between sensors. Time-domain amplitude-only models struggle to detect these subtle timing inconsistencies directly.

2. Methodology: PhaseNet++

PhaseNet++ is a frequency-domain autoencoder designed to detect anomalies by explicitly modeling phase relationships. It operates on sliding windows of multivariate sensor data.

A. Input Representation (STFT)

Instead of raw time-series, the model applies the Short-Time Fourier Transform (STFT) to sensor windows.

• It retains both Magnitude ($M$) and Phase ($\Phi$) spectra.
• The phase spectrum is treated as a first-class signal, capturing within-window timing offsets that amplitude alone misses.

B. Phase Coherence Index (PCI)

To leverage the physical coupling of sensors, the authors introduce a Phase Coherence Index (PCI), inspired by the Phase Locking Value (PLV) from neuroscience.

• Mechanism: It calculates pairwise phase consistency across frequency bins between every pair of sensors ($i, j$).
• Output: A continuous adjacency matrix $A \in [0, 1]^{C \times C}$.
• Significance: Under normal operation, physically coupled sensors have stable phase lags, resulting in high $A_{ij}$. During an attack (e.g., replay or delay), this coherence breaks, causing $A_{ij}$ to drop. This matrix serves as a physics-informed spatial prior for the graph network.

C. Network Architecture

The model follows an encoder-decoder structure with four stages:

1. Spectral CNN Embedding: A lightweight 1D CNN extracts features from the magnitude and phase spectra of each sensor independently.
2. PCI-Weighted Graph Attention (GAT): A Graph Attention Network refines embeddings. Crucially, the PCI matrix ($A_{ij}$) is multiplied directly into the attention mechanism. This forces the model to propagate information preferentially between sensors that are phase-synchronized, rather than learning adjacency purely from data correlations.
3. Sensor-Token Transformer Encoder: A Transformer captures global system-wide structure across the sensor dimension (not time, as time is summarized in the spectral features).
4. Dual-Head Decoder: Two separate heads reconstruct the Magnitude and Phase spectra.

D. Training Objective

The model minimizes a composite loss function:
$$\mathcal{L} = \alpha \mathcal{L}_{mag} + \beta \mathcal{L}_{phase} + \gamma \mathcal{L}_{coh}$$

• $\mathcal{L}_{mag}$ (MSE): Standard reconstruction error for magnitude.
• $\mathcal{L}_{phase}$ (Circular Loss): Uses a cosine loss ($1 - \cos(\hat{\Phi} - \Phi)$) instead of Euclidean MSE. This respects the angular geometry of phase (handling the wrap-around at $\pm \pi$) and prevents discontinuity errors.
• $\mathcal{L}_{coh}$ (Coherence Loss): Re-estimates the PCI matrix from the reconstructed phase and compares it to the original PCI. This ensures the model preserves cross-sensor synchrony, not just individual sensor values.

3. Key Contributions

1. Phase as a First-Class Signal: The first systematic study to treat Fourier phase as a primary detection feature in ICS, reconstructing it with circular loss rather than treating it as a standard Euclidean channel.
2. PCI as Graph Structure: Introduces a method to derive graph adjacency from pairwise phase coherence (a physical quantity) rather than learned embeddings, injecting a physics-based prior into the attention mechanism.
3. Efficient Inductive Bias: The phase-aware components (Spectral CNN + PCI-GAT) add only 264,816 parameters (5.0% of the total 5.29M), proving that phase modeling is a lightweight but powerful enhancement.
4. New Evaluation Protocol: The authors adopt a strict window-level evaluation without point-adjustment, providing a more conservative and realistic assessment of the model's intrinsic discriminative ability compared to methods using point-adjustment heuristics.

4. Experimental Results

Evaluated on the Secure Water Treatment (SWaT) benchmark:

• Performance:
  • F1-Score: 90.98%
  • ROC-AUC: 95.66%
  • Average Precision: 91.51%
• Comparison:
  • While the F1-score is slightly lower than the Anomaly Transformer (94.07%), the authors note this is due to the stricter evaluation protocol (no point adjustment).
  • Under the same GDN protocol, PhaseNet++ outperforms GDN (90.98% vs. 81.0% F1).
  • The high ROC-AUC indicates the model's anomaly scores are highly discriminative; the gap between ranking metrics and F1 suggests the bottleneck is threshold calibration, not representation quality.
• Ablation: Removing the phase-aware front-end or the PCI graph module significantly degrades performance, confirming the necessity of phase coherence for detecting timing-based attacks.

5. Significance and Future Directions

• Scientific Impact: This work challenges the dominance of time-domain amplitude modeling in ICS security. It demonstrates that phase coherence is a complementary and critical signal for detecting attacks that manipulate timing (e.g., replay, delay injection) while preserving amplitude statistics.
• Practical Value: The method is lightweight and can be integrated into existing autoencoder frameworks with minimal parameter overhead.
• Future Work: The authors suggest fusing phase-aware and amplitude-aware representations, validating on other datasets (WADI, BATADAL), and developing adaptive thresholding strategies to close the gap between ranking metrics and F1 scores.

Conclusion: PhaseNet++ establishes a new direction for ICS anomaly detection by proving that the "timing" of physical processes, encoded in the Fourier phase spectrum, is a vital signal for identifying sophisticated cyber-physical attacks.