Behavioral Knowledge Distillation for Dynamic Graph Anomaly Detection in Trustworthy Power Grid Dispatching

Abstract

Trustworthy anomaly detection in power-grid dispatching requires alerts that are traceable to operational knowledge while satisfying real-time constraints. Existing data-driven detectors do not naturally encode behavioral rules, whereas placing a large language model (LLM) in the online decision loop introduces latency and nondeterministic outputs. We propose K-TRACE-CP, an offline-heavy, online-light framework that represents source-linked behavioral knowledge as numerical prototypes and transfers this supervision to a lightweight attribute-dynamic physical-graph expert. A separately trained cyber–physical expert models 470 process variables and 80 label-agnostic communication features, and threshold-normalized fusion combines their anomaly scores. At inference, the framework retrieves ranked, source-linked behavioral candidates for each alert without LLM calls. On an event-group-held-out split of Sherlock 01-Basic, K-TRACE-CP achieves $0.974\pm 0.012$ attack-window recall, $0.914\pm 0.009$ average precision, and an F1 score of $0.813\pm 0.009$ over three seeds. All four distinct held-out attack events are detected, corresponding to an event recall of 1.000 with an exact 95% confidence interval of 0.398–1.000. A non-overlapping-window evaluation retains $0.973\pm 0.016$ recall and $0.903\pm 0.010$ average precision. The controlled prototype-ranking experiment achieves Hit@1 of $0.954\pm 0.023$, supporting family-level behavioral retrieval. The primary Sherlock evaluation uses manually compiled prototypes, while an independent physical-testbed experiment evaluates few-shot LLM-compiled knowledge in downstream graph training. The complete 127,386-trainable-parameter online path requires a median of 1.412 ms per sample on an RTX 3060. These results support source-grounded, computationally lightweight anomaly detection and offline behavioral-knowledge transfer in the evaluated simulated and laboratory settings.

1. Introduction

Power-grid dispatch anomaly detection aims to identify operational deviations from continuous cyber–physical states and determine whether they conflict with established operational rules. As machine learning models are increasingly integrated into security-critical power-grid monitoring and dispatch-support systems, detection accuracy alone is insufficient: operational deployment also requires models to be reliable, auditable, and understandable to human operators. These requirements become increasingly important as large-scale renewable integration and frequent operating-mode changes shift dispatching from relatively fixed-condition analysis toward highly constrained, multi-device decision making.

The problem is challenging because an anomaly is rarely manifested as a single threshold violation. A single attack or abnormal event may simultaneously affect process measurements, physical dependencies, and communication behavior. Multivariate time-series and graph-neural detectors therefore attempt to learn sensor dependencies and temporal propagation patterns [1,2,3]. However, in security-critical applications, a detector that only outputs an anomaly score remains difficult to audit and operationally validate. Such models do not naturally provide regulation-grounded interpretations because their learning signals are primarily derived from observed data, such as event labels, prediction errors, or structural patterns, rather than explicit natural-language constraints such as “which subject may perform which action.” This lack of source-grounded interpretability can make it difficult for operators to verify alarms, distinguish meaningful violations from false positives, and trace model outputs to operational knowledge. Large language models (LLMs) offer a potential means of extracting such semantic knowledge from textual materials. However, directly embedding a generative model into a security-critical online detection loop introduces not only latency and computational overhead but also reliability concerns arising from hallucination, prompt sensitivity, and service-version changes [4,5]. These properties complicate deterministic verification, reproducible deployment, and operator trust in time-sensitive anomaly-detection systems.

A natural direction is therefore to transform semantic knowledge from operational sources into inspectable numerical supervision for lightweight detectors. However, power-grid dispatching lacks a natural one-to-one alignment between high-level regulation clauses and second-level cyber–physical sensor windows. This makes direct language-to-graph transfer difficult and motivates an auditable intermediate representation connecting behavioral knowledge with graph-based learning. We therefore use source-linked behavioral prototypes as explicit supervisory targets. Unlike conventional knowledge distillation [6], the primary Sherlock detector does not use soft targets from an LLM teacher; the end-to-end LLM experiment is reported separately on an independent physical testbed.

To this end, we propose K-TRACE-CP, an offline-heavy and online-light framework for cyber–physical attribute-dynamic graph anomaly detection. The formal Sherlock experiments use silver behavioral records and prototypes manually compiled from official Sherlock event descriptions; they are source-linked but are not independently adjudicated expert annotations or dispatch-regulation clauses. A constrained LLM and deterministic ontology rules populate the same schema in auxiliary experiments, and an end-to-end physical-testbed study uses the generated banks to train the downstream graph student. As illustrated in Figure 1, the physical-graph expert learns anomaly, behavior-family, and prototype-level objectives under this supervision, while the online path remains independent of generative models.

Figure 1. Overview of K-TRACE-CP. Offline source materials are compiled into validated, source-linked records and numerical prototypes. These supervise the attribute-dynamic physical-graph expert, while an independently trained cyber–physical expert models process and communication sequences. Validation-threshold-normalized fusion produces the anomaly decision, and the online path emits ranked source-linked candidates without an LLM call. Versioned prototype-bank updates are evaluated separately in RQ4.

Relying on a single aggregated representation can undermine detection reliability because different attack manifestations may appear in different cyber–physical views. In particular, an aggregated physical graph can obscure individual process changes and communication-side anomalies that are not explicitly represented by the physical topology. We therefore introduce an independently trained cyber–physical expert that encodes all 470 unaggregated process variables together with 80 label-agnostic communication features derived from network behavior. At runtime, the anomaly scores of the graph expert and the cyber–physical expert are combined through validation-threshold-normalized mean fusion. When an alert is generated, the graph representation retrieves the top-k source-linked prototype candidates, providing traceable behavioral hypotheses and source metadata without invoking an LLM during online inference.

The main contributions of this work are summarized as follows:

• We introduce a source-traceable behavior-knowledge representation for structured behavioral records and learnable prototypes. The primary detector instantiates this interface with Sherlock descriptions, the physical-testbed experiment propagates LLM-generated records through downstream graph training, and RQ4 evaluates successive releases of the official ICS and Enterprise ATT&CK knowledge bases.
• We develop K-TRACE-CP with a prototype-supervised physical-graph expert and an independently trained cyber–physical expert. The graph expert jointly learns anomaly detection, behavior-family discrimination, and prototype-level supervision, while the cyber–physical expert preserves fine-grained visibility of unaggregated process variables and communication behavior. Validation-threshold-normalized fusion modestly increases recall and F1 relative to the cyber–physical expert alone in the evaluated split, although it does not improve AP.
• We design a non-generative online prototype retrieval mechanism that associates detected anomalies with ranked source-linked candidates and provenance metadata. The evaluation quantifies this path against neural baselines with post hoc attribution and a task-matched, zero-shot Qwen2.5-3B online baseline receiving the same cyber–physical-window summary.

2. Related Work

2.1. Cyber–Physical Anomaly Detection in Power Grids

Detecting sophisticated power-grid attacks requires analyzing operational deviations across both communication networks and physical processes, since modern threats may propagate across cyber and physical domains. Foundational studies showed that carefully constructed false-data injections can evade conventional bad-data checks [7] and established system-theoretic conditions for attack detection and identification in cyber–physical systems [8]. Subsequent work formulated smart-grid attack detection as a statistical learning problem [9] and demonstrated deep feature learning for real-time false-data-injection detection [10]. More recent graph-based approaches model cyber-attack event sequences through graph convolution and recurrent encoding [11] or use spatiotemporal graph representations for false-data detection in smart grids [12]. Recent simulation frameworks and dataset benchmarks, such as Wattson [13] and Sherlock [14], have further advanced this field by providing synchronized physical-process states and network packet captures. These environments support process-aware research by enabling models to observe both cyber intrusions and their corresponding effects on operational measurements.

Despite this progress, many existing detectors emphasize either physical-process deviations, unaggregated process sequences, or communication-side anomalies, while fewer jointly integrate topology-aware physical dependencies, fine-grained cyber–physical observations, and source-linked behavioral semantics. Models centered on physical variables may overlook communication-side anomalies before their effects propagate into process measurements, whereas purely network-oriented detectors do not explicitly model the physical dependencies that constrain grid operation. Knowledge graphs and graph neural networks have also been used to organize and trace large volumes of power-monitoring cybersecurity alarms [15], demonstrating the operational value of relational evidence. However, conventional anomaly scores generally indicate distributional deviation but do not directly associate the detected behavior with source records. In contrast, K-TRACE-CP combines a prototype-supervised physical-graph expert with an independently trained cyber–physical expert and links detected anomalies to ranked source-linked behavioral candidates.

