## 4 Experiments
### Comparison with Other Methods  
To validate the effectiveness of our approach, we compared it against several representative methods recently applied to the SWaT dataset using the same evaluation metrics. Table 7 summarizes the comparison, which includes traditional baseline methods [9; 10; 11], deep learning-based baselines [19; 20; 21; 23], and an invariant rule-based baseline [32]. Some \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Rule No.** & **Antecedent** & **Consequent** & **Attack Type** & **Recall** & **Precision** \\ \hline
1 & \(167.305<\text{LIT101}<650.699\) and P101 = ON & P102 = OFF & 1 & 0.8978 & 1 \\
2 & \(246.053<\text{AIT201}<272.272\) and \(229.611<\text{LIT101}<678.163\) & P102 = OFF & 2 & 0.8961 & 1 \\
3 & \(153.781<\text{AIT402}<165.234\) and \(262.233<\text{AIT503}<281.705\) & \(413.039<\text{LIT301}<1014.724\) & 7 & 0.9463 & 1 \\
4 & MV302 = OFF and \(0.0<\text{FIT301}<2.359\) & \(0.0<\text{DPT1301}<21.0993\) & 8 & 0.4917 & 1 \\  & and MV304 = ON & & & & \\
5 & \(329.519<\text{AIT203}<336.848\) and \(0.663<\text{FIT501}<1.707\) & P501 = ON & 22 & 0.8509 & 1 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Typical invariant rules mined using the particle swarm optimization algorithm. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Algorithm** & **Accuracy** & **Recall** & **Precision** & **F1-Score** \\ \hline BA & 0.9782 & 0.8239 & 0.9795 & 0.8950 \\ DE & 0.9811 & 0.8676 & 0.9603 & 0.9116 \\ PSO & 0.9804 & 0.8457 & 0.9773 & 0.9067 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Evaluation of invariant rule anomaly detection performance. experimental results are sourced from SiET [20]. For this comparison, we used the hyperparameters specified in the respective papers for each baseline model. As shown in Table 7, while our method exhibits slightly lower performance in recall and F1-score compared to some deep learning-based methods (e.g., SiET), it maintains high precision. This indicates that our method effectively reduces false positives while still identifying most anomalies. Although deep learning-based anomaly detection methods excel in recall and F1-score, their black-box nature poses significant limitations in practical applications. Specifically, these models can detect anomalies but fail to provide specific reasons for the anomalies. As a result, operators must manually inspect numerous sensor or actuator states to identify potential sources of anomalies, which is both time-consuming and complex. In contrast, our method not only accurately detects anomalies but also provides intuitive explanations. Once an anomaly is detected, our method can quickly pinpoint the specific cause and detail how it deviates from normal patterns. For instance, by analyzing a small number of key sensors (typically 2-6) or actuators, operators can rapidly determine the exact location and cause of the anomaly. This capability significantly enhances the efficiency of fault diagnosis, reducing the time and effort required to identify and address issues, thus ensuring the safe and stable operation of the system. For example, one of the typical invariant rules we mined using the PSO algorithm is 810.1662341107707 \(<\) LIT101 \(<\) 1000.0 and P101=ON \(\Rightarrow\) MV101=OFF. Through the system's feedback mechanism, this rule eventually causes MV101 to close. Deviations from this established pattern may indicate an attack or a fault. In the SWaT system, network attacks on MV101 can be effectively identified by this rule. Specifically, in the test set, single stage single point attacks on MV101 are detected with high accuracy, as shown in Figure 8. The recall rate for this rule in detecting the single stage single point attack reached 89.78%, with a precision of 1.0. Furthermore, combining this rule with two other invariant rules for detecting the attack can improve the recall rate to 98.14%. Similarly, the invariant rules we discovered showed good detection performance for single stage multi-point attacks, multi-stage single point attacks, and multi-stage multi-point attacks.