⚡ electrical engineering

Attack Detection using Time Series Foundation Models

This paper proposes a model-free attack detection and mitigation framework for cyber-physical systems that leverages the TimesFM time-series foundation model as a zero-shot surrogate residual generator to effectively identify both replay and stealthy attacks, even without knowledge of the underlying plant dynamics.

Original authors: Sribalaji C. Anand, Anh Tung Nguyen, George J. Pappas

Published 2026-06-05

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Sribalaji C. Anand, Anh Tung Nguyen, George J. Pappas

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a remote power plant or a factory that sends a constant stream of data (like temperature, speed, or voltage) to a control room operator over the internet. The operator's job is to watch this data to make sure everything is running smoothly.

The problem is that hackers can intercept this internet connection. They can either record the data and play it back later (a "Replay Attack") to hide that the machine is actually breaking, or they can mathematically tweak the numbers (a "Stealthy Attack") so the machine looks fine even though it's being sabotaged.

Traditionally, to catch these hackers, the operator needs a perfect "blueprint" (a mathematical model) of how the machine should behave. If the hacker knows the blueprint too, they can trick the operator's alarm system.

This paper proposes a new solution that doesn't need a blueprint at all. Instead, it uses a super-smart AI called TimesFM (developed by Google) that has read billions of time-series data patterns from all over the world.

Here is the breakdown of their approach using simple analogies:

1. The Two Layers of Security (The Swiss Cheese Model)

Think of security like a block of Swiss cheese.

Layer 1 (The Traditional Guard): This is the standard alarm system. It knows the blueprint of the machine. If the numbers don't match the blueprint, it screams "Alarm!"
- Weakness: If the hacker knows the blueprint, they can write a "magic spell" (a stealthy attack) that makes the numbers look perfect to this guard, even while the machine is being destroyed.
Layer 2 (The New AI Guard - TimesFM): This is the new invention in the paper. This guard doesn't know the blueprint. It has never seen this specific machine before. Instead, it acts like a super-weather forecaster. It looks at the recent history of the data and says, "Based on billions of patterns I've seen, the next number should be this."

2. How the AI Catcher Works

The AI guard works in three simple steps:

Warm-up: It watches the data for a while to get a feel for the rhythm.
Prediction: It guesses what the next number should be.
The "Surprise" Test: It compares the actual number sent by the machine with its guess.
- If the machine is honest, the guess and the reality are close (like a weather forecast being mostly right).
- If a hacker is faking the data, the "magic spell" that fooled the Blueprint Guard will look weird to the AI. The AI's guess will be totally different from the hacker's fake number, and the alarm will go off.

3. The Two Types of Hackers They Caught

The researchers tested this against two types of bad guys:

The Recorder (Replay Attack): Imagine a hacker who records a video of a calm river and plays it on a loop while the real river is actually flooding. The Blueprint Guard might be fooled because the video looks normal. But the AI Guard, looking at the context of the whole system, realizes, "Wait, the wind is blowing hard, but the river video shows no waves. That's fake!"
The Math Wizard (Stealthy Attack): This hacker knows the Blueprint Guard's math perfectly and tweaks the numbers just enough to pass its test. However, because the AI Guard doesn't use that same math, it doesn't see the trick. The AI Guard sees a pattern that doesn't fit the "story" of the data history and raises an alarm.

4. The "Magic Backup" (Mitigation)

The paper also found a cool side effect. If the hackers manage to corrupt the sensors so badly that the operator can't trust the real data, the AI Guard can actually guess what the real data should be.

Analogy: Imagine your car's speedometer is broken and stuck at 0 mph. A normal mechanic would be stuck. But this AI is like a passenger who knows how fast you should be going based on the engine noise and the road. It can fill in the missing information so the driver can keep driving safely.

5. The Results

The researchers tested this on a real-world simulation of a power grid (the IEEE 14-bus system).

The Blueprint Guard often failed to catch the "Math Wizard" hackers because the hackers were too good at following the rules.
The AI Guard caught almost all of them, even the ones designed to be invisible to the Blueprint Guard.
It also worked well when the system was noisy or when sensors were broken.

The Bottom Line

This paper shows that you don't need to know the secret blueprints of a machine to protect it. By using a general-purpose AI that understands how data "flows" over time, you can spot hackers who are trying to hide in plain sight. It's like hiring a detective who doesn't know the suspect's alibi but is so good at spotting inconsistencies in a story that the lie falls apart immediately.

Technical Summary: Attack Detection using Time Series Foundation Models

Problem Statement

This paper addresses the challenge of detecting cyber-attacks in Cyber-Physical Systems (CPS) where the operator possesses no knowledge of the plant model (neither its structure nor its parameters). The scenario involves a remotely located plant transmitting sensor measurements over a network susceptible to tampering. The authors focus on two specific classes of attacks:

Model-free replay attacks: Where an attacker replays recorded legitimate data (e.g., Stuxnet-style), requiring no system knowledge.
Model-based stealthy attacks: Where an attacker with full system knowledge designs inputs to maximally bias the state estimate while remaining undetected by a primary model-based $\chi^2$ detector.

The core research question is whether time-series foundation models can serve as a "model-structure-free" secondary detector ( $g_s$ ) to identify these attacks, including those specifically engineered to evade traditional model-based detectors ( $g_p$ ).

