AI That Understands Process Physics in ICS

 From Detection to Decision

Introduction
Industrial Control System (ICS) cybersecurity has long focused on network-based detection. This includes signatures, unusual traffic patterns, protocol issues, and asset discovery. These tools have improved visibility, but they miss the real purpose of industrial systems, which is to keep physical processes safe, stable, and running without interruption.
In reality, this creates a false sense of security. Many OT security programs are good at spotting cyber noise such as scans, malware, or protocol misuse, but they fail to see real operational danger. When an incident happens, teams can often explain what happened on the network, yet struggle to explain why the physical process itself is moving toward failure.
Today’s OT attacks are also changing. Attackers are no longer loud on the network. Instead, they quietly alter control logic, sensor readings, and operating settings while staying within normal network behavior. In these situations, network-based tools may report everything as normal, even as the process slowly becomes unstable.
This blind spot has led to the rise of physics-aware artificial intelligence. These systems focus on how an industrial process should behave, not just how network traffic looks. This paper explains why traditional OT security falls short, how physics-aware AI works, and why it marks a major shift in how industrial systems are defended.
Methods
Limitations of Network-Only OT Security
Network-based OT security usually focuses on a few main areas:
Whether industrial protocols like Modbus, DNP3, and IEC 104 follow expected rules

• How often data is sent and how much traffic is moving

• Detection of known malicious patterns

• Which assets are talking to each other and how

These methods work well for spotting malware spread and basic reconnaissance. However, they break down when:

• Attackers use valid and stolen credentials

• Control commands are technically correct

• Network traffic stays within normal limits

Changes are made slowly to avoid detection thresholds
In these cases, the network appears normal, but the physical process is not.
This gap explains why many OT security operations centers look strong during audits yet struggle during real incidents. Seeing network traffic does not mean understanding risk, and a high number of alerts does not lead to clear decisions. As long as detection stays limited to the network, incident response will remain reactive and uncertain.
Process-Level Attack Scenarios
Documented ICS incidents demonstrate this failure mode clearly:

• Stuxnet manipulated centrifuge speeds while replaying normal sensor values.
  

• Triton/Trisis targeted safety systems using legitimate engineering workflows.
  

• Process drift attacks subtly alter setpoints to degrade quality or cause wear.
  

• Sensor spoofing feeds false data to operators and automated systems.

These attacks succeed because traditional defenses lack awareness of physical constraints, causal relationships, and operational intent.
Definition of Physics Aware AI
Physics-aware AI combines:

• - Models of the process, like mass balance, thermodynamics, and fluid flow

• - How control logic affects different parts of the system

• - Safe operating limits for equipment and processes

• - Rules about cause and effect over time

Instead of asking, “Is this network traffic unusual?” the system asks, “Can the process actually behave this way under the current conditions?”
- This is a major shift. Security moves from just watching the network to checking whether the process itself is operating correctly according to physical laws.
Results
Detection of Stealthy Manipulation
Physics-aware AI shows much better detection in cases where:

• - Sensor readings stay within normal limits individually

• - Control commands are valid and authenticated

• - Network activity looks normal

By analyzing relationships like:

• How inputs affect outputs

• Conservation of energy and materials

• Time based responses of the process

The system can spot impossible or unlikely conditions, such as:

• Pressure rising without corresponding input flow

• Temperature staying stable even when energy is being removed

• Actuator behavior not matching the commands given

• These signs reveal attacks that network based tools cannot see.

Reduction of False Positives
Traditional anomaly detection often floods operators with alerts that do not affect operations. Physics aware systems reduce this noise by:

• Ignoring alerts that do not break physical rules

• Prioritizing deviations that could impact safety or production

• Placing alerts in the context of the overall process state

This approach helps reduce operator fatigue and mental overload, which are common weaknesses in OT security programs.
Improved Incident Response Decision Making
Because alerts are based on physical reality, response teams get:
A clear view of actual operational risk
Faster ability to distinguish between cyber incidents and process problems
Greater confidence in taking containment actions
The result is actionable intelligence that supports decisions, not just simple detection.
Discussion
The Role of Humans in Physics Aware Security
Even with advanced AI, human expertise is still essential for:

• Checking that model assumptions are correct

• Understanding unclear or unusual process changes

• Approving response actions that could disrupt operations

• Updating models when the process changes

• Physics-aware AI does not replace operators or engineers. Instead, it enhances their awareness, letting humans focus on making decisions rather than sorting through noisy alerts.

Impact on OT Incident Response
Physics-aware AI changes how teams respond to incidents:

• Incidents are prioritized by their impact on the process, not by the number of alerts

• Containment decisions take safety limits and recovery plans into account

• Response times improve because there is less uncertainty

This shifts OT cybersecurity from a reactive approach to one guided by operational reality.

Why This Will Be Standard by 2028
Several factors make physics aware AI adoption unavoidable:
Processes are becoming more complex and automated

• Attacks are increasingly AI driven and quiet

• Regulations are focusing more on safety and resilience

• Digital twins and advanced analytics are becoming common

As industrial systems become more digital, security tools that cannot understand physical reality will become a liability rather than protection.

Conclusion
Network-focused OT security spots cyber activity, while physics aware AI spots its effects on the process. Today, attackers often manipulate systems instead of breaking them, so understanding how processes behave is essential.
Moving from simple detection to informed decision-making requires security tools that understand industrial processes. Physics-aware AI provides this ability, helping organizations protect not just networks, but the physical systems that keep modern society running.