Attack #22UV401 + AIT502 + P501

At 2015-12-29 22:55:18, attack #22 (MSMP) manipulated UV401, AIT502, P501 — “Stop UV-401; Value of AIT502 set as 150; Force P-501 to remain on”. The serving model raised the alert immediately — within the first second of the attack (peak score 7.2852x the operating threshold). The dominant physical evidence: P402 — UV/RO feed pump (duty), Stage 4 (dechlorination / UV) was driven to a state the plant's learned physics did not predict from the rest of the process, carrying 20% of the anomaly score — 25x its share in normal operation. Supporting deviations were concentrated in AIT502, AIT402, LIT401. Independently, the mined process rule “PIT503 ≈ 0.7834·PIT501 + -7.309, residual ∈ [-0.7047, 0.6132]” was violated for 466 seconds inside the attack window. The fused detection stack corroborated the alert across channels (physics residual + process rules), which is the platform's high-confidence state. In plain terms: the plant's own physics stopped agreeing with what the sensors were reporting, in exactly the part of the process the attacker touched.