A real-time malware detection framework for Industrial Control Systems using hybrid SARIMA-LSTM models. The system detects cyber-attacks targeting sensor data and PLC logic by analyzing process-layer anomalies. SARIMA captures seasonal trends while LSTM learns complex temporal patterns. Validated on SWaT and HAI datasets with 5.5 hours early warning capability. Lightweight 199KB model suitable for edge device deployment in critical infrastructure.