Physics-guided contrastive temporal graph learning for anomaly detection and root-cause localization in industrial control systems

Industrial control systems generate complex multivariate time series and detecting anomalies without labelled attacks is still difficult. In this work we propose a physics guided contrastive temporal graph learning framework for anomaly detection and root-cause localization in ICS. The method follows three main steps. First, a self-supervised contrastive encoder is trained only on normal data to learn robust representations of sensor windows. Augmented views of the same signal are used so that normal behaviour is pulled together in latent space. Second, a physics guided graph is built from the plant P&ID where sensors and actuators are nodes and physical dependencies form edges. Third, a temporal graph module operates on the learned embeddings to capture both time evolution and cross-sensor relations. Anomaly score is computed from graph representations and node level scores are used to rank possible root causes. Experiments on ICS dataset show higher detection performance than LSTM-AE and CNN-AE baselines. Additional robustness tests such as distribution shift, sensor drift and missing channels are conducted to study practical behaviour. The main innovation of this work is the combination of contrastive learning with physics guided graph reasoning without using any attack labels, and the ability to provide interpretable sensor ranking for operators.