TF-Detector: Anomaly Detection in Industrial Control System through Process-Aware Time-Frequency Domain Analysis

Anomaly detection in Industrial Control Systems (ICS) is crucial for ensuring operational safety, preventing equipment damage, and maintaining production continuity in critical infrastructure. As ICS become increasingly complex and interconnected, anomaly detection faces significant challenges in maintaining system security and operational integrity. Traditional statistics-based methods fail to capture complex, high-dimensional industrial data patterns. Existing deep learning approaches primarily focus on time-domain analysis, struggling with normal operational noise and system oscillation anomalies, causing detection errors. Additionally, these methods rely solely on data-driven correlation patterns, missing anomalies that violate physical coupling relationships between ICS components, leading to false negatives. In this paper, we propose TF-Detector, a dual-scale anomaly detection framework that decomposes ICS data into time-domain and frequency-domain representations. To capture the process interaction between sensors, TF-Detector employs process graphs enhanced with dynamic correlation patterns to model industrial relationships, and utilizes graph neural networks to extract complex features. Comprehensive evaluations conducted on two real-world ICS datasets demonstrate that our approach significantly outperforms state-of-the-art anomaly detection methods, improving average precision by 15.61% and 2.36%, respectively.