Trustworthy Anomaly Detection for Industrial Control Systems via Conformal Deep Autoencoder

Industrial control systems (ICSs) are critical infrastructures that remain highly vulnerable to both accidental and intentional anomalies, potentially leading to dangerous scenarios. While machine learning (ML) models are increasingly used for anomaly detection in ICSs, concerns about their trustworthiness persist due to their "black-box" nature, lack of effective uncertainty treatment, and absence of prediction guarantees. A key challenge is the high rate of false alarms, which can overwhelm operators and lead to unnecessary shutdowns. To address this, we propose a novel approach integrating deep autoencoders with conformal predictions to achieve high anomaly detection performance while providing statistical guarantees on false alarm rates. Our method uses conformal prediction as a post-hoc technique to enhance uncertainty treatment in a CNN-LSTM autoencoder, yielding trustworthy anomaly detection results with guaranteed false alarm rates. Recognizing temporal distribution shifts in time-series data, we incorporate temporal quantile adjustment to dynamically adapt the anomaly detection threshold, further improving temporal false alarm rate guarantees empirically. We validate the proposed model's ability to detect both accidental and attack-induced anomalies while maintaining a controlled false alarm rate using a publicly available dataset.

Keywords: Anomaly detection, Industrial control systems, Machine learning, Uncertainty treatment, Conformal predictions, Trustworthy AI, Process safety, Process security.