Methodology

1. Optimal Stealthy Attack Construction

To establish a rigorous baseline for detection, the authors first derive closed-form expressions for the optimal stealthy attack policy against a primary $\chi^2$ detector.

Linear Time-Invariant (LTI) Systems: For systems with a static observer (e.g., Luenberger or steady-state Kalman), the authors derive the attack vector that maximizes the estimation error subject to the constraint that the detection statistic remains below the threshold with a specified probability.
Nonlinear Systems: For systems employing an Extended Kalman Filter (EKF), the authors derive an approximate closed-form solution using first-order linearization of the deviation dynamics.
Key Insight: These derived attacks are mathematically guaranteed to be stealthy against the primary model-based detector ( $g_p$ ) by construction, provided the attacker has full model knowledge.

2. TimesFM-Based Detection Algorithm

The proposed solution replaces the model-based residual generator with TimesFM, a time-series foundation model developed by Google Research.

Zero-Shot Operation: TimesFM operates without any training, fine-tuning, or retraining on the specific plant data. It leverages pre-training on billions of diverse time-series data points.
Surrogate Residual Generation: The algorithm treats TimesFM predictions as a surrogate for the system's expected behavior. The residual is defined as the difference between the actual (potentially corrupted) sensor measurement and the TimesFM prediction.
Detection Statistic: A $\chi^2$ test is applied to these prediction residuals.
Mitigation Mechanism: Upon detecting an attack, the algorithm can replace corrupted measurements with TimesFM point predictions to maintain state estimation, effectively acting as a redundancy substitute when classical sensor redundancy assumptions fail.

Algorithm Workflow:

Warmup: TimesFM observes a window of past data to form predictions.
Covariance Estimation: A clean window of data is used to estimate the covariance of the prediction residuals under nominal operation.
Online Detection: A $\chi^2$ statistic is computed. If an alarm is raised, the buffer is not updated with the corrupted measurement, preventing contamination of future predictions.

Key Contributions

Closed-Form Optimal Attack Policies: The paper provides the first closed-form expressions for optimal stealthy attacks against $\chi^2$ detectors for both LTI and nonlinear systems, assuming the attacker has full model knowledge.
Model-Structure-Free Detection: The authors propose and validate a detector based on TimesFM that requires no explicit system model. This detector operates in a zero-shot fashion, distinguishing it from traditional data-driven methods that require task-specific training and hyperparameter tuning.
Robustness Against Stealthy Attacks: The paper demonstrates that attacks designed to be perfectly stealthy against model-based detectors are reliably detected by the TimesFM-based detector. This is attributed to the fact that TimesFM lacks the specific "innovation structure" that model-based attackers exploit.
Mitigation via Prediction: The work empirically shows that TimesFM predictions can substitute for corrupted measurements, enabling robust state estimation even when the number of compromised sensors violates standard observability redundancy assumptions (e.g., $N-2M$ sensors).

Experimental Results

The efficacy of the proposed approach was validated on two systems:

1. Undamped Mass-Spring System (Linear)

Replay Attacks: The TimesFM detector achieved a False Alarm Rate (FAR) of 0.5% (vs. 2.8% for the observer-based detector) and sustained detection throughout the attack, whereas the observer-based detector's alarms were intermittent and indistinguishable from noise.
Stealthy Attacks: Attacks constructed using Theorem 1 were undetectable by the EKF-based detector (FAR remained at nominal levels) but were consistently detected by TimesFM.
Single-Sensor Attack: In a scenario where the only available sensor was compromised (violating standard redundancy), the TimesFM-protected observer achieved significantly lower state reconstruction error than the unprotected observer.
Adaptive Attacker: Against an adaptive attacker using SPSA to evade both detectors simultaneously, the presence of the TimesFM detector reduced the attacker's impact by 91 times compared to an attacker targeting only the model-based detector.

2. IEEE 14-Bus Power System (Nonlinear)

Setup: A nonlinear swing equation model with 14 buses and 20 transmission lines.
Replay Attacks: TimesFM consistently raised alarms throughout the attack duration. The EKF-based detector only detected the attack during the initial phase before the replayed data became indistinguishable from nominal behavior in the model-based residual.
Stealthy Attacks: Using the nonlinear attack policy from Theorem 2, the EKF detector raised no alarms. In contrast, TimesFM detected the attack across all trials.
Statistical Validity: A Shapiro-Wilk test confirmed that the prediction residuals under nominal operation were approximately Gaussian, justifying the use of the $\chi^2$ test statistic.

Significance and Claims

The authors position this work as a significant step toward defense-in-depth in CPS security. By framing the TimesFM detector as a "second layer of defense" (inspired by the Swiss Cheese Model), the paper argues that:

Model-Free Advantage: Unlike traditional detectors that rely on explicit system models, TimesFM's lack of a closed-form innovation structure makes it inherently harder for model-based attackers to construct stealthy attacks.
Plug-and-Play Capability: The zero-shot nature of TimesFM eliminates the need for retraining or system identification, making it a practical solution for generic nonlinear systems where model knowledge is unavailable or unreliable.
Beyond Detection: The paper claims that foundation models can serve a dual role: not only as detectors but also as practical mitigation tools to restore state estimation when sensor redundancy is compromised.

The paper concludes that this is, to the best of the authors' knowledge, the first work to propose a foundation-model-based, model-structure-free zero-shot detector capable of handling both replay and model-based stealthy attacks in the presence of noise.