2.2. Multivariate and Dynamic-Graph Anomaly Detection

Deep anomaly detection spans reconstruction, one-class learning, representation learning, and related objectives [16], while graph-specific surveys distinguish anomalous nodes, edges, subgraphs, and entire graphs [17]. To capture complex sensor dependencies and temporal propagation patterns, multivariate time-series detectors have progressed from latent-density estimation in DAGMM [18] and stochastic recurrent reconstruction in OmniAnomaly [19] to graph-attention models such as MTAD-GAT [20] and GDN [1]. For attributed graphs, DOMINANT jointly reconstructs topology and node attributes [21], whereas CoLA [22] and ANEMONE [23] introduce local and multi-scale contrastive objectives. AddAG-AE further combines graph attention with an LSTM autoencoder to detect anomalous snapshots in dynamic attributed graphs [24]. Transformer-based detectors, including TranAD [25] and Anomaly Transformer [26], model long-range temporal context and association discrepancies. In parallel, DySAT [27], EvolveGCN [28], and TGAT [29] provide representative mechanisms for learning from evolving graph snapshots or timestamped interactions. Detection-oriented extensions such as TADDY [2] and SLADE [30] use Transformer representations and self-supervised objectives to identify structural and temporal shifts in edge streams, while GeneralDyG [3] targets robust detection under distribution shifts.

These methods establish the importance of relational and temporal modeling, but their learning signals are primarily derived from observed data, including detection labels, reconstruction or prediction objectives, and self-supervised structural signals. Such signals can capture whether an observation deviates from learned patterns, but they do not explicitly encode source-linked operational semantics such as behavioral preconditions, permitted actions, and expected system states. K-TRACE-CP complements data-driven anomaly modeling with a source-grounded prototype interface, allowing the physical-graph expert to learn behavior-family and prototype-level supervision in addition to the anomaly-detection objective.

2.3. Semantic Supervision and Knowledge Distillation

Knowledge distillation has expanded beyond traditional soft-label compression [6] toward transferring semantic or structural knowledge across heterogeneous model architectures. In unsupervised anomaly detection, student–teacher discrepancies have been used as anomaly signals [31], and multi-resolution feature transfer improves the use of intermediate teacher representations [32]. Refined distillation networks further introduce simulated anomalies and multi-scale feature interaction to strengthen student learning [33]. Representative graph-oriented works such as Graph-less Neural Networks [34] demonstrate that knowledge acquired by graph models can be transferred to more inference-efficient architectures. More recently, LinguGKD [35] has aligned language and graph representations across multiple scales on text-attributed graphs, allowing graph models to inherit rich semantic information without retaining the full language model during online inference.

A key challenge in power-grid dispatching is that this transfer lacks a natural one-to-one alignment between textual knowledge and numerical graph observations. Existing language–graph settings commonly assume that textual attributes can be associated with specific nodes or graph instances, whereas dispatch regulations are typically high-level clauses describing conditional subjects, actions, and expected states. Such clauses cannot be directly paired with second-level cyber–physical sensor windows. K-TRACE-CP therefore introduces a structured behavior-knowledge interface between source materials and graph learning. In the primary evaluation, source-linked silver prototypes compiled from Sherlock event descriptions provide semantic supervision for graph training. The independent physical-testbed evaluation then replaces an oracle bank with constrained-LLM outputs and propagates their errors through downstream graph training. The evidence therefore supports end-to-end LLM-to-graph transfer for benchmark scenario descriptions, but not yet regulation-to-detector transfer on operational utility data.

2.4. Continual Graph Learning

Continual learning aims to acquire new tasks or classes while limiting catastrophic forgetting of previously learned knowledge, which is important for long-term model deployment [36]. Within graph domains, methods such as ER-GNN [37] use experience replay to retain representative historical nodes during model updates. SEA-ER [38] further introduces structure-evolution-aware replay to mitigate the effects of graph-topology changes while preserving both node-level and structural knowledge.

However, regulation updates introduce a different form of change. Moving from one policy edition to another may alter behavioral conditions, action semantics, or expected operating states rather than merely changing numerical features or graph structure. We therefore study regulation-version assimilation as an auxiliary extension of the primary anomaly-detection framework. Specifically, K-TRACE-CP evaluates a replay- and consistency-based update mechanism on a controlled regulation-version retrieval proxy to examine whether newly introduced source-linked behavioral knowledge can be incorporated while preserving previously learned prototypes. This experiment is treated separately from the main detection claims and serves to explore the broader challenge of reliable rule-update assimilation in practical grid-dispatch deployments.

3. Materials and Methods

Figure 1 summarizes the complete offline-training and online-inference pipeline of K-TRACE-CP. The framework combines source-linked behavioral supervision, dual-expert anomaly detection, and non-generative online inference. The methodology then describes behavior-knowledge formulation, offline compilation, graph and cyber–physical learning, score fusion, source-linked retrieval, and a controlled prototype-bank update.

3.1. Problem Formulation

3.1.1. Source-Linked Behavior Knowledge

Let $\mathcal{S}={\left\{d_m\right\}}_{m=1}^M$ denote offline source documents, including regulation clauses, contingency plans, event descriptions, and confirmed expert examples. A behavior record is

$$k_j=(s_j,a_j,o_j,c_j,{\tau }_j,x_j^{\ast },r_j,{\rho }_j),$$

(1)

where $s_j$, $a_j$, and $o_j$ are the subject, action, and object; $c_j$ is a precondition; ${\tau }_j$ is a temporal relation; $x_j^{\ast }$ is an expected state; $r_j$ is a risk level; and ${\rho }_j$ stores source-document and source-record identifiers. The versioned store is ${\mathcal{K}}^{\left(v\right)}={\left\{k_j\right\}}_{j=1}^K$. Each record has the eight conceptual fields in Equation (1); the source field ${\rho }_j$ remains metadata and is not embedded. The other seven fields are deterministically expanded into ten model inputs: subject, action, object, precondition, temporal relation, expected-state class, expected-state direction, expected-state range, risk level, and source-type indicator. Categorical fields use fixed enumerations and numerical ranges are normalized. The resulting representation is denoted by ${\mathit{q}}_j{\in }^{d_q}$, where $d_q=10$.

3.1.2. Attribute-Dynamic Graph Windows

At second t, the physical system is represented as

$$G_t=(\mathcal{V},\mathcal{E},{\mathit{X}}_t),$$

(2)

where $\mathcal{V}$ and $\mathcal{E}$ are physical buses/devices and connections, and ${\mathit{X}}_t$ contains time-varying node attributes. The formal dataset has a fixed physical edge set; “dynamic graph” therefore refers to an attribute-dynamic graph sequence rather than topology rewiring. For a length-T window $W_i=[t_i-T+1,t_i]$, let ${\mathcal{G}}_i={\left\{G_t\right\}}_{t\in W_i}$, ${\mathit{S}}_i\in {\mathbb{R}}^{T\times d_s}$ be the unaggregated process sequence, and ${\mathit{C}}_i\in {\mathbb{R}}^{T\times d_c}$ be communication behavior. Each window has an anomaly label $y_i$, event group $g_i$, and behavior-family label $f_i$.

Train, validation, and test sets satisfy event-group isolation:

$$\{g_i:i\in {\mathcal{D}}_p\}\cap \{g_i:i\in {\mathcal{D}}_q\}=⌀,p\ne q.$$

(3)

This prevents overlapping windows from the same event from crossing splits and defines the family-stratified, event-held-out protocol used throughout the primary evaluation.

3.1.3. Detection and Retrieval Tasks

The detector outputs anomaly score $a_i$ and decision ${\widehat{y}}_i$. If ${\widehat{y}}_i=1$, it also returns

$${\mathcal{R}}_i={TopK}_{k_j\in {\mathcal{K}}^{\left(v\right)}}sim({\mathit{z}}_i,{\mathit{p}}_j),$$

(4)

where ${\mathit{z}}_i$ is the graph-window representation and ${\mathit{p}}_j$ is a behavior prototype. RQ1 uses window recall, event recall, precision, F1, average precision (AP), and false-positive rate (FPR). RQ2 uses Prototype Hit@k and detection AP. RQ3 measures parameters, complete alert-path latency, LLM calls/tokens, and record completeness. RQ4 uses old-knowledge retention, new-knowledge accuracy, forgetting, and Macro-F1. Completeness and semantic correctness are deliberately separate metrics.

