RAID: Retrieval Augmented Intrusion Detection for Cyber Physical Systems

This paper presents a Retrieval Augmented Intrusion Detection system (RAID), a three-stage framework for interpretable AI-driven intrusion detection in Industrial Control Systems (ICS). Existing ICS detectors flag anomalies without explaining them, and LLM-based explanations are rarely verified against the detector’s rules or linked to past incidents. Specifically, a resilient isolation forest algorithm is used for its ability to generate structured anomaly interpretations and to mitigate the effects of dangerous data drift. A grounded physics-aware feature engineering process extends the baseline capabilities of this algorithm, including counterfactual evaluation, contrastive analysis, causal chain identification, and redundancy inspection of data streams. Subsequently, a fleet of Large Language Models (LLMs) is used to generate deep natural-language explanations for each anomaly log, under the guidance of an independent LLM orchestrator that produces a final incident report. Finally, a Retrieval-Augmented Generation framework embeds the historical patterns of the recovered events into an accessible index that contains all the log interpretations over time. The entire framework is validated at each stage on the HAI-21.03 dataset: among nine unsupervised detectors, the Isolation Forest provides the most balanced performance (F1 = 0.409, MCC = 0.393, eTaPR F1 = 0.773); 87% of the propositions generated by the language agents exactly match the underlying detection rules; and the retrieval stage reaches 0.998 faithfulness and 0.782 answer correctness.