Attack #28P302

At 2015-12-31 01:45:19, attack #28 (SSSP) manipulated P302 — “Close P-302”. The serving model raised the alert 1765 seconds after onset (peak score 7.7104x the operating threshold). The dominant physical evidence: P402 — UV/RO feed pump (duty), Stage 4 (dechlorination / UV) was driven to a state the plant's learned physics did not predict from the rest of the process, carrying 58% of the anomaly score — 72.1x its share in normal operation. Supporting deviations were concentrated in MV304, P302, MV302. Independently, the mined process rule “FIT501 ≈ 0.9242·FIT401 + 0.1401, residual ∈ [-0.007591, 0.007749]” was violated for 31990 seconds inside the attack window. The fused detection stack corroborated the alert across channels (physics residual + process rules), which is the platform's high-confidence state. In plain terms: the plant's own physics stopped agreeing with what the sensors were reporting, in exactly the part of the process the attacker touched.