zkSTAR¶
Paritosh Ramanan et al. zkSTAR: A zero knowledge system for time series attack detection enforcing regulatory compliance in critical infrastructure networks. arXiv:2510.23060, 2025. [Paper]
This repository is the official implementation of the zkSTAR system.
Key Contribution¶
zkSTAR is a two-pronged zkSNARK architecture for ICS cyberattack detection with verifiable regulatory compliance:
-
Prediction circuit — encodes one step (or a DVAL-length interval) of the Extended Kalman Filter (EKF) forward pass, implemented with an LSTM-based KFLSTMModel. The circuit proves that the reported EKF state estimate and innovation residuals were computed correctly from the supplied sensor readings and pre-registered model weights.
-
Hypothesis circuit — encodes a chi-squared hypothesis test over the DVAL-aggregated residuals. The circuit proves that the alarm decision reported to the regulator was derived from a statistically valid test applied to the verified residuals produced by the prediction circuit.
Together the two circuits allow a regulator to verify — without seeing any raw process data — that the ICS operator's anomaly detector is running correctly and that its alarm decisions are trustworthy.