Search papers, labs, and topics across Lattice.
This paper introduces a system-aware unsupervised framework for anomaly diagnosis in Industrial Control Systems (ICS) that combines online anomaly detection with contextual explanations. A contextual digital twin, augmented with a Large Language Model (LLM), is used to translate detection evidence into diagnostic hypotheses and verification steps. Experiments on public ICS benchmarks demonstrate real-time detection efficiency and interpretable anomaly diagnoses, facilitating low-latency warnings and practical deployment.
LLMs can now provide interpretable anomaly diagnoses in industrial control systems by translating detection evidence into actionable hypotheses for operators.
Industrial Control Systems (ICS) integrate computing, physical processes, and communication to operate critical infrastructures such as power grids, water treatment plants, and oil and gas facilities. As ICS become increasingly targeted by cyberattacks, timely and reliable anomaly diagnosis is essential for protecting operational safety. However, existing ICS anomaly detection approaches face practical limitations: supervised methods require extensive labeled attack data and suffer from class imbalance, while model-based detectors often lack the ability to provide deep insight into the root causes of anomalies, leading to elevated false alarms and making it difficult for operators to initiate a timely response. In this work, we propose a system-aware unsupervised framework for ICS anomaly diagnosis that combines lightweight online detection with contextual explanation. The system identifies deviations from observed normal behaviors without prior knowledge of system topology. To support actionable response, we further concatenate a contextual digital twin augmented with an Large Language Model (LLM) to enhance interpretability, which translates detection evidence into grounded diagnostic hypotheses and verification steps for operators. Experiments on public ICS benchmarks demonstrate that the proposed framework achieves real-time detection efficiency and provides consistent, interpretable anomaly diagnoses, enabling low-latency warning and practical deployment in complex industrial environments.
