Where Does Detection Fail? A Residual-Evidence Diagnostic Workflow for Industrial Control Systems

Residual-based anomaly detectors for industrial control systems (ICS) convert model residuals into anomaly scores and alarms, but final detection metrics provide little guidance on which component to examine when performance is poor. We present a retrospective diagnostic workflow built around covariance-normalized residual energy (CNRE), a measurement based on squared Mahalanobis distance. The workflow evaluates whether the normal reference still describes the evaluation recording, whether attacks separate from normal operation under a specified reference, and how scoring and alarm rules use fixed residuals. Across fifteen detector–dataset pairs spanning five detectors on SWaT, WADI, and HAI, reference updates improve attack–normal separation in some cases but degrade it in others. A retrospective policy that updates the reference only when recommended by a label-free screening rule increases mean AUC from 0.751 with no update and 0.759 with unconditional updating to 0.809. On the twelve non-GDN pairs, which did not inform the screening boundaries, the corresponding AUC is 0.805, compared with 0.759 and 0.747. Rescoring CNRE under a fixed reference reproduces most of the AUC gain from a reference update on WADI, but not on SWaT. A detailed GDN case study further connects the diagnostic stages. Normal-only adaptation reduces normal prediction error by 27.3%, yet its effect on attack separation depends on the reference protocol. With residuals fixed, improved score ranking also does not guarantee that normal-calibrated alarms preserve their nominal false-positive rate. Together, these results support diagnosing reference fit, attack evidence, and alarm calibration separately when selecting intervention stages and interpreting their effects.