Features over Architecture: Physics-Informed Anomaly Detection in Industrial Control Systems

Industrial control systems (ICS) are increasingly targeted by cyberattacks that manipulate physical processes while evading data-driven detectors trained on raw time-series data. This paper extracts 34–41 control-theoretic features, including tracking error, valve mismatch, sensor liveness, and their temporal derivatives, from Proportional–Integral–Derivative (PID) control loops and evaluates them using an Isolation Forest combined with a maximum z-score. On HAI 21.03, Stage 1 achieves a PA-F1 score of 0.8945, detecting 48 out of 50 attacks. On HAI 23.05, Stage 1 attains a PA-F1 score of 0.9210, surpassing seven deep-learning baselines by at least 23 PA-F1 points; the closest baseline, a learned Graph Neural Network (GNN), achieves 0.6890. Re-implementations of ConvBiLSTM-AE (PA-F1 = 0.6689) and TranAD (PA-F1 = 0.6838) on the same evaluation split confirm this performance gap. A controlled USAD experiment, with PA-F1 = 0.7343 for physics features versus 0.6687 for raw Supervisory Control and Data Acquisition (SCADA), demonstrates that the extracted features provide the detection signal independently of the model architecture. Adding a bidirectional Gated Recurrent Unit (GRU) refinement stage improves PA-F1 by 8.1 percentage points on HAI 21.03, but the same stage reduces it by 6.8 percentage points on HAI 23.05, where attacks manifest as brief perturbations; four alternative Stage 2 designs reproduce this degradation. We therefore characterize temporal refinement as beneficial only for sustained-deviation attacks and identify Stage 1 as the primary deployable detector. This study is the first to apply physics-informed features, report both PA-F1 and eTaPR on HAI 23.05, and perform per-window error diagnosis on this dataset. Results show that 10 of 15 detected windows are covered by fewer than 10% of their timesteps, revealing a structural tension between PA-F1 and eTaPR.