Machine-learning intrusion detection for operational technology (OT) is usually evaluated on benchmark datasets that separate normal and attack traffic into different recordings. The new paper argues that this common evaluation design can produce misleadingly high results.
Because the model is trained on data from separate sessions, it may latch onto recording-specific differences rather than the actual attack pattern. The paper therefore proposes a recording-aware evaluation method for multimodal OT intrusion detection, which is intended to separate genuine attack detection from these spurious cues.
The contribution is methodological and cautionary: it calls for evaluation protocols that are aware of how the data were recorded, so that benchmark scores reflect true intrusion-detection performance rather than recording artifacts.