Search papers, labs, and topics across Lattice.
This study investigates the resilience of various anomaly detection models used in industrial control systems (ICS) when faced with training-time data contamination, a common real-world issue. By evaluating 11 different detectors under three distinct contamination strategies鈥攔andom injection, similarity-targeted injection, and feature-noise injection鈥攖he research reveals that model robustness is highly variable and cannot be inferred from performance metrics based on clean data. Notably, local-density and distance-based detectors suffer significant performance degradation from contamination, while models like PCA, SVM, HBOS, and IForest maintain relative stability, underscoring the critical need for data integrity in ML applications within ICS environments.
Model robustness against training-time data contamination varies dramatically, challenging the assumption that clean data performance predicts real-world reliability.
Machine-learning-based anomaly detection is increasingly used in industrial control systems (ICS), yet most studies assume that detector training data is trustworthy. In practice, training data may be corrupted through compromised logs, labeling errors, manipulated historian records, or unsafe retraining processes. This paper evaluates the robustness of offline ICS anomaly-detection pipelines on the Secure Water Treatment (SWaT) benchmark under training-time contamination. We assess 11 heterogeneous anomaly detectors under three contamination strategies: random injection, similarity-targeted injection, and feature-noise injection. The first two insert attack samples into the nominal training pool, while the third adds bounded Gaussian noise to selected normal training samples. These attacks are contamination-based rather than gradient-driven poisoning methods. Contamination budgets from 1% to 10% are evaluated using clean validation and test sets under a unified offline protocol. The results show that robustness is strongly model-dependent and cannot be predicted from clean-data performance alone. Injection-based contamination causes the greatest degradation, particularly for local-density and distance-based detectors, whereas feature-noise contamination has a comparatively limited effect. PCA, SVM, HBOS, and IForest remain relatively stable, while the tuned neural detectors demonstrate intermediate robustness. Overall, the findings highlight the importance of training-data integrity in ML-enabled ICS monitoring, subject to the evaluated dataset, models, and threat assumptions.