3.2. Offline Behavior-Knowledge Compilation

The offline compiler maps each source document to the schema in Equation (1). It can use a field-constrained LLM prompt or a deterministic ontology rule for stable templates. Records must pass type, enumeration, and source-identifier checks before entering the store. The numerical record is encoded as

$${\mathit{p}}_j={\displaystyle \frac{g_{\varphi }\left({\mathit{q}}_j\right)}{{\parallel g_{\varphi }\left({\mathit{q}}_j\right)\parallel }_2}},{\mathit{p}}_j\in {\mathbb{R}}^{d_p}.$$

(5)

The index retains source-document, source-record, and source-URL fields, while the run-level provenance manifest records the knowledge-file hash.

The formal Sherlock detector uses source-linked silver prototypes manually compiled from official event descriptions as supervisory targets through prototype and behavior-family objectives. They are not independent expert annotations. The auxiliary extraction benchmark evaluates whether constrained LLM and deterministic compilers can populate the same interface; the physical-testbed propagation experiment additionally substitutes these generated records for the oracle bank during downstream graph-student training. We therefore distinguish the manually supervised primary Sherlock pipeline from the end-to-end LLM-compiled auxiliary pipeline rather than implying that the primary scores were obtained from LLM-generated prototypes.

3.3. Physical-Graph Expert

For window i and step t, the graph input is ${\mathit{X}}_{it}\in {\mathbb{R}}^{N\times 43}$ with $N=15$. Four core channels and 39 auxiliary channels are projected separately. A learned scalar gate limits the auxiliary branch:

$$\begin{array}{cc}\hfill {\mathit{H}}_{it}^{\left(0\right)}& =W_c{\mathit{X}}_{it}^c+\alpha W_a{\mathit{X}}_{it}^a+\mathit{E},\alpha =\sigma \left(\gamma \right),\hfill \end{array}$$

(6)

$$\begin{array}{cc}\hfill {\mathit{H}}_{it}^{\left(1\right)}& =GELU\left(W_s{\mathit{H}}_{it}^{\left(0\right)}+W_n\tilde{A}{\mathit{H}}_{it}^{\left(0\right)}\right),\hfill \end{array}$$

(7)

where $\mathit{E}$ is a learned node embedding and $\tilde{A}$ is the self-looped, symmetrically normalized physical adjacency matrix. Attention pooling and max pooling form a graph vector ${\mathit{h}}_{it}$, and a GRU encodes the temporal sequence:

$${\mathit{z}}_i^g={GRU}_g({\mathit{h}}_{i1},\dots ,{\mathit{h}}_{iT}).$$

(8)

The GRU output is projected into the same $d_p$-dimensional prototype space as the behavior prototypes, such that ${\mathit{z}}_i^g,{\mathit{p}}_j\in {\mathbb{R}}^{d_p}$.

The graph expert has anomaly, family, and prototype heads. Prototype logits use temperature-scaled cosine similarity:

$${\mathsf{\ell }}_{ij}^p={\displaystyle \frac{cos({\mathit{z}}_i^g,{\mathit{p}}_j)}{\kappa }},\kappa =0.120.$$

(9)

Let $s_i=\sigma \left(a_i\right)$ denote the anomaly probability produced from anomaly logit $a_i$. The primary Sherlock detector uses the anomaly-ranking loss

$${\mathcal{L}}_{ar}={\displaystyle \frac{1}{q^2}}\sum _{i\in {\tilde{\mathcal{P}}}_b}\sum _{j\in {\tilde{\mathcal{N}}}_b}max\left(0,m_a-s_i+s_j\right),m_a=0.350,$$

(10)

where ${\mathcal{P}}_b$ and ${\mathcal{N}}_b$ are the anomalous and normal samples in a minibatch, respectively; $q=min\left(\right|{\mathcal{P}}_b|,|{\mathcal{N}}_b|,64)$; and the tilded sets contain the first q samples of each class after minibatch shuffling. We set ${\mathcal{L}}_{ar}=0$ when either class is absent. The complete primary graph-expert objective is

$${\mathcal{L}}_g={\mathcal{L}}_{det}+0.250{\mathcal{L}}_{fam}+0.300{\mathcal{L}}_{proto}+0.120{\mathcal{L}}_{ar},$$

(11)

where ${\mathcal{L}}_{det}$ is binary cross-entropy and ${\mathcal{L}}_{fam}$ and ${\mathcal{L}}_{proto}$ are categorical cross-entropies. Thus, ${\mathcal{L}}_{ar}$ ranks anomalous samples above normal samples and is distinct from the prototype-ranking loss used only in the controlled RQ2 transfer experiment.

3.4. Cyber–Physical Expert

Graph aggregation can hide individual process changes, and the physical graph cannot represent ARP activity, TCP flags, or endpoint diversity. A separate expert encodes all 470 process variables and 80 communication features:

$$\begin{array}{cccc}\hfill {\mathit{z}}_i^s& ={GRU}_s\left({\mathit{S}}_i\right),\hfill & \hfill {\mathit{z}}_i^c& ={GRU}_c\left({\mathit{C}}_i\right),\hfill \end{array}$$

(12)

$$\begin{array}{cc}\hfill {\mathit{z}}_i^{cp}& =LN\left(GELU(W_f[{\mathit{z}}_i^s\parallel {\mathit{z}}_i^c]+{\mathit{b}}_f)\right),\hfill \end{array}$$

(13)

$$\begin{array}{cc}\hfill s_i^{cp}& =\sigma ({\mathit{w}}_{cp}^{\top }{\mathit{z}}_i^{cp}+b_{cp}).\hfill \end{array}$$

(14)

The state and communication GRUs use 48 and 40 hidden units, respectively, and their fused representation has 64 dimensions. This expert is independently optimized with binary cross-entropy. The two experts share the split and validation protocol but not parameters or optimization trajectories.

3.5. Validation-Threshold-Normalized Fusion

For expert $e\in \{g,cp\}$, the highest validation threshold satisfying target recall $r_0=0.980$ is

$${\tau }_e=max\{\tau :{Recall}_{val}(s_i^e\ge \tau )\ge r_0\}.$$

(15)

The online score and decision are

$$a_i={\displaystyle \frac{1}{2}}\left({\displaystyle \frac{s_i^g}{{\tau }_g}}+{\displaystyle \frac{s_i^{cp}}{{\tau }_{cp}}}\right),{\widehat{y}}_i=\mathbb{I}[a_i\ge {\tau }_f],$$

(16)

where ${\tau }_f$ is selected from the validation set by the same rule. This is operating-point normalization, not probability calibration. Test labels are never used to select thresholds.

Proposition 1 

(positive-scale invariance). If an expert score and its validation threshold are both rescaled by any constant $c_e>0$, then $c_e{s}_i^e/\left(c_e{\tau }_e\right)=s_i^e/{\tau }_e$; hence the fused score and decision in Equation (16) are unchanged. This property motivates threshold normalization when the two expert heads have different score scales.

Proposition 2 

(Top-1 prototype stability). Let $\mathit{z}$ and all prototypes be unit normalized, and let the winning prototype $j^{\ast }$ have cosine gap $\gamma ={\mathit{z}}^{\top }{\mathit{p}}_{j^{\ast }}-{max}_{j\ne j^{\ast }}{\mathit{z}}^{\top }{\mathit{p}}_j$. If a normalized perturbation ${\mathit{z}}^{\prime }$ satisfies ${\parallel {\mathit{z}}^{\prime }-\mathit{z}\parallel }_2\le ϵ$ and $\gamma >2ϵ$, then $j^{\ast }$ remains Top-1. Indeed, Cauchy–Schwarz bounds the change of each cosine score by $ϵ$, so the winning gap after perturbation is at least $\gamma -2ϵ>0$. This gives a directly checkable sufficient condition; it is not a guarantee when the empirical gap is small.

3.6. Source-Linked Alert Records

If ${\widehat{y}}_i=1$, the graph embedding ranks prototypes using Equation (9). Each JSONL record contains the timestamp, fused anomaly score, decision threshold, top-three prototype candidates, source-document and source-record identifiers, evidence text, source URL, and online LLM call/token counters. A provenance manifest separately stores data, code, checkpoint, and knowledge-corpus hashes. Record generation reads model outputs and the knowledge index but not test labels.

Algorithm 1 summarizes the LLM-free online scoring, decision, and source-linked retrieval procedure.

