Multi-Level Graph Attention Network-Based Anomaly Detection in Industrial Control System

Industrial control systems (ICSs) are vital to critical infrastructure in energy, manufacturing, and other industries. As ICSs become increasingly interconnected, their complexity grows, making them more vulnerable to cyber attacks and system failures. This growing complexity underscores the critical need for advanced anomaly detection techniques to ensure the safe and reliable operation of ICSs. To address this need, we propose a novel method, the physical process and controller graph attention network (PCGAT), which constructs multi-level graphs based on physical process and controller information. Experiments on two real-world ICS datasets demonstrate that PCGAT achieves superior performance and enables the localization of anomalies within specific physical processes. Moreover, by leveraging graph attention networks (GATs), PCGAT enhances interpretability in anomaly detection.