Temporal-Local Attribution with Domain Knowledge for Explainable Anomaly Detection in Power Industrial Control Networks

Anomaly detection in power industrial control system (ICS) networks is critical for ensuring the safety and reliability of modern power infrastructures. However, the widespread use of deep learning models has introduced significant interpretability challenges, limiting their practical adoption in industrial scenarios. In this paper, we propose a novel temporal-local attribution framework that integrates domain knowledge to provide fine-grained, dynamic, and actionable explanations for anomaly detection models operating on multivariate time-series data in power ICS networks. Specifically, our method combines sliding-window temporal sampling with local perturbation analysis to construct a two-dimensional attribution matrix that reveals the joint impact of critical time points and key features on anomaly decisions. Unlike conventional attribution approaches, our framework explicitly captures temporally localized precursor patterns and incorporates domain knowledge to align explanations with real-world process logic. Furthermore, we incorporate attention-based mechanisms and expert knowledge to enhance the identification of precursor signals and to align explanation outputs with operational logic. Experimental results on public ICS datasets demonstrate that our approach delivers superior interpretability compared to traditional methods such as LIME and SHAP, achieving an average expert interpretability score improvement of 35% and reducing false attribution rates by 28%. In addition, the framework is computationally efficient, introducing less than 10% overhead compared with baseline detectors, making it suitable for real-time deployment. The proposed framework bridges the gap between model performance and real-world usability, enabling transparent, trustworthy, and effective anomaly management in power ICS environments.