Algorithm 1 LLM-free online detection and source-linked retrieval

Require:  Window $({\mathcal{G}}_i,{\mathit{S}}_i,{\mathit{C}}_i)$, trained experts, validation thresholds $({\tau }_g,{\tau }_{cp},{\tau }_f)$, prototype store ${\mathcal{K}}^{\left(v\right)}$ 1: $s_i^g,{\mathit{z}}_i^g\leftarrow f_g\left({\mathcal{G}}_i\right)$ 2: $s_i^{cp}\leftarrow f_{cp}({\mathit{S}}_i,{\mathit{C}}_i)$ 3: $a_i\leftarrow \frac{1}{2}(s_i^g/{\tau }_g+s_i^{cp}/{\tau }_{cp})$ 4: if $a_i\ge {\tau }_f$ then 5:     ${\mathcal{R}}_i\leftarrow {Top3}_{k_j\in {\mathcal{K}}^{\left(v\right)}}cos({\mathit{z}}_i^g,{\mathit{p}}_j)$ 6:     Emit $(t_i,a_i,{\tau }_f,{\mathcal{R}}_i,{\rho }_{{\mathcal{R}}_i},\mathtt{llm}\_\mathtt{calls}=0)$ 7: end if

3.7. Constrained Prototype-Bank Update

For a transition from ${\mathcal{K}}^{\left(v\right)}$ to ${\mathcal{K}}^{(v+1)}$, the updater represents every query and source record through three complementary views: frozen MiniLM semantic embeddings [39], character n-gram features, and closed-schema behavioral vectors. Newly inserted prototypes are initialized from the corresponding source records. Let ${\mathcal{B}}_{new}$ denote new-version examples and ${\mathcal{B}}_{rep}$ denote balanced replay examples from the preceding version. The complete update objective is

$${\mathcal{L}}_{inc}={\mathcal{L}}_{new}+{\mathcal{L}}_{replay}+0.7{\mathcal{L}}_{cons}+0.35{\mathcal{L}}_{topo},$$

(17)

where ${\mathcal{L}}_{new}$ and ${\mathcal{L}}_{replay}$ are classification losses. The consistency term is the KL divergence between the frozen pre-update teacher distribution and the updated student’s logits on replay examples. For view $u\in \{sem,char,beh\}$, let ${\overline{P}}_u$ be the row-normalized full prototype bank and let $T_u^{\left(0\right)}={\overline{P}}_u^{\left(0\right)}{\overline{P}}_u^{\left(0\right)\top }$ be its pairwise cosine-similarity matrix immediately after source initialization. The topology-preservation term is

$${\mathcal{L}}_{topo}=\sum _{u\in \{sem,char,beh\}}{∥{\overline{P}}_u{\overline{P}}_u^{\top }-T_u^{\left(0\right)}∥}_F^2.$$

(18)

After each optimization step, the four old-version prototypes are restored to their pre-update anchors. Consequently, only the six inserted prototypes and shared calibration parameters absorb the new regulation version while the preceding prototype bank remains fixed.

4. Experimental Design

4.1. Sherlock Data and Temporal Construction

The primary detector experiment uses Sherlock 01-Basic [14,40], a CIGRE 15-bus medium-voltage scenario with synchronized process and network data. It contains 43,204 consecutive one-second states, 470 raw process variables, 28 labeled event groups, and 831,757 packets from four switch mirror ports. We extract 80 unlabeled per-second communication features: packet and byte volumes, protocol counts, TCP flags, endpoint and flow cardinalities, delivery statistics, and packet-size statistics. Features undergo $log(1+x)$ transformation, training-split z-score normalization, and clipping. Event descriptions, attack names, labels, and event IDs are not model inputs.

We construct 3814 event-contained windows of 12 s at stride 3; adjacent windows overlap by 9 s, but no window crosses an event boundary. Family-stratified event-group assignment produces 19/4/5 train/validation/test event groups and 2399/630/785 windows. The test set contains 455 attack and 330 normal windows, with four attack events. No event group, second, or window crosses splits, yielding a leakage-controlled event-held-out evaluation. Table 1 summarizes the primary dataset split.

Table 1. Sherlock 01-Basic data used in the formal experiment.

Item	Value
Consecutive process states	43,204 s
Raw process variables	470
Physical topology	15 buses
Parsed packets	831,757
Communication features	80 from 4 mirrors
Window length/stride	12 s/3 s
Event-contained windows	3814
Train/validation/test windows	2399/630/785
Test attack/normal windows	455/330
Train/validation/test event groups	19/4/5

We further evaluate topology transfer with Sherlock v3 [41]. The topology-agnostic student removes learned node-identity embeddings, parses each published grid SVG, and pools over a variable number of buses. Complete events from the Semiurban test recording are partitioned into train, validation, and test groups; Rural remains test-only and does not influence scaling, early stopping, or threshold selection. The high-sensitivity operating point is the highest Semiurban validation threshold attaining at least 0.980 attack-window recall. Table 2 summarizes these additions. The independent MSU/ORNL/UAH dataset [42] was acquired on a physical laboratory power-system testbed containing two generators, four protective relays/IEDs, four breakers, and two transmission lines. It supplies 78,377 snapshots from 15 files and 37 event scenarios, including cyber attacks, natural disturbances, and normal operation, with 116 synchrophasor measurements and 12 control/log/security features. Files 1–9, 10–12, and 13–15 form train, validation, and test partitions for cross-file detection and structured-supervision evaluation. This is non-simulated laboratory apparatus data, but it is not confidential production-grid traffic.

Table 2. Additional evaluation data. Semiurban and Rural are distinct Sherlock scenarios; MSU/ORNL/UAH is an independent source.

Dataset	Nodes	Groups	Samples	Train/Val/Test	Protocol
Sherlock 02-Semiurban	178	39 events	5815	4234/677/904	Within topology
Sherlock 03-Rural	99	36 events	5535	0/0/5535	Zero-shot transfer
MSU physical testbed	4 IEDs	37 classes	78,377	9/3/3 files	Cross-file test

4.2. Knowledge Materials

An auxiliary extraction benchmark contains 37 short official scenario descriptions. Three are demonstrations and 34 non-demonstration descriptions form the primary evaluation. The formal Sherlock prototypes are manually compiled from public sources and dataset event definitions to isolate downstream behavior. The LLM propagation study replaces the oracle MSU bank with zero-shot or few-shot records and retrains the downstream graph student. RQ4 uses ten source-grounded records describing a PRC-024-3 to PRC-024-4 transition and 40 version-implicit queries, plus official MITRE ATT&CK for ICS and Enterprise STIX releases 8.0, 10.1, 12.1, 14.1, 16.1, and 18.1 [43] for two larger five-transition assimilation tests.

To evaluate compiler-to-detector propagation on the primary benchmark, we add a matched compiler-substitution experiment on Sherlock. A frozen Qwen2.5-3B compiler receives the six source descriptions and the same ten-field schema, produces a complete JSON record for every description, and replaces only the manual prototype bank. Data splits, model architecture, optimizer, seeds, checkpoint selection, and threshold rule are held fixed. We additionally evaluate a controlled fact-preserving lexical-shift set of the 34 descriptions to distinguish closed-template accuracy from robustness to wording changes. This lexical stress test complements, but does not replace, future evaluation on long-form regulations.

4.3. Baselines and Training Protocol

RQ1 compares Random Forest, State-GRU, STGNN, the earlier K-TRACE graph/state model, and compact protocol-matched implementations of GDN, TranAD, and MTAD-GAT with K-TRACE-CP. Isolation Forest is omitted from comparative interpretation because its all-positive operating point is not informative. Every neural baseline receives the same label-agnostic 470 process variables and 80 communication features; only its published dependency/temporal mechanism differs. State-GRU encodes the unaggregated process sequence. The reported STGNN implementation uses physical topology and temporal encoding with behavior-family supervision, but without prototype alignment or prototype-ranking objectives; the graph detection-only variant evaluated later is the knowledge-free graph comparator. K-TRACE-CP combines the prototype-supervised graph expert with an independently trained cyber–physical expert through threshold-normalized mean fusion. All methods use the same 785 test windows, and the comparison between K-TRACE and K-TRACE-CP is evaluated at the complete-pipeline level.

The primary RQ1 neural models use AdamW with learning rate $1.5\times {10}^{-3}$, weight decay $2\times {10}^{-4}$, batch size 128, a global gradient-norm limit of 2.0, and at most 40 epochs. Training stops after eight epochs without validation-AP improvement, and the best validation-AP checkpoint is retained. The controlled RQ2 retrieval student instead uses AdamW with learning rate $1.2\times {10}^{-3}$, weight decay $2\times {10}^{-4}$, batch size 128, patience 10, and validation Hit@1 for checkpoint selection; the retained raw results record 11–99 executed epochs across its seed–variant runs. Reported values are means and sample standard deviations over seeds 17, 29, and 43 on the same split unless a table states otherwise. Expert and fusion thresholds use validation data only. The deployment benchmark uses Python 3.11.9, PyTorch 2.11.0+cu126, CUDA 12.6, and an NVIDIA GeForce RTX 3060. Strict deterministic mode, input hashes, checkpoints, and per-window predictions are retained for the primary experiment.

