Detect First, Explain Later: Training-Free Temporal-Memory Digital Twin Anomaly Detection with Post-Hoc LLM Interpretation for ICS

• Cyber-physical attacks may cause gradual, subtle process deviations, as illustrated by the Oldsmar and Stuxnet incidents.Such attacks can be observable through small, temporally evolving inconsistencies.Source: §1 · p. 1
• Data-driven ICS detectors may be sensitive to distribution shifts, require retraining, and offer limited insight into anomaly causes.The introduction argues for interpretable detection grounded in controlled-process structure.Source: §1 · p. 1
• Constraint-based DTs can detect process-invariant violations transparently, but instantaneous evaluations may miss weak evidence accumulating over time.This can make brief fluctuations difficult to distinguish from prolonged abnormal behavior.Source: §1 · p. 1
• The paper proposes training-free DT detection with temporal context and optional post-hoc interpretation that does not affect detection.Its detector uses process-level invariants, while the interpretation layer supports understanding detected events.Source: §1 · p. 1
• The contributions include temporal memory, gated LLM explanations, evaluation on HAI and BATADAL, and analysis of detection trade-offs.The paper identifies memory as essential and states that the LLM does not affect detection decisions.Source: §1 · p. 2

• [18] combines LSTM sequence learning, Isolation Forest operating envelopes, and DT context for time-aware, event-level monitoring.Source: §2 · p. 2
• [19] pairs DT modeling with SHAP, counterfactuals, and natural-language normalization for operator-facing explanations.Source: §2 · p. 2
• [20] detects temporal correlations statistically and uses SHAP for feature-level root-cause explanations, without DT constraints.Source: §2 · p. 2
• Sayghe et al. [21] fuse physics residuals with LSTM and one-class SVM detection in simulated SCADA attacks, without explicit temporal reasoning.Source: §2 · p. 2
• [1] uses DT discrepancy detection between expected and observed behavior in an industrial control testbed, including stealthy threats.Source: §2 · p. 2
• [22] combines honeynets, SDN, XAI feature selection, and a BO-GRU-LSTM detector for supervised intrusion classification.Source: §2 · p. 2
• Varghese et al. [23] use an open-source ICS DT to generate labeled attack data and benchmark supervised classifiers.Source: §2 · p. 2
• Table 1 groups prior work into DT-plus-ML monitoring and XAI explanation; most rely on training or calibration and handle temporal anomalies implicitly.The paper contrasts these patterns with constraint-based detection, explicit temporal aggregation, and post-hoc reasoning.Source: §2 · p. 2

3 Methodology

• Detection remains deterministic and separate from reasoning: the DT scores constraint violations, while the LLM is reserved for post-detection interpretation.The method is designed to use system dynamics for detection and keep the interpretation layer optional.Source: §3 · p. 2, §3.1 · p. 3

3.1 Overview

• Temporal memory combines persistence and cross-signal context to aggregate weak or intermittent constraint violations into event-level detections.The LLM is optional and does not influence the detection process.Source: §3.1 · p. 2

3.2 Constraint-Based Detection and Temporal Modeling

• A sliding window aggregates violation scores, while DT memory tracks sustained violations and their continuity to distinguish transient deviations from sustained behavior.The memory records active constraints and severity, violation streaks, process domains, and transitions across domains.Source: §3.2 · p. 3

3.2.1 Constraint Design:

• Constraints cover flow–level consistency, actuator–sensor consistency, operating bounds, and rates of change, but require manual or semi-manual engineering.The authors describe a compositional strategy that reuses process-level invariants across subsystems; effort scales primarily with unique process types rather than monitored variables.Source: §3.2.1 · p. 3

3.3 LLM-Assisted Interpretation and Gating

• The LLM interprets structured DT evidence, with indexed constraints and persistence information, and is invoked only when DT evidence exceeds a calibrated gating threshold.Its structured output references constraint identifiers to support operator verification.Source: §3.3 · pp. 3–4

3.4 Operational Workflow

• Each cycle evaluates constraints, updates the window and memory, makes a thresholded detection decision, and independently gates optional LLM interpretation.The dependency runs from constraints to memory to interpretation, not from the LLM back to detection.Source: §3.4 · p. 4

4 Experimental Setup

• The study tests the proposed DT detector under both structured and heterogeneous ICS conditions.The two-dataset evaluation is described as a way to assess different process dynamics and anomaly profiles.Source: §4 · p. 4, §4.1 · p. 4

4.1 Datasets

• HAI and BATADAL provide contrasting evaluation conditions, from structured persistent anomalies to noisier, less localized attacks in a water distribution system.The datasets differ in process structure, noise, and anomaly expression.Source: §4.1 · p. 4

4.2 Preprocessing and Signal Configuration

• Signals are processed in 30-step sliding windows with a one-step stride, without feature engineering beyond basic preprocessing.All signals are used without dataset-specific feature selection; HAI labels are propagated to windows, while BATADAL's label column maps directly to the anomaly target.Source: §4.2 · pp. 4–5

4.3 Detection Configuration

• The detector aggregates constraint violations over a sliding window, applies a threshold calibrated on normal training data, and uses hysteresis to stabilize events.Threshold calibration targets a predefined false positive rate without attack labels or test data; short detection gaps are merged and brief events filtered.Source: §4.3 · p. 5

