On the Application of Time-Series Foundation Models for Detecting Long-Context Anomalies in Industrial Control Systems

Machine learning (ML) can be used to protect critical, industrial processes. By predicting future industrial-process values, ML models can identify anomalies indicative of harmful malfunctions or cyberattacks. However, training ML models for industrial processes in practice is hindered by the scarcity of high-quality training data and technical expertise. Thus, we explore the application of pre-trained time-series foundation models (FMs) for detecting anomalies in industrial processes. In an evaluation with two time-series FMs and three ICS, we find that FMs struggle to detect long-duration anomalies, which are common when ICS are attacked. We introduce a new time-series forecasting method that filters out suspicious data and uses previously predicted data as input, called Forecast Fallback (FF). We show that FF significantly improves performance for detecting ICS anomalies (i.e., 0.1--0.45 increase in ROC-AUC). Our work demonstrates challenges for using time-series FMs to detect ICS anomalies and illustrates open challenges for future work that uses time-series FMs for critical, industrial processes.