The temperatures, margins, and loss weights in Equations (9)–(20) are fixed design constants shared by all formal seeds; they are not tuned separately for individual test runs. Model checkpoints are selected by validation AP for RQ1 and validation Hit@1 for the controlled RQ2 student, and the test set is used only after selection. The available experiment record does not support a claim of globally optimal hyperparameters or an exhaustive search over the small four-event-group validation split. We therefore treat possible validation-set overfitting as a limitation and report independent perturbation seeds and component ablations rather than interpreting the selected constants as uniquely optimal.

As a dependence sensitivity check, we retain every fourth test window within each event group. This changes the effective stride from 3 s to 12 s, so adjacent retained 12 s windows share no seconds. The trained models and validation-selected thresholds remain unchanged. We report this non-overlapping analysis separately from the primary protocol; it reduces temporal redundancy but does not increase the number of independent attack events.

For the direct comparison with TranAD, we additionally use a paired event-group block bootstrap. We request 10,000 resamples of the five held-out event groups with replacement; 9997 contain both classes and are retained, while three no-positive resamples are omitted because AP is undefined. Each valid replicate computes the AP difference for matched seeds 17, 29, and 43 and averages the three paired differences. The reported 95% interval is the 2.5th–97.5th percentile range. This procedure is applied to both the primary and non-overlapping protocols and therefore uses event groups, rather than individual windows, as the resampling unit.

The controlled RQ2 transfer experiment uses a separate prototype-retrieval student. Its prototype logits use temperature ${\kappa }_{RQ2}=0.100$, and its hard-negative prototype-ranking loss is

$${\mathcal{L}}_{pr}={\displaystyle \frac{1}{B}}{\displaystyle \sum _{i=1}^B}max\left(0,m_p-{\mathsf{\ell }}_{i{j}_i^{+}}^p+\underset{j\ne j_i^{+}}{max}{\mathsf{\ell }}_{ij}^p\right),m_p=1.000,$$

(19)

where $j_i^{+}$ is the source-linked target-prototype index and the inner maximum selects the hardest competing prototype. The complete RQ2 objective is

$${\mathcal{L}}_{RQ2}={\mathcal{L}}_{det}+0.350{\mathcal{L}}_{attr}+0.450{\mathcal{L}}_{align}+0.800{\mathcal{L}}_{proto}+1.200{\mathcal{L}}_{pr},$$

(20)

where ${\mathcal{L}}_{attr}$ is binary cross-entropy against the behavior-attribute vector, ${\mathcal{L}}_{align}=1-B^{-1}{\sum }_{i}cos({\mathit{z}}_i^g,{\mathit{p}}_{j_i^{+}})$, and ${\mathcal{L}}_{proto}$ is categorical cross-entropy over prototype logits. The no-knowledge variant retains only ${\mathcal{L}}_{det}$; the prototype-alignment variant uses ${\mathcal{L}}_{det}+0.350{\mathcal{L}}_{attr}+0.450{\mathcal{L}}_{align}$; and the no-topology and complete variants use Equation (20), differing only in whether physical message passing is enabled.

5. Results

5.1. Research Questions

We organize the evaluation around four research questions examining anomaly-detection performance, controlled prototype retrieval, online-path cost, and constrained prototype-bank updating.

• RQ1 (Detection effectiveness): Can the complete framework accurately detect anomalous power-grid dispatch behavior under an event-group-held-out evaluation protocol?
• RQ2 (Prototype supervision): Does source-linked prototype supervision enable the controlled graph student to retrieve the intended violated prototype rather than learning only binary attack labels?
• RQ3 (Online efficiency and source-linked candidates): Can the detector produce anomaly scores and structurally traceable candidate records at low latency without invoking an LLM, how accurate is their semantic ranking, and what is the measured trade-off against a task-matched online LLM baseline?
• RQ4 (Version-update feasibility): Across a controlled regulation proxy and multiple official ICS and Enterprise knowledge-base releases, can newly introduced behavioral records be incorporated without degrading retrieval of retained records?

5.2. RQ1: Detection Effectiveness

Table 3 reports means and sample standard deviations across three optimization seeds. The test prevalence is 455/785 = 0.580, which is also the no-skill AP reference. The protocol-matched public detectors also recover every attack event, but their high-sensitivity operating points produce FPRs from 0.788 to 0.964. K-TRACE-CP reaches $0.974\pm 0.012$ window recall, $0.697\pm 0.018$ precision, $0.914\pm 0.009$ AP, and $0.813\pm 0.009$ F1. The recalls for seeds 17, 29, and 43 are 0.960, 0.985, and 0.978, respectively. All four unique held-out attack events are detected; the exact 95% binomial confidence interval for event recall is 0.398–1.000. Relative to TranAD, the paired AP difference is $0.297\pm 0.009$ across the matched seeds.

Table 3. RQ1 results on the event-group-held-out test set, reported as mean ± sample standard deviation over three seeds. † denotes a compact, protocol-matched reimplementation rather than an author-reported result. Bold values indicate the best result in each metric column. The no-skill AP is 0.580.

Method	Win. Recall	Event Recall	Prec.	FPR	AP	F1
Random Forest	$0.968\pm 0.056$	$1.000\pm 0.000$	$0.598\pm 0.032$	$0.905\pm 0.164$	$0.669\pm 0.060$	$0.738\pm 0.007$
GDN †	$1.000\pm 0.000$	$1.000\pm 0.000$	$0.589\pm 0.002$	$0.964\pm 0.009$	$0.608\pm 0.006$	$0.741\pm 0.002$
TranAD †	$1.000\pm 0.000$	$1.000\pm 0.000$	$0.638\pm 0.039$	$0.788\pm 0.137$	$0.616\pm 0.001$	$0.779\pm 0.029$
MTAD-GAT †	$1.000\pm 0.000$	$1.000\pm 0.000$	$0.594\pm 0.005$	$0.944\pm 0.019$	$0.598\pm 0.007$	$0.745\pm 0.004$
State-GRU	$0.931\pm 0.092$	$0.917\pm 0.144$	$0.645\pm 0.046$	$0.719\pm 0.206$	$0.576\pm 0.021$	$0.759\pm 0.028$
STGNN	$0.887\pm 0.032$	$0.750\pm 0.000$	$0.654\pm 0.010$	$0.645\pm 0.015$	$0.583\pm 0.020$	$0.753\pm 0.017$
K-TRACE	$0.933\pm 0.093$	$0.917\pm 0.144$	$0.635\pm 0.039$	$0.747\pm 0.176$	$0.573\pm 0.019$	$0.754\pm 0.035$
K-TRACE-CP	$0.974\pm 0.012$	$1.000\pm 0.000$	$0.697\pm 0.018$	$0.585\pm 0.058$	$0.914\pm 0.009$	$0.813\pm 0.009$

Table 4 audits validation-best-F1 thresholds using the same scores and seeds. GDN and TranAD become more selective but obtain test F1 values of 0.374 and 0.389. The matched K-TRACE-CP rerun retains approximately 0.908 threshold-free AP, while its transferred threshold yields low recall and zero observed FPR, distinguishing score ranking from operating-point stability.

Table 4. Validation-best-F1 audit on Sherlock, reported as mean ± sample standard deviation over three seeds. Thresholds use validation data only; AP is threshold independent and its no-skill value is 0.580. † denotes a compact protocol-matched reimplementation.

Method	Recall	Precision	FPR	AP	F1
GDN †	$0.279\pm 0.010$	$0.566\pm 0.007$	$0.295\pm 0.005$	$0.608\pm 0.006$	$0.374\pm 0.010$
TranAD †	$0.292\pm 0.005$	$0.583\pm 0.004$	$0.288\pm 0.000$	$0.616\pm 0.001$	$0.389\pm 0.005$
MTAD-GAT †	$0.500\pm 0.433$	$0.571\pm 0.038$	$0.476\pm 0.333$	$0.598\pm 0.007$	$0.483\pm 0.241$
K-TRACE-CP, manual matched rerun	$0.048\pm 0.064$	$0.667\pm 0.577$	$0.000\pm 0.000$	$0.908\pm 0.019$	$0.086\pm 0.114$
K-TRACE-CP, Qwen matched rerun	$0.080\pm 0.070$	$0.667\pm 0.577$	$0.000\pm 0.000$	$0.908\pm 0.012$	$0.143\pm 0.124$

The non-overlapping analysis in Table 5 retains the validation thresholds: AP changes from $0.914\pm 0.009$ to $0.903\pm 0.010$, event recall remains 4/4, and the FPR corresponds to $179.310\pm 9.123$ false alerts per observed normal hour at 12 s sampling. This remains a high-sensitivity research operating point.

Table 5. Dependence sensitivity for K-TRACE-CP. The non-overlapping protocol retains every fourth within-event window without changing models or thresholds. No-skill AP is 0.580 at 3 s and 0.561 at 12 s.

