Poisoning-Resistant Anomaly Detection for Industrial Control Systems: A Byzantine-Robust Data Analytics Framework

Industrial Control Systems (ICS) increasingly deploy machine learning-based anomaly detection to secure critical infrastructure, yet these systems remain vulnerable to data poisoning attacks that can compromise the very models designed to protect them.This paper presents a novel Byzantine-robust anomaly detection framework specifically engineered for ICS environments where operational constraints demand both adversarial resilience and real-time performance.We propose a tiered architecture integrating explainable AI validation, causal inference analytics, and adaptive model hardening techniques.Through experiments on adapted UNSW-NB15 and synthetic ICS datasets, we demonstrate that our approach achieves 94.2% attack survivability while maintaining sub-200ms latency constraints.The framework introduces two novel metrics, robustness-to-drift ratio (RDR) and mean-time-to-human-escalation (MTHE), to evaluate defender effectiveness in adversarial OT environments.Our findings indicate that traditional anomaly detection systems can be compromised with as few as 5% poisoned samples, whereas our Byzantine-robust variant maintains detection accuracy above 88% even under 15% poisoning rates, offering practical guidance for critical infrastructure operators deploying AI-driven security systems.