The continuous monitoring of the interactions between cyber-physical components of any industrial control system (ICS) is required to secure automation of the system controls, and to guarantee plant processes are fail-safe and remain in an acceptably safe state. Safety is achieved by managing actuation (where electric signals are used to trigger physical movement), dependent on corresponding sensor readings; used as ground truth in decision making. Timely detection of anomalies (attacks, faults and unascertained states) in ICSs is crucial for the safe running of a plant, the safety of its personnel, and for the safe provision of any services provided. We propose an anomaly detection method that involves accurate linearization of the non-linear forms arising from sensor-actuator(s) relationships, primarily because solving linear models is easier and well understood. We accomplish this by using a well-known water treatment testbed as a use case. Our experiments show millisecond time response to detect anomalies, all of which are explainable and traceable; this simultaneous coupling of detection speed and explainability has not been achieved by other state of the art Artificial Intelligence (AI)/ Machine Learning (ML) models with eXplainable AI (XAI) used for the same purpose. Our methods explainability enables us to pin-point the sensor(s) and the actuation state(s) for which the anomaly was detected. The proposed algorithm showed an accuracy of 97.72% by flagging deviations within safe operation limits as non-anomalous; indicative that slower detectors with highest detection resolution is unnecessary, for systems whose safety boundaries provide leeway within safety limits.

翻译：对任何工业控制系统（ICS）中信息物理组件间交互的持续监控，是实现系统控制自动化的安全保障，也是确保工厂流程具备故障安全特性并维持在可接受安全状态的前提。安全性通过管理执行动作（利用电信号触发物理运动）来实现，该动作依赖于相应的传感器读数——这些读数作为决策制定的基准真相。在ICS中及时检测异常（攻击、故障及未确证状态）对于工厂安全运行、人员安全以及所提供服务的可靠性至关重要。我们提出一种异常检测方法，该方法对传感器-执行器关系产生的非线性形式进行精确线性化处理，主要原因在于线性模型求解更为简便且已有成熟理论支撑。我们通过使用著名的水处理测试平台作为案例验证该方法。实验表明，该方法能在毫秒级时间内检测出异常，且所有异常均可解释、可追溯；这种检测速度与可解释性的同步耦合，是其他用于相同目的的、具备可解释人工智能（XAI）的最先进人工智能（AI）/机器学习（ML）模型尚未实现的。我们的方法通过可解释性能够精确定位检测到异常的传感器及其对应执行状态。所提算法通过将安全运行范围内的偏差标记为非异常，实现了97.72%的准确率——这表明对于安全边界内存在裕量的系统，无需使用检测分辨率最高的低速检测器。