RuleTwin: Physics-Constrained Rule Induction for Anomaly Detection in Industrial Multivariate Time Serie

With the deep integration of industrial internet technologies, industrial control systems are increasingly exposed to cyber attacks, where malicious behaviors in cyberspace can propagate into physical processes and induce system anomalies. Existing data-driven anomaly detection methods can identify abnormal patterns but remain limited in attack localization and anomaly interpretation. We propose RuleTwin, a physics-constrained rule induction framework that integrates data-driven modeling with domain-specific physical constraints through dual-view rule learning. RuleTwin induces event-view logical rules to capture control semantics and state-view physical consistency rules to constrain multivariate sensor dynamics, enabling unified anomaly detection, localization, and interpretation. Experiments on industrial benchmark datasets against twelve baseline methods demonstrate that RuleTwin achieves superior detection performance while accurately localizing the compromised actuators or sensors in the majority of cyber attack scenarios.