GraphAE: Plant-informed Graph Autoencoder for ICS Anomaly Detection with SHAP-based Explanations

Network timing in industrial control systems (ICS) distorts cross-tag relationships and inflates false alarms. We propose a lightweight graph autoencoder (GraphAE) that encodes plant structure: nodes are tags and edges follow P&ID couplings, with cross-phase links up-weighted 2.5× to capture inter-stage propagation. The model is trained on normal data and scores windows by reconstruction error. On the Secure Water Treatment (SWaT) testbed (N =44), we evaluate GraphAE against a nongraph AE–LSTM and the graph-centric GDN under identical preprocessing. All methods are compared at a matched true-positive rate of 0.90 on A2 and we report AUC–ROC and false-positive rate (FPR) both overall and inside near-prop windows (a ±10-step band around positives). At this operating point, GraphAE attains AUC–ROC =0.861 versus 0.870 for AE–LSTM and 0.841 for GDN. FPR (overall) is 0.507 for GraphAE, 0.533 for AE–LSTM, and 0.689 for GDN. In near-prop regions, FPR is 0.556 for GraphAE, 0.625 for AE–LSTM, and 0.641 for GDN. SHAP analyses with a compact A1 background (2,048 samples) highlight the tags driving high scores and support operator triage. These results show that modeling inter-signal structure reduces false alarms in networking-sensitive regimes without meaningful inference overhead.