The 12th International Conference on Fuzzy Systems and Data Mining (FSDM 2026)

Abstract: Industrial Control Systems (ICSs) are at the core of critical infrastructure, where cyberattacks and system anomalies can affect not only digital assets but also the reliability and safety of physical processes. Unlike conventional IT systems, ICSs exhibit strong physical and logical dependencies among sensors, actuators, and controllers, as well as complex temporal behavior and changing operating conditions. These characteristics present unique challenges for AI-driven anomaly detection.
In this talk, I will present our recent research on anomaly detection for ICSs, focusing on how structural and temporal context can be incorporated into AI-based monitoring. We first explore a functional patch-based approach that decomposes complex industrial systems into functionally meaningful units based on their physical and logical relationships. Building on this structural perspective, we introduce DRAMA, a drift-aware memory-augmented spatio-temporal graph attention framework that jointly captures physical topology, behavioral relationships, long-term temporal dependencies, and device-specific drift under evolving operating conditions.
Beyond detecting anomalies, effective ICS monitoring requires operators to understand where an anomaly originates and how it relates to the underlying control process. To address this challenge, we further discuss ICSDiag, which connects anomaly detection with process-aware diagnosis and uses a constrained language-model-based approach to support reliable investigation while reducing unsupported diagnostic claims. Finally, I will discuss emerging challenges in evaluating ICS anomaly detection, highlighting the need to move beyond conventional point-wise metrics toward event-level detection, localization, and operationally meaningful diagnosis.
Keywords: anomaly detection, ICS security, LLM-based diagnosis

Biography: Dr. Donghoon Shin is an Associate Professor in the Department of Electrical Engineering and Computer Science at Daegu Gyeongbuk Institute of Science and Technology (DGIST), Republic of Korea. He received his M.S. and Ph.D. degrees in Computer Science from KAIST, Republic of Korea. Prior to joining DGIST, he worked as a Senior Researcher in the Department of Critical Infrastructure Protection at the National Security Research Institute (NSRI), where he conducted research on cybersecurity for critical infrastructure. His research interests include cybersecurity for industrial control systems (ICS), AI-based anomaly detection, digital twins, and information hiding. His recent research focuses on anomaly detection and diagnosis for industrial systems, automated identification and monitoring of ICS environments, privacy-preserving anomaly detection, and steganography and digital watermarking. He has published his research in international journals and conferences including the IEEE Internet of Things Journal, Computers & Security, IEEE Embedded Systems Letters, IEEE Access, ACM SIGKDD, and Interspeech. He is also actively leading government-funded research projects on digital twin-based fault diagnosis and prediction for power plants and robust information hiding technologies.