Attack Detection using Time Series Foundation Models

The paper's actual contribution is narrower than the summary suggests: TimesFM works as an anomaly detector not because it understands cyber-physical dynamics, but because it can recognize when temporal patterns deviate from learned statistical norms. The key qualifier is that this approach only catches attacks that leave detectable traces in time series; stealthy attacks that preserve statistical properties remain invisible.

This connects directly to the ODTQA-FoRe work from early June, which identified a critical gap in LLM-based systems: the inability to reason about time-series trends and forecast future values. TimesFM solves the inverse problem, using temporal reasoning to detect anomalies rather than predict them. Both papers signal that foundation models trained on broad temporal data are becoming useful for specialized tasks beyond their original intent. The Meta chatbot incident also echoes here: both stories involve deploying pretrained systems into high-stakes domains (infrastructure security vs. account access) where the model's general capabilities may mask domain-specific blindness.

If Google or security vendors ship TimesFM-based monitoring into production critical infrastructure within the next 12 months and report detection rates on real-world attacks, that validates the practical utility. If instead the work remains confined to academic benchmarks against synthetic attacks, it signals the gap between zero-shot detection in controlled settings and robustness against adaptive adversaries remains unsolved.