Attack detection based on time series foundation models

The research proposes a cyber-physical system attack detection method that requires no knowledge of the plant model, using zero-shot generation of replacement residuals by Google Research's time series foundation model TimesFM. For replay attacks and stealthy attacks, the paper derives closed-form solutions for optimal stealthy attack strategies against the χ² detector in linear and nonlinear systems. Experiments on the IEEE 14-bus power system show comparable or better detection performance, and TimesFM forecasts can also replace tampered measurement values.