AI-Assisted Resilience Monitoring for Industrial Control System Security

Abstract

Industrial control-system anomaly alarms are most useful when they distinguish unusual telemetry from loss of safety or recovery margin. This paper presents RACER-ICS, an operator-oriented framework that combines a one-step predictive residual, rolling physical invariants, held-out empirical block-quantile calibration, sequential evidence, a soft-state observer, and a fully specified resilience trajectory index (RTI). Temporally dependent accumulated evidence is calibrated by normal-block maxima; the resulting block tail probability is an engineering design index, not a split-conformal coverage guarantee. Predictor fitting, score-reference construction, threshold calibration, development attacks, and final testing use five disjoint traces. All detectors use the same two-second dwell, 30-second release, 120-second cooldown, and 600-second ticket-merge rule. On a frozen 56,000-second three-tank test trace containing 18 attacks, RACER-ICS detects 77.8% of events with 67-s median delay; matched physics+CUSUM detects 83.3% with 5-s delay. Each has one ticket whose onset is outside all labels. Across ten paired noise seeds, their event-recall difference is $-0.050\pm 0.066$ (95% $t$ -interval half-width), while physics+CUSUM is $53.20\pm 3.34$ s faster. A frozen detection-core transfer to five HAI hardware-in-the-loop test files detects only 3 of 50 events (6.0%), demonstrating substantial negative transfer. The proposed detector therefore does not dominate the matched baseline or transfer without adaptation. Its supported contribution is the auditable integration of evidence, observability uncertainty, and recovery-oriented triage. Safety-margin lead time is withheld on HAI because it supplies neither hidden state nor validated safety bounds. The study reports attack-only and recovery-sensitive metrics, six ablations, benign transitions, four trajectory cases, all coefficients, software versions, seeds, and reproducible artifacts.