Protocol	Recall	Event Recall	Precision	FPR	AP	F1
3 s stride	$0.974\pm 0.012$	$1.000\pm 0.000$	$0.697\pm 0.018$	$0.585\pm 0.058$	$0.914\pm 0.009$	$0.813\pm 0.009$
12 s stride	$0.973\pm 0.016$	$1.000\pm 0.000$	$0.675\pm 0.009$	$0.598\pm 0.030$	$0.903\pm 0.010$	$0.797\pm 0.006$

The high-sensitivity point implies approximately 702 false alerts per observed normal hour at 3 s stride, versus $179.310\pm 9.123$ at 12 s. At a validation-normal budget of 60 alarms/h, the Qwen-compiled rerun obtains $1.000\pm 0.000$ precision, $0.198\pm 0.178$ window recall, $0.750\pm 0.433$ event recall, and zero observed test false positives. Under attack prevalence $\pi$, implied precision is $\pi \mathrm{TPR}/[\pi \mathrm{TPR}+(1-\pi \left)\mathrm{FPR}\right]$: 0.156, 0.017, and 0.002 for $\pi =0.10$, 0.01, and 0.001; no-skill AP is $\pi$.

Table 6 reports a controlled compiler substitution. Replacing only the manual bank with Qwen-compiled records preserves mean AP to three decimals and event recall but does not improve semantic ranking; these point estimates are not an equivalence test.

Table 6. Matched Sherlock prototype-bank substitution, mean ± sample standard deviation over three seeds. Other settings are fixed; event recall is 1.000 for both rows. Hit@k uses attack windows; no-skill AP is 0.580.

Prototype Bank	Recall	AP	F1	Hit@1	Hit@3
Manual silver	$0.803\pm 0.176$	$0.908\pm 0.019$	$0.751\pm 0.059$	$0.000\pm 0.000$	$0.496\pm 0.074$
Qwen compiled	$0.803\pm 0.177$	$0.908\pm 0.012$	$0.754\pm 0.044$	$0.000\pm 0.000$	$0.404\pm 0.210$

Table 7 reports the event-group block-bootstrap comparison with TranAD; the AP-difference interval retains a positive lower bound under both the primary and non-overlapping protocols.

Table 7. Paired AP comparison with TranAD. The 95% intervals use 9997 valid paired event-group block-bootstrap replicates from 10,000 resamples, averaging matched-seed AP differences per replicate. No-skill AP is 0.580 at 3 s and 0.561 at 12 s.

Protocol	K-TRACE-CP AP	TranAD AP	AP Difference	95% Block CI
3 s stride	$0.914\pm 0.009$	$0.616\pm 0.001$	$0.297\pm 0.009$	[0.005, 0.712]
12 s stride	$0.903\pm 0.010$	$0.601\pm 0.002$	$0.302\pm 0.012$	[0.018, 0.720]

Table 8 holds data, architecture, optimization, validation rules, and seeds fixed while removing one loss term. The complete graph objective raises recall and F1, but not AP, over detection-only training; removing ${\mathcal{L}}_{fam}$ causes the largest AP and F1 decrease. Its zero attack-window Hit@1 shows that these objectives do not yet ensure online attribution. The cyber–physical expert supplies most pipeline AP; normalized fusion slightly raises recall and F1 while changing AP from 0.919 to 0.914.

Table 8. RQ1 leave-one-loss-out and fusion variants, mean ± sample standard deviation over three seeds. Hit@1 uses attack windows for graph rows and is inapplicable to cyber–physical and fusion rows. No-skill AP is 0.580.

Variant	Recall	FPR	AP	F1	Hit@1
Detection only	$0.656\pm 0.217$	$0.485\pm 0.152$	$0.658\pm 0.067$	$0.642\pm 0.107$	$0.317\pm 0.282$
Complete graph objective	$0.822\pm 0.150$	$0.545\pm 0.139$	$0.628\pm 0.080$	$0.737\pm 0.058$	$0.000\pm 0.000$
Complete minus ${\mathcal{L}}_{fam}$	$0.611\pm 0.264$	$0.488\pm 0.046$	$0.572\pm 0.046$	$0.604\pm 0.176$	$0.000\pm 0.000$
Complete minus ${\mathcal{L}}_{proto}$	$0.716\pm 0.140$	$0.534\pm 0.044$	$0.577\pm 0.022$	$0.677\pm 0.080$	$0.136\pm 0.236$
Complete minus ${\mathcal{L}}_{ar}$	$0.784\pm 0.211$	$0.609\pm 0.032$	$0.607\pm 0.030$	$0.696\pm 0.124$	$0.000\pm 0.000$
Cyber–physical expert only	$0.960\pm 0.040$	$0.584\pm 0.071$	$0.919\pm 0.011$	$0.805\pm 0.022$	–
Raw-score mean fusion	$0.946\pm 0.094$	$0.558\pm 0.112$	$0.871\pm 0.048$	$0.804\pm 0.027$	–
Threshold-normalized mean fusion	$0.974\pm 0.012$	$0.585\pm 0.058$	$0.914\pm 0.009$	$0.813\pm 0.009$	–

5.3. RQ2: Controlled Prototype Supervision and Retrieval

Table 9 reports controlled transfer fidelity. The no-knowledge student obtains 0.208 Hit@1 and 0.549 Hit@3; prototype alignment raises these to 0.736 and 0.915, while removing topology gives 0.438 Hit@1. The complete student adds the ranking loss ${\mathcal{L}}_{pr}$ in Equation (19) and reaches $0.954\pm 0.023$ Hit@1, versus $0.973\pm 0.006$ for the family-emission baseline. Because each attack family has one violated prototype, RQ2 supports family recovery rather than fine-grained within-family ranking.

Table 9. RQ2 retrieval on independently generated test perturbations. Hit@k is computed over the four violated attack prototypes; attribute accuracy covers all six behavior families. Values are mean ± sample standard deviation over three seeds. Bold values indicate the best result in each applicable metric column.

Variant	Hit@1	Hit@3	Attribute Acc.
No knowledge supervision	$0.208\pm 0.038$	$0.549\pm 0.053$	$0.501\pm 0.054$
Prototype alignment	$0.736\pm 0.344$	$0.915\pm 0.130$	$0.878\pm 0.132$
No physical topology	$0.438\pm 0.090$	$0.813\pm 0.088$	$0.727\pm 0.019$
Predict family, emit unique prototype	$0.973\pm 0.006$	$0.998\pm 0.002$	–
Graph expert + ranking	$0.954\pm 0.023$	$0.999\pm 0.001$	$0.941\pm 0.025$

The auxiliary extraction test instantiates the schema from short descriptions. On 34 original descriptions, Qwen2.5-3B [44] improves exact match from 0.235 zero-shot to 0.676 few-shot, while a deterministic rule obtains 1.000. On fact-preserving unseen wording templates, few-shot Qwen obtains 0.529 versus 0.147 for the rule, with 0.588 family, 0.971 line, 1.000 risk, and 0.971 exact-subject accuracy. Table 10 shows that few-shot compilation broadens lexical coverage, although family errors still limit general regulation-language claims.

Table 10. Auxiliary extraction results on 34 non-demonstration short descriptions.

Extractor	Original	Lexical Shift
Qwen2.5-3B, zero-shot	0.235	–
Qwen2.5-3B, few-shot	0.676	0.529
Deterministic ontology rule	1.000	0.147

The graph-and-ranking student improves over positive-only and no-topology variants but not the family-emission baseline. Thus, structured supervision recovers benchmark-defined families; multiple prototypes per family and independently worded sources are needed to test finer attribution.

5.4. RQ3: Online Efficiency and Source-Linked Candidates

RQ3 benchmarks 500 timed single-sample repetitions after 50 warm-ups on an RTX 3060 (Windows, Python 3.11.9, PyTorch 2.11.0+cu126). We report detector-only and forward-evidence latency: baselines emit their three largest standardized residuals, whereas K-TRACE-CP ranks intrinsic prototypes. Measurements include device-to-host transfer and output construction.

Table 11 uses forward-only evidence paths. GDN and TranAD are faster; prototype retrieval and serialization add 0.088 ms to K-TRACE-CP, and all P95 values remain well below the 3 s sampling interval. The supported claim is real-time operation without an online LLM.

Table 11. Single-sample RTX 3060 latency over 500 repetitions: median ± sample standard deviation and P95. † denotes a compact protocol-matched reimplementation.

