时空注意力图神经网络：用注意力解释因果关系
Spatio-Temporal Attention Graph Neural Network: Explaining Causalities With Attention
AI总结：
提出时空注意力图神经网络（STA-GNN），用于工业控制系统的无监督可解释异常检测，通过动态图建模时空依赖，注意力机制揭示因果关系，并采用共形预测控制误报率。
摘要：
工业控制系统（ICS）支撑关键基础设施，并因操作技术与网络环境的融合面临日益增长的网络物理威胁。虽然基于机器学习的ICS异常检测方法在理论上表现出色，但部署常受限于可解释性差、误报率高以及对系统行为演变（即基线漂移）的敏感性。我们提出一种时空注意力图神经网络（STA-GNN），用于ICS中无监督且可解释的异常检测，该网络同时建模系统的时间动态和关系结构。传感器、控制器和网络实体被表示为动态学习图中的节点，使模型能够捕获物理过程和通信模式之间的相互依赖关系。注意力机制提供影响关系，支持检查检测事件背后的相关性和潜在因果路径。该方法支持多种数据模态，包括SCADA点测量、网络流特征和载荷特征，从而实现统一的网络物理分析。为满足操作需求，我们引入共形预测策略来控制误报率并监控环境漂移下的性能退化。我们的发现强调了模型评估的可能性与局限性，以及ICS异常检测中的常见陷阱。我们的发现强调了可解释、漂移感知的评估对于可靠部署基于学习的安全监控系统的重要性。
英文摘要：
Industrial Control Systems (ICS) underpin critical infrastructure and face growing cyber-physical threats due to the convergence of operational technology and networked environments. While machine learning-based anomaly detection approaches in ICS shows strong theoretical performance, deployment is often limited by poor explainability, high false-positive rates, and sensitivity to evolving system behavior, i.e., baseline drifting. We propose a Spatio-Temporal Attention Graph Neural Network (STA-GNN) for unsupervised and explainable anomaly detection in ICS that models both temporal dynamics and relational structure of the system. Sensors, controllers, and network entities are represented as nodes in a dynamically learned graph, enabling the model to capture inter-dependencies across physical processes and communication patterns. Attention mechanisms provide influential relationships, supporting inspection of correlations and potential causal pathways behind detected events. The approach supports multiple data modalities, including SCADA point measurements, network flow features, and payload features, and thus enables unified cyber-physical analysis. To address operational requirements, we incorporate a conformal prediction strategy to control false alarm rates and monitor performance degradation under drifting of the environment. Our findings highlight the possibilities and limitations of model evaluation and common pitfalls in anomaly detection in ICS. Our findings emphasise the importance of explainable, drift-aware evaluation for reliable deployment of learning-based security monitoring systems.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
