CUSUM Algorithm

CUSUM operates by accumulating deviations from a target value over time. Unlike threshold-based methods that look at single data points, CUSUM integrates the difference between each observation and a reference mean. This sequential summation makes it exceptionally sensitive to small, persistent shifts in the process mean, as the cumulative statistic steadily drifts away from zero when a change occurs.

An alarm is triggered when the cumulative sum exceeds a predefined decision interval (H). This threshold is not arbitrary; it is typically selected based on the desired Average Run Length (ARL). A larger H value reduces false alarms but increases the time to detect a real shift. The standard CUSUM is often implemented as a two-sided test, using separate upper (C+) and lower (C-) cumulative sums to detect both increases and decreases in the mean.

The reference value (K), often set to half the magnitude of the shift considered critical, acts as a slack parameter. By subtracting K from each deviation before accumulation, the algorithm filters out random noise and prevents the sum from drifting due to normal variance. This parameter directly tunes the algorithm's sensitivity to a specific magnitude of change, making it optimal for detecting a pre-specified shift size.

While the standard CUSUM assumes normally distributed data, non-parametric CUSUM variants exist for scenarios where the underlying data distribution is unknown or heavy-tailed. These methods operate on ranks or signs of the data rather than raw values, providing robust changepoint detection without distributional assumptions. This is critical in OT environments where sensor noise profiles may not follow a Gaussian distribution.

In industrial control systems, CUSUM is deployed to detect stealthy command injection attacks that subtly modify process parameters over time. Instead of triggering on a single malicious Modbus write, a CUSUM-based detector monitors the cumulative deviation of a sensor reading from its predicted baseline. A slow, deliberate manipulation—such as gradually opening a pressure valve—will eventually cause the cumulative sum to breach the decision interval, alerting operators to a low-and-slow cyber-physical attack.

Shewhart control charts (e.g., X-bar charts) are effective for detecting large, sudden shifts but are statistically weak against small, sustained drifts. CUSUM complements Shewhart charts by integrating historical data. A common hybrid approach uses a Shewhart chart for gross error detection and a CUSUM chart for subtle drift detection. This dual strategy provides comprehensive monitoring coverage for both abrupt faults and gradual degradation in industrial processes.

A foundational sequential hypothesis testing method developed by Abraham Wald that predates and informs CUSUM. SPRT evaluates incoming observations one at a time and makes a decision—accept, reject, or continue sampling—as soon as sufficient evidence accumulates. Unlike fixed-sample tests, SPRT minimizes the expected number of observations required to reach a decision at a given error threshold. In SCADA anomaly detection, SPRT is often used for rapid intrusion detection where minimizing detection delay is critical.

The simplest statistical process control method, which flags an anomaly when a single observation exceeds a threshold—typically three standard deviations from the mean. Unlike CUSUM, Shewhart charts have no memory of past observations, making them insensitive to small, sustained shifts. In ICS environments, Shewhart charts are useful for detecting sudden, catastrophic deviations like a voltage collapse but fail to identify slow, stealthy attacks that gradually drift a process variable out of specification.

A control chart technique that applies geometrically decreasing weights to past observations, giving more influence to recent data. EWMA bridges the gap between Shewhart charts and CUSUM by providing a tunable smoothing parameter λ. A smaller λ gives more weight to historical data, improving detection of small shifts. In operational technology monitoring, EWMA is frequently used for real-time sensor validation, detecting subtle calibration drifts in pressure transmitters and flow meters before they trigger false alarms.

A probabilistic framework that computes the posterior distribution over possible changepoint locations given observed data. Unlike CUSUM's frequentist approach, Bayesian methods quantify uncertainty about whether and when a change occurred. The technique models the run length—the time since the last changepoint—and updates beliefs recursively. In SCADA security, Bayesian changepoint detection excels at identifying multiple change points in complex, non-stationary ICS traffic patterns where prior knowledge about attack signatures is available.

A changepoint detection method that compares the maximum likelihood under the null hypothesis of no change against the maximum likelihood under the alternative hypothesis that a change occurred at an unknown time. GLR extends CUSUM by handling cases where post-change parameters are unknown. In industrial control system anomaly detection, GLR is valuable when the exact nature of an attack—such as the specific manipulated register value or command frequency—cannot be specified in advance.

The original formulation by E.S. Page in 1954 that introduced the CUSUM decision interval scheme. Page's test accumulates the log-likelihood ratio of each observation and resets the cumulative sum to zero whenever it becomes negative, then signals when it exceeds a threshold h. This one-sided formulation is the direct ancestor of modern CUSUM implementations used in DNP3 and Modbus traffic monitoring, where the direction of deviation—such as an unexpected increase in write commands—is known a priori.