Method	Detection Only (ms)	Forward Evidence (ms)	Evidence P95 (ms)
GDN †	$0.707\pm 0.180$	$0.929\pm 0.252$	1.622
TranAD †	$0.851\pm 0.207$	$1.080\pm 0.300$	1.966
MTAD-GAT †	$1.235\pm 0.250$	$1.471\pm 0.248$	2.144
K-TRACE-CP	$1.324\pm 0.272$	$1.412\pm 0.339$	2.377

The trainable parameter count decomposes into 31,977 parameters in the graph expert and 95,409 in the cyber–physical expert, for 127,386 trainable parameters in total. The six ten-dimensional prototype records contribute 60 stored scalar values and are not trainable network parameters.

A task-matched online Qwen2.5-3B baseline receives summaries of the same 470 process and 80 communication features, excluding labels and event metadata. Its threshold uses 80 validation windows; Table 12 evaluates both systems on 200 fixed test windows. Qwen returns valid JSON but one prototype and two probabilities, giving AP equal to prevalence (0.520), versus 0.893 AP and 0.774 F1 for K-TRACE-CP. Its 981.742 ms median (1010.772 ms P95) includes the complete prompt-to-parse path, versus a hardware-matched 1.412 ms K-TRACE-CP median, a 695.2-fold difference. This zero-shot baseline quantifies the evaluated online alternative, not every possible LLM adaptation.

Table 12. Task-matched online-LLM comparison on 200 fixed Sherlock test windows. K-TRACE-CP uses its formal validation threshold; Qwen uses 80 validation windows. Prevalence and no-skill AP are 0.520. † uses the hardware-matched median from Table 11; bold marks the better result.

Method	AP	Recall	Precision	F1	Median ms
Qwen2.5-3B online	0.520	1.000	0.520	0.684	981.742
K-TRACE-CP †	0.893	0.971	0.643	0.774	1.412

Seed 17 produces 612 complete JSONL records matching 437 true-positive and 175 false-positive alerts, each with timestamp, score, threshold, Top-3 identifiers, source metadata, and LLM counters. Emitted-alert Hit@1/Hit@3 are 0.245/0.592; on true attacks they are 0.000/0.428. Across three seeds, manual-bank attack-window Hit@1/Hit@3 are $0.000\pm 0.000$/$0.496\pm 0.074$, versus $0.000\pm 0.000$/$0.404\pm 0.210$ for Qwen. Unlike the controlled student in Table 9, RQ3 establishes trace construction and cost, not reliable semantic ranking.

5.5. RQ4: Controlled Regulation-Version Update

RQ4 evaluates the PRC-024-3 to PRC-024-4 proxy (four old and six inserted records; 40 queries; five seeds) and fixed MITRE ATT&CK STIX releases 8.0–18.1. The ICS and Enterprise domains provide ten transitions, nine with insertions; 185 techniques are added, retained-bank size ranges from 68 to 655, and the largest bank contains 691 techniques.

The update combines source initialization, balanced replay, consistency, anchoring, and topology preservation; the complete method restores the four old prototypes after each step. Table 13 includes no-hard-anchor and joint-retraining controls. Old retention is 1.000 even without restoration, while random initialization recognizes only $0.125\pm 0.106$ of new records. Source initialization separates all six records, so this proxy primarily demonstrates the value of initialization; the multi-release tests provide the scale evaluation.

Table 13. Controlled RQ4 regulation-version update. Stochastic update methods report mean ± sample standard deviation over five seeds; deterministic retrieval baselines are reported without deviations. Hard restoration guarantees retention of the four old prototypes in the complete method. Bold values identify the complete constrained-update configuration.

Method	Old Ret.	New Acc.	Overall	Macro-F1
Word TF-IDF 1-NN	0.625	0.750	0.700	0.701
Character TF-IDF 1-NN	0.563	0.917	0.775	0.756
Frozen MiniLM 1-NN	0.688	0.625	0.650	0.623
Random-init fine-tune, no hard anchor	$1.000\pm 0.000$	$0.125\pm 0.106$	$0.475\pm 0.064$	$0.349\pm 0.078$
Random-init replay, no hard anchor	$1.000\pm 0.000$	$0.125\pm 0.106$	$0.475\pm 0.064$	$0.349\pm 0.078$
Source initialization only	$1.000\pm 0.000$	$1.000\pm 0.000$	$1.000\pm 0.000$	$1.000\pm 0.000$
Joint retraining, no hard anchor	$1.000\pm 0.000$	$1.000\pm 0.000$	$1.000\pm 0.000$	$1.000\pm 0.000$
Source-init + constrained update	$1.000\pm 0.000$	$1.000\pm 0.000$	$1.000\pm 0.000$	$1.000\pm 0.000$

Table 14 reports the ICS multi-transition test. Prototype text contains the official technique name, tactics, platforms, and source description, while held-out queries mask the technique name and use a description excerpt plus tactics. Random insertion fails for every newly introduced technique. Source initialization retrieves all 15 inserted ICS techniques at Hit@1 across the four insertion-bearing transitions. The 16.1–18.1 transition contains no new ICS technique, so only retained-technique performance is defined for that row.

Table 14. Multi-transition RQ4 test on official MITRE ATT&CK for ICS STIX releases. Values are Hit@1 mean ± sample standard deviation over five seeds. “Old” is evaluated on retained techniques and “new” on techniques first appearing in the new release.

Transition	Method	Retained	Inserted	Old Hit@1	New Hit@1
8.0→10.1	Random insertion	68	10	$0.956\pm 0.000$	$0.000\pm 0.000$
	Source initialization	68	10	$0.956\pm 0.000$	$1.000\pm 0.000$
	Source-init + replay	68	10	$0.921\pm 0.013$	$1.000\pm 0.000$
10.1→12.1	Random insertion	78	1	$0.949\pm 0.000$	$0.000\pm 0.000$
	Source initialization	78	1	$0.949\pm 0.000$	$1.000\pm 0.000$
	Source-init + replay	78	1	$0.903\pm 0.007$	$1.000\pm 0.000$
12.1→14.1	Random insertion	79	2	$0.962\pm 0.000$	$0.000\pm 0.000$
	Source initialization	79	2	$0.962\pm 0.000$	$1.000\pm 0.000$
	Source-init + replay	79	2	$0.949\pm 0.032$	$1.000\pm 0.000$
14.1→16.1	Random insertion	81	2	$0.963\pm 0.000$	$0.000\pm 0.000$
	Source initialization	81	2	$0.963\pm 0.000$	$1.000\pm 0.000$
	Source-init + replay	81	2	$0.943\pm 0.011$	$1.000\pm 0.000$
16.1→18.1	Random insertion	83	0	$0.964\pm 0.000$	—
	Source initialization	83	0	$0.964\pm 0.000$	—
	Source-init + replay	83	0	$0.940\pm 0.000$	—

Table 15 repeats the identical protocol on the substantially larger Enterprise ATT&CK domain. Across five transitions and 170 inserted techniques, source initialization obtains new-technique Hit@1 values from 0.935 to 1.000. Balanced replay obtains 0.976–1.000 and improves the two most difficult insertion transitions from 0.952 to 0.976 and from 0.935 to 0.994. Together with the ICS results, all nine insertion-bearing transitions achieve at least 0.935 Hit@1 with source initialization and at least 0.976 with balanced replay. The result shows that the source-initialization behavior persists from tens to hundreds of retained techniques and through a 691-technique bank.

Table 15. Cross-dataset RQ4 test on Enterprise ATT&CK. Values are Hit@1 mean ± sample standard deviation over five seeds. The source-initialization rows are deterministic under the frozen encoder.

Transition	Retained	Inserted	Source Old	Source New	Replay Old	Replay New
8.0→10.1	524	42	0.931	0.952	$0.949\pm 0.002$	$0.976\pm 0.000$
10.1→12.1	564	30	0.943	0.967	$0.941\pm 0.004$	$0.980\pm 0.018$
12.1→14.1	594	31	0.943	1.000	$0.941\pm 0.005$	$1.000\pm 0.000$
14.1→16.1	625	31	0.944	0.935	$0.940\pm 0.003$	$0.994\pm 0.014$
16.1→18.1	655	36	0.942	1.000	$0.940\pm 0.004$	$1.000\pm 0.000$

5.6. Additional Dataset and Topology-Transfer Results

Table 16 reports the two additional Sherlock scenarios. K-TRACE-TA denotes the topology-agnostic graph student with prototype supervision, whereas STGNN-TA removes this supervision. On held-out Semiurban events, K-TRACE-TA obtains $0.937\pm 0.057$ attack-window recall and $1.000\pm 0.000$ attack-event recall. Without retraining or threshold adjustment, transfer from the 178-node Semiurban network to the 99-node Rural network obtains $0.914\pm 0.149$ attack-window recall and $0.976\pm 0.041$ attack-event recall. However, the corresponding FPRs of $0.868\pm 0.142$ and $0.928\pm 0.124$ preclude a claim of successful operational transfer. The results establish variable-size execution and retained sensitivity, while showing severe specificity degradation and substantial seed variability.

