Industrial Control Systems Research

STIS

State Transition Integrity Scoring for interpretable ICS anomaly detection.

Created by A A Hasnat and published through HNE Technologies.

STIS detects anomalies by scoring transitions between system states, combining sensor deviation, transition rarity, and rule-based control consistency into a single interpretable alert score.

View Repository Read README

Scoring Equation

STIS(t) = alpha * ValueDeviation(t)
        + beta  * TransitionRarity(t)
        + gamma * ConstraintViolationScore(t)

Final public BATADAL default: tuned to emphasize value deviation and transition rarity with zero-delay attack detection.

0.7627 STIS F1 on BATADAL dataset04
0.6164 STIS recall on labeled attack rows
0.0 Mean detection delay

Why It Matters

Transitions are often where ICS attacks reveal themselves.

Value deviation

Flags continuous sensor behavior that departs from learned normal operating patterns.

Transition rarity

Uses a Markov-style state model to catch unlikely control and process transitions.

Constraint violations

Encodes interpretable process rules such as missing flow response or unexpected tank behavior.

Benchmark Snapshot

Public BATADAL benchmark included in the repository.

Model F1 Recall Detection Delay
Windowed Autoencoder 0.9050 0.8265 0.0
LOF 0.8504 0.7397 0.0
One-Class SVM 0.7731 0.6301 0.0
STIS 0.7627 0.6164 0.0
Isolation Forest 0.4792 0.3151 2.0

BATADAL dataset04 contains labeled attack rows and unlabeled rows. This benchmark compares models on the labeled attack subset currently supported in the repo.

Visuals

Generated directly from the repository outputs.

STIS anomaly score timeline for BATADAL
Anomaly score timeline with thresholding over BATADAL labeled evaluation data.
Transition heatmap
Transition model heatmap showing probabilities learned from normal operating transitions.
Top violated constraints
Top rule violations surfaced by the STIS constraint engine.

Get Started

Clone the repo and run the benchmark locally.

python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

python scripts/train_stis.py \
  --dataset-config configs/datasets/batadal.yaml \
  --constraints-config configs/constraints/batadal_rules.yaml \
  --output-dir results/batadal_final