From Detection to Diagnosis: Tcae–dbscan With Lime for Interpretable Ics Anomaly Analysis

Industrial Control Systems (ICS) are frequent targets of cyberattacks, often leading to severe operational and safety consequences. Their continuous, automated operation with minimal human oversight increases the risk of undetected adversarial interference. While deep learning–based anomaly detection methods have shown strong performance in identifying abnormal behaviour, most lack the ability to pinpoint which sensors or actuators drive these detections. In this work, we propose a Temporal Convolutional Autoencoder (TCAE) combined with DBSCAN clustering to detect anomalies in the Secure Water Treatment (SWaT) dataset. The TCAE effectively captures long‑term temporal dependencies and scales efficiently to large datasets. To enhance interpretability, we integrate Local Interpretable Model‑Agnostic Explanations (LIME), which not only identifies the features that positively contribute to an anomaly but also highlights those with negative or negligible influence. This dual perspective enables domain experts to distinguish between primary drivers of abnormal behaviour and unaffected components, improving analysis, targeted mitigation, and user trust in automated detection systems.