Summary
Industrial control systems, like those managing water supply, need to detect unusual or harmful behavior even when attackers try to fool these systems. The authors show that protecting these systems against tricky attacks is part of a bigger idea called system resilience, which means how well a system can absorb shocks and keep working safely. They created mathematical tools linking how individual detection parts work to the whole system's ability to handle attacks. Their tests found surprising results, such as improving one part might actually hurt overall safety. This work helps build safer control systems and shape future safety standards.
What this means in practice
- •For industrial control engineers: Evaluate and improve system-wide robustness of anomaly detectors in ICS against stealthy attacks using compositional resilience metrics.
- •For cybersecurity compliance teams: Develop resilience certification guidelines that account for node interactions and absorption capacity in ICS security architectures.
Tested on one dataset.
Abstract
Anomaly-based intrusion detection systems in industrial control systems (ICS) and operational technology (OT) environments are increasingly required to meet formal resilience criteria: absorbed adversarial disturbances, graceful degradation under sustained attack, and certified system-level guarantees. Existing resilience frameworks for cyber-physical systems define absorb-recover-adapt trajectories at the architectural level but do not treat machine learning anomaly detectors as first-class components, leaving a gap between component-level robustness evaluation and system-level resilience certification. In this paper, we establish that adversarial robustness in ICS anomaly detection is a specific instantiation of system resilience, and formalise this connection by mapping four resilience constructs, i.e. disturbance class, absorption capacity, recovery trajectory, and degradation function, onto the adversarial machine learning setting. We derive a compositional resilience bound for heterogeneous ICS detection networks, showing that the binding constraint on system-level resilience is the coupling-adjusted absorption capacity of each node along the attack path, not the per-node capacity -- so the binding node need not be the weakest one. Empirical validation on the BATADAL water distribution system benchmark demonstrates that the resulting metrics surface operationally significant phenomena invisible to standard benchmarks: the absorption-degradation divergence under adversarial training, and the paradox that hardening the binding node in isolation reduces system-level resilience. Implications for ICS architecture design and certification standards are discussed.