zkSTAR: A zero knowledge system for time series attack detection enforcing regulatory compliance in critical infrastructure networks

2025-10-27

AI Summary

Reconciling security verification with operational data privacy in critical infrastructure regulation remains challenging. Method: This paper proposes the first attack detection framework supporting zero-knowledge verification of temporal alarm authenticity, built upon a dual-track zk-SNARK architecture that jointly integrates state-space modeling and residual-driven statistical hypothesis testing—ensuring both temporal consistency of system-state evolution and verifiability of statistical significance. Contribution/Results: It is the first to enable zero-knowledge compliance proofs for ICS temporal anomaly alerts without exposing raw operational data. Evaluated on real-world industrial control system datasets, the framework achieves high efficiency (proof generation <1.5 s), rigorous security (under SNARKs’ trusted setup assumptions), and strong privacy guarantees, enabling scalable deployment. It establishes a verifiable, practical technical paradigm for privacy-preserving regulatory oversight.

Technology Category

• Data Mining & Knowledge Management: Anomaly/Outlier Detection
• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Machine Learning: Calibration & Uncertainty Quantification

Application Category

• Security and Privacy: Data transparency and provenance
• Systems and Infrastructure for Web, Mobile and WoT: Experiences and lessons learnt from Web-based algorithms and system deployments
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

Industrial control systems (ICS) form the operational backbone of critical infrastructure networks (CIN) such as power grids, water supply systems, and gas pipelines. As cyber threats to these systems escalate, regulatory agencies are imposing stricter compliance requirements to ensure system-wide security and reliability. A central challenge, however, is enabling regulators to verify the effectiveness of detection mechanisms without requiring utilities to disclose sensitive operational data. In this paper, we introduce zkSTAR, a cyberattack detection framework that leverages zk-SNARKs to reconcile these requirements and enable provable detection guarantees while preserving data confidentiality. Our approach builds on established residual-based statistical hypothesis testing methods applied to state-space detection models. Specifically, we design a two-pronged zk-SNARK architecture that enforces temporal consistency of the state-space dynamics and statistical consistency of the detection tests, allowing regulators to temporally verify alarm correctness without visibility into utility-level data. We formally analyze the soundness and zero knowledge properties of our framework and validate its practical feasibility through computational experiments on real-world ICS datasets. As a result, our work demonstrates a scalable, privacy-preserving alternative for regulatory compliance for ICS driven critical infrastructure networks.

Problem

• Detecting cyberattacks in critical infrastructure without exposing sensitive data
• Enabling regulatory compliance verification while preserving operational confidentiality
• Providing verifiable attack detection guarantees through zero-knowledge cryptographic proofs

Innovation

• Leverages zk-SNARKs for privacy-preserving attack detection
• Enforces temporal and statistical consistency via dual architecture
• Validates framework on real-world industrial control datasets