Attack #37P501 + FIT502

At 2015-01-02 11:17:02, attack #37 (SSMP) manipulated P501, FIT502 — “Close P-501; Set value of FIT-502 to 1.29 at 11:18:36”. The serving model raised the alert 46 seconds after onset (peak score 5.2621x the operating threshold). The dominant physical evidence: FIT504 — RO recirculation flow meter, Stage 5 (reverse osmosis) ran 29.2 standard deviations above the value predicted by the plant's learned physics, carrying 16% of the anomaly score — 6.3x its share in normal operation. Supporting deviations were concentrated in FIT501, FIT503, P403. Independently, the mined process rule “PIT503 ≈ 0.7834·PIT501 + -7.309, residual ∈ [-0.7047, 0.6132]” was violated for 429 seconds inside the attack window. The fused detection stack corroborated the alert across channels (physics residual + process rules), which is the platform's high-confidence state. In plain terms: the plant's own physics stopped agreeing with what the sensors were reporting, in exactly the part of the process the attacker touched.