4.4 LLM Configuration

• The LLM is gated and post hoc: it interprets DT-memory summaries without influencing detection decisions.Its outputs include an explanation, a possible attack stage, and a confidence estimate; calls are limited by a 60-step cooldown and a maximum of 20 per file.Source: §4.4 · p. 5

4.5 Evaluation Metrics

• Evaluation covers point-wise precision, recall, and F1, event recall and false alarm events, detection delay, and qualitative LLM interpretation.An event is counted as detected when a predicted event overlaps a true attack interval; delay averages the time from attack start to first detection.Source: §4.5 · p. 5

4.6 Implementation Details

• The evaluation is offline and benchmark-based, so it does not establish real-time deployment performance.Experiments use the same method and parameter structure independently on each dataset.Source: §4.6 · p. 5

5.1 Ablation Analysis and Role of Temporal Memory

• 0 true positives and 0 detected events on HAI without memory; adding memory yields microaveraged F1 0.31 and event recall 0.655, while BATADAL also fails without memory.The LLM produces nearly identical detection results with or without its interpretation layer, leaving temporal memory as the primary factor enabling detection.Source: Table 4 · p. 6, §5.1 · p. 6, Table 5 · p. 6

5.2 Detection Performance on HAI

• 0.566 mean HAI event recall (range 0.35–0.80) accompanies precision of 0.85 in some cases; waiting for sustained evidence reduces spurious detections but increases delay.The approach is described as training-free and deterministic.Source: §5.2 · p. 6

5.3 Cross-Dataset Evaluation on BATADAL

• 0.60 event recall without adaptation keeps the detector functional on BATADAL, but HAI-derived constraints fit its process dynamics less well.The persistence-based design emphasizes sustained behavior and may detect attack interiors more reliably than onset or recovery phases; the results attribute cross-domain robustness more to temporal aggregation than direct constraint transfer.Source: §5.3 · p. 6

5.4 Comparison with Baseline Methods

• 4 mean false alarm events on HAI and 21 on BATADAL accompany DT detection; IF produces over 300 HAI and 127 BATADAL false alarm events, while BATADAL AE precision is 0.875.The DT approach sacrifices some sensitivity for more stable event-level detections; overall, results indicate partial transferability under domain shift.Source: Table 8 · p. 7, §5.4 · p. 7

6.1 Detection vs Interpretation in ICS Monitoring

• Without temporal memory, the detector identifies no attack events on either dataset; persistence distinguishes sustained anomalies from transient fluctuations.Detection is driven by constraint violations and their temporal aggregation, not learned models or statistical assumptions.Source: §6.1 · p. 7
• The LLM interprets DT-derived evidence post hoc and does not affect detection, preserving deterministic decisions while adding structured explanations.The discussion argues for explicitly decoupling detection from higher-level reasoning.Source: §6.1 · pp. 7–8

6.2 Robustness Under Varying Data Conditions

• HAI’s persistent constraint violations support more stable detection, whereas BATADAL’s weaker, less consistent violations reduce precision and increase false alarms despite moderate event-level recall without retraining.The authors attribute the difference to clearer process-level deviations in HAI and higher variability in BATADAL.Source: §6.2 · p. 8
• Temporal aggregation and hysteresis wait for sustained evidence, reducing fragmented detections and false alarms at the cost of latency.The discussion favors this trade-off in slower or supervisory monitoring, while safety-critical or fast-control settings may need lower-latency mechanisms alongside it.Source: §6.2 · p. 8

6.3 Implications for Practical Deployment

• The method is positioned as a stable first-line monitoring layer, with training-free operation and an optional gated LLM for structured explanations.The LLM’s effectiveness is bounded by DT detection quality; under weak or ambiguous evidence it may produce low-confidence outputs or abstain.Source: §6.3 · p. 8, §6.2 · p. 8

6.4 Limitations and Future Directions

• Detection reliability depends on constraints matching process dynamics, and local-relationship constraints may miss complex cross-subsystem interactions in large or distributed ICS.Heterogeneous systems require domain-specific constraint design.Source: §6.3 · p. 8, §6.4 · p. 8
• Fixed thresholds and gating are calibrated per dataset, so changing noise or process behavior may limit generalization across operating regimes.The authors identify adaptive or data-driven thresholding as a possible robustness improvement.Source: §6.4 · p. 8
• LLM interpretation is evaluated qualitatively, and offline experiments do not establish real-time latency, continuous-monitoring scalability, or operational-system integration.Quantitative reasoning assessment is limited by the absence of annotated attack-stage or progression datasets.Source: §6.4 · p. 8

7 Conclusion

• The method combines training-free, process-level constraint detection and temporal aggregation with gated post-hoc LLM interpretation that does not influence detection decisions.The LLM supplies structured interpretations while detection remains based on the DT constraints.Source: §7 · pp. 8–9
• Temporal memory is essential: without it the detector misses attack events, while adding memory enables consistent event-level detection across HAI and BATADAL.On BATADAL, the method remains functional without retraining, although precision degrades under domain shift.Source: §7 · p. 9
• The approach prioritizes low false alarm rates and interpretability as a lightweight alternative for early-stage deployment and operational monitoring, with effectiveness dependent on constraint alignment.It retains functionality across datasets without retraining.Source: §7 · p. 9
• Future work targets richer constraint modeling, robustness under heterogeneous conditions, quantitative interpretation evaluation, and real-time operational integration.Source: §7 · p. 9