Process-Aware Anomaly Detection in Industrial Control Systems Using Frequency-Based Causal Structure Analysis

Critical infrastructures encompass a wide range of process control systems, each with unique security needs. Securing diverse systems is a challenge since they require custom defenses. To address the gap, this study describes a process-aware anomaly detection framework that can automatically baseline the behavior of the process. Utilizing a sliding window Granger causality method, the framework detects time-varying dependencies, allowing it to capture stable and transient causal links across different operational states. Additionally, the anomaly detection framework considers the criticality of various components. The study evaluates the framework on a hardware-in-the-loop (HIL) water tank testbed. The framework successfully identified four sensors and actuator spoofing scenarios on the water tank system.