Title: From Correlation to Causality: Actuator-Triggered Temporal Logic Monitoring for Multivariate Time-Series Security

Presented by Afsana Afrin, Computing PhD student, Computer Science emphasis

Abstract

Industrial control systems (ICS) produce multivariate time-series data in which attacks may be subtle and temporally structured. Data-driven anomaly detectors can achieve high recall but often generate excessive false alarms and provide limited interpretability. We propose an actuator-triggered temporal-logic monitoring framework that moves from correlation-based deviations to causality-oriented “physics witnesses.” Using normal-operation data, we automatically infer actuator–process relationships from post-toggle response signatures and synthesize Differential Temporal Logic (DTL) rules capturing expected control–response behavior, including no-response-after-toggle constraints and state-conditioned invariants. Rule parameters are calibrated via robust, normal-only quantiles and combined using persistence and  𝑚-of-𝑛 voting to control alert rates. Evaluated on the Secure Water Treatment (SWaT) dataset, the proposed witnesses yield interpretable evidence and reduce false alarms while maintaining timely detection of attack episodes.

Advisor: Dr. Hoda Mehrpouyan

Committee Members: Dr. Jyh-haw Yeh, Dr. Xinyi Zhou

External Examiner: Dr. Hao Chen