A neural-symbolic dynamic graph framework for real-time anomaly detection in software-defined industrial cyber-physical systems

Abstract

Software-defined industrial cyber-physical systems (SD-ICPS) face emerging security challenges as sensor measurements, system logs, and network traffic become increasingly interconnected under stringent timing requirements. Most existing anomaly detection methods rely on a single modality, provide limited modeling of cross-modal attack evidence, and assume a static graph structure, which restricts their ability to capture topology changes caused by SDN reconfiguration. Given the above deficiencies, this paper introduces NS-MFM-DGA, a neural-symbolic multimodal foundation model that incorporates dynamic graph attention for real-time anomaly detection in SD-ICPS. The framework aligns heterogeneous data through cross-modal contrastive learning, adapts to changes in industrial network topology, and incorporates symbolic domain knowledge to improve interpretability. Experiments on the two public testbed datasets, a synthetic SDN-CPS benchmark and an in-house SD-ICPS testbed, have shown that NS-MFM-DGA achieves a 94.2% F1-score on SWaT with an average inference latency of 23.0 ms. Compared with the ten baselines, it has improved the mean F1-score by 15.2 percentage points over the average of the baselines and by 4.1 percentage points over the best baseline. The measured detector-side inference latency satisfies the 100 ms supervisory detection budget under the evaluated hardware and workload conditions, supporting online deployment at the supervisory monitoring layer. Therefore, NS-MFM-DGA provides a feasible and explainable low-latency anomaly-detection framework for supervisory monitoring in SD-ICPS.