ICSTracker: Backtracking Intrusions in Modern Industrial Control Systems

Applying "provenance analysis" to industrial control systems (ICS) is challenging. Existing research struggles with recovering the physical semantics of controller logic, managing inconsistent state transitions, tracking cross-domain causality, and practical implementation. In this paper, we introduce ICS Tracker, a comprehensive approach that addresses these gaps by using digital twins to collect logs, automatically recovering physical semantics, reconstructing data dependencies, and linking controller operations to OS-level events. Tested on ten attack scenarios across two testbeds, ICSTracker outperforms previous methods, capturing all attack activities where earlier techniques missed 56%.