Table 16. Additional Sherlock results at the Semiurban validation-recall target of 0.980. Values are means ± sample standard deviations over three random seeds. Bold values indicate the best result within each transfer protocol and metric. The evaluation-set no-skill AP is 0.663 for Semiurban and 0.606 for Rural.

Protocol	Method	Window Recall	Event Recall	FPR	AP	F1
02 → 02	STGNN-TA	$0.947\pm 0.067$	$1.000\pm 0.000$	$0.918\pm 0.096$	$0.770\pm 0.023$	$0.784\pm 0.044$
02 → 02	K-TRACE-TA	$0.937\pm 0.057$	$1.000\pm 0.000$	$0.868\pm 0.142$	$0.792\pm 0.021$	$0.788\pm 0.024$
02 → 03	STGNN-TA	$0.807\pm 0.180$	$0.905\pm 0.090$	$0.819\pm 0.176$	$0.621\pm 0.013$	$0.684\pm 0.066$
02 → 03	K-TRACE-TA	$0.914\pm 0.149$	$0.976\pm 0.041$	$0.928\pm 0.124$	$0.623\pm 0.041$	$0.723\pm 0.055$

The independent MSU/ORNL/UAH snapshot dataset provides a complementary cross-file structured-supervision evaluation. As shown in Table 17, structured supervision raises behavior-family Macro-F1 from $0.111\pm 0.017$ to $0.278\pm 0.003$ and relay-subject Micro-F1 from $0.430\pm 0.031$ to $0.559\pm 0.018$ relative to hard-label graph training. The observed attack AP is approximately 0.869 for both objectives. Thus, structured supervision improves semantic attribute prediction without an observed anomaly-ranking improvement on this independent dataset.

Table 17. Cross-file MSU/ORNL/UAH results. Panel A compares student objectives over three random seeds; Panel B evaluates knowledge banks used in downstream graph-student training over five random seeds. Values are mean ± sample standard deviation. Bold values indicate the best result within each panel and metric. The test prevalence and no-skill AP are both 0.721.

Configuration	Attack AP	Attack F1	Family F1	Subject F1
Panel A: Student-objective comparison
Hard labels	$0.869\pm 0.007$	$0.767\pm 0.002$	$0.111\pm 0.017$	$0.430\pm 0.031$
Logit KD	$0.868\pm 0.001$	$0.771\pm 0.006$	$0.116\pm 0.016$	$0.423\pm 0.050$
Attribute MTL	$0.871\pm 0.003$	$0.761\pm 0.004$	$0.276\pm 0.004$	$0.537\pm 0.025$
Structured KD	$0.869\pm 0.003$	$0.767\pm 0.005$	$0.278\pm 0.003$	$0.559\pm 0.018$
Panel B: End-to-end compiled-knowledge comparison
Oracle schema	$0.871\pm 0.002$	$0.770\pm 0.008$	$0.276\pm 0.007$	$0.558\pm 0.012$
Qwen2.5-3B, zero-shot	$0.872\pm 0.002$	$0.772\pm 0.016$	$0.174\pm 0.011$	$0.425\pm 0.019$
Qwen2.5-3B, few-shot	$0.872\pm 0.004$	$0.777\pm 0.009$	$0.271\pm 0.009$	$0.529\pm 0.007$

To test compilation errors end to end, we additionally replace the oracle MSU behavior bank with records produced by the zero-shot and few-shot Qwen2.5-3B compilers, then retrain and evaluate the same graph student on the held-out files. Thus, unlike the isolated 34-description extraction score, the generated records in Table 17 actually enter the downstream training objective. Few-shot compilation produces a similar observed attack AP ($0.872\pm 0.004$ versus $0.871\pm 0.002$ with the oracle schema) and F1, but reduces family F1 from $0.276\pm 0.007$ to $0.271\pm 0.009$ and subject F1 from $0.558\pm 0.012$ to $0.529\pm 0.007$. Zero-shot compilation produces substantially lower semantic scores while its observed attack AP remains similar. The result is consistent with end-to-end transfer of automatically compiled behavioral supervision on this physical testbed, while again showing that the supervision mainly affects attribution rather than binary detection.

6. Discussion

The evaluation provides complementary evidence across the simulated Sherlock dispatch scenario, a non-simulated physical laboratory testbed, and versioned knowledge-base transitions. In the primary Sherlock 01-Basic experiment, K-TRACE-CP detects all four distinct held-out attack events and maintains comparable attack-window recall and average precision under the non-overlapping-window protocol. The event-group block-bootstrap comparison also retains a positive AP advantage over TranAD under both windowing settings. These findings show that the detection performance is not dependent on the 75%-overlapping evaluation alone. The high-sensitivity operating point is designed to prioritize attack coverage, while the alarm-budget and prevalence analyses quantify how thresholds can be adjusted for different operational requirements. Longer normal-operation streams, temporal aggregation, and site-specific alarm budgets can further support deployment-oriented calibration.

The MSU/ORNL/UAH experiment extends the evaluation from simulation to physical laboratory apparatus using a cross-file split. The Sherlock experiment evaluates source-linked silver prototypes, whereas the physical-testbed experiment propagates few-shot LLM-compiled knowledge through downstream graph training. The comparable attack AP obtained with oracle and LLM-compiled knowledge indicates that automated offline compilation can be incorporated without reducing the primary detection objective. The controlled retrieval experiments further demonstrate strong family-level behavioral recovery. Deployed candidate retrieval currently provides source-linked triage context, and additional alert-level supervision can strengthen fine-grained prototype ranking for operator-facing attribution. The task-matched online Qwen comparison also confirms the practical value of moving knowledge compilation offline: K-TRACE-CP preserves millisecond inference while avoiding generative calls in the online decision path.

The continual-assimilation experiments broaden the knowledge evaluation to MITRE ICS and Enterprise, covering ten authentic transitions and knowledge bases with up to 655 retained techniques. Source initialization consistently retrieves newly introduced techniques across the insertion-bearing transitions, demonstrating scalable cross-version knowledge transfer within structured behavioral representations. The retained-technique results further motivate replay and retention-aware updating as the knowledge base grows. Across the detection and retrieval experiments, loss weights, temperatures, and margins are fixed across seeds; checkpoints and thresholds are selected exclusively from validation data, and the test sets are reserved for final evaluation.

Together, the results position K-TRACE-CP as an efficient framework for combining cyber–physical anomaly detection with source-linked behavioral supervision. Future work will extend the knowledge layer with independently annotated dispatch regulations, larger compiler-generated prototype banks, heterogeneous knowledge formats, and repeated continual updates. Longer normal-operation streams and, where security requirements permit, de-identified operational data will support site-specific calibration and field validation.

7. Conclusions

We presented K-TRACE-CP, an offline behavioral-knowledge distillation framework with non-generative online cyber–physical graph anomaly detection. On the event-group-held-out Sherlock 01-Basic benchmark, K-TRACE-CP obtains $0.974\pm 0.012$ attack-window recall, $0.914\pm 0.009$ AP, and $0.813\pm 0.009$ F1 over three seeds. The paired AP advantage over TranAD remains positive under event-group block bootstrap for both primary and non-overlapping protocols. All four held-out attack events are detected, although the false-positive rate remains too high for direct operational use and prevalence-adjusted precision declines sharply under rare attacks. Strict loss and fusion ablations show that the cyber–physical expert accounts for most of the pipeline’s AP. The family-emission baseline and deployed retrieval measurements further show that current evidence supports family-level semantic supervision, not reliable fine-grained operator-facing attribution. A matched Sherlock substitution gives the same observed mean AP to three decimals when manual prototypes are replaced by Qwen-compiled records, but compiler wording sensitivity and poor prototype ranking remain. On the independent MSU physical testbed, few-shot LLM-generated knowledge likewise gives a similar observed attack AP while reducing semantic attribution. A fair forward-only latency benchmark gives a 1.412 ms median candidate-producing path for K-TRACE-CP; GDN and TranAD are faster, while all neural methods remain far below the 3 s sampling interval. Across ten MITRE ICS and Enterprise transitions, source initialization achieves at least 0.935 new-technique Hit@1 in every insertion-bearing transition from 68 to 655 retained techniques; the small PRC proxy is explicitly treated as saturated. Overall, the evidence supports lightweight anomaly detection and offline behavioral-knowledge transfer in the evaluated simulated and laboratory settings, while reliable attribution, realistic false-alarm control, continual adaptation, and operational-data validation remain open requirements.