Attack-Level Failure Analysis of Invariant-Rule-Based Anomaly Detection in Industrial Control Systems

Invariant-rule-based anomaly detection is attractive for industrial control systems (ICSs) because its rules are interpretable, auditable, and learnable from normal-operation data alone. However, mined invariants can miss attacks that induce weak, localized, transient, or rule-consistent deviations, because such attacks may not sufficiently violate the specific variable relationships captured by the rules. Aggregate time-step metrics can also obscure these failures, since they do not reveal which documented attack windows remain uncovered. Therefore, we analyze rule-only detection failures at the attack-window level and evaluate a rule-preserving hybrid detector that keeps the original invariant-rule alarm unchanged while adding learned anomaly evidence from per-sensor XGBoost residual models and an Anomaly Transformer. The final alarm uses OR fusion and matched-FPR results are reported as an evaluation-time operating-point analysis under a common system-level false-positive budget. On the SWaT benchmark, the reproduced rule-only detector detects 16/36 attacks at an attack-window recall threshold of 0.05 and 13/36 at 0.4. At the Zhu-matched evaluation-time false-positive budget (α≈0.00447), the pre-specified equal-weight hybrid reaches 19/36 and 16/36, respectively. For localization, SHAP attribution on the XGBoost residual models places the attacked sensor in the top-5 for 70.6% of direct sensor attacks and a variable from the correct process stage in the top-5 for 94.4% of all attacks. These results indicate that rule-preserving residual learning modestly improves attack-level coverage while providing operator-oriented localization evidence rather than definitive root-cause identification.