<figure><img src="image_1.png" /></figure>

HAL
open science

# Graphs in OT Testing Graph Abnormality Application to a Real OT Data Set Ongoing & Future Works References

C Boinay, C Biernacki, C Preda

<figure><img src="image_2.png" /></figure>

## To cite this version:

C Boinay, C Biernacki, C Preda. Graphs in OT Testing Graph Abnormality Application to a Real OT Data Set Ongoing & Future Works References. 54e Journées de Statistique, Jul 2023, Bruxelles, Belgium. hal-04370878

HAL Id: hal-04370878

https://inria.hal.science/hal-04370878v1

Submitted on 3 Jan 2024

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

<figure><img src="image_3.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_4.png" /></figure>

<figure><img src="image_5.png" /></figure>

<figure><img src="image_6.png" /></figure>

<figure><img src="image_7.png" /></figure>

# Testing Abnormality of a Sequence of Graphs: Application to Cybersecurity

C. Boinay¹, C. Biernacki², C. Preda³

¹ Seckiot & Inria, ² Inria & U. Lille, ³ U. Lille & Inria

54ᵉ Journées de Statistique

3-7 juillet 2023, Université libre de Bruxelles (ULB)

<figure><img src="image_8.png" /></figure>

<figure><img src="image_9.png" /></figure>

Université
de Lille

<figure><img src="image_10.png" /></figure>

SECKIOT

<figure><img src="image_11.png" /></figure>

<figure><img src="image_12.png" /></figure>

<figure><img src="image_13.png" /></figure>

<figure><img src="image_14.png" /></figure>

<figure><img src="image_15.png" /></figure>

<figure><img src="image_16.png" /></figure>
<figure><img src="image_17.png" /></figure>

<figure><img src="image_18.png" /></figure>

<figure><img src="image_19.png" /></figure>

<figure><img src="image_20.png" /></figure>

# Outline

1. Graphs in OT

2. Testing Graph Abnormality

3. Application to a Real OT Data Set

4. Ongoing & Future Works

<figure><img src="image_21.png" /></figure>

<figure><img src="image_22.png" /></figure>

<figure><img src="image_23.png" /></figure>

<figure><img src="image_24.png" /></figure>

<figure><img src="image_25.png" /></figure>

<figure><img src="image_26.png" /></figure>
<figure><img src="image_27.png" /></figure>

<figure><img src="image_28.png" /></figure>

<figure><img src="image_29.png" /></figure>

<figure><img src="image_30.png" /></figure>

Operational Technology (OT)

* Part of modern **critical infrastructures** such as water treatment plants, oil refineries, power grids, and nuclear and thermal power plants

* Composed of **heterogeneous and complex components**: sensors and actuators, programmable logic controllers, supervisory control and data acquisition and human-machine interface

It is thus essential, but also challenging, to preserve OT from malicious actions (**attacks**)

<figure><img src="image_31.png" /></figure>

<figure><img src="image_32.png" /></figure>

<figure><img src="image_33.png" /></figure>

<figure><img src="image_34.png" /></figure>

<figure><img src="image_35.png" /></figure>

<figure><img src="image_36.png" /></figure>

<figure><img src="image_37.png" /></figure>
<figure><img src="image_38.png" /></figure>

<figure><img src="image_39.png" /></figure>

<figure><img src="image_40.png" /></figure>

<figure><img src="image_41.png" /></figure>

# Attacks in OT: Stuxnet as a game-changer

<figure><img src="image_42.png" /></figure>

Stuxnet: 1st attack of an industrial system (Iranian nuclear power plant)

## Cyber attack (the National Cyber Security Centre)

Malicious attempts to damage, disrupt or gain unauthorised access to computer systems, networks or devices, via cyber means

<figure><img src="image_43.png" /></figure>

<figure><img src="image_44.png" /></figure>

<figure><img src="image_45.png" /></figure>

<figure><img src="image_46.png" /></figure>

<figure><img src="image_47.png" /></figure>

<figure><img src="image_48.png" /></figure>

<figure><img src="image_49.png" /></figure>
<figure><img src="image_50.png" /></figure>

<figure><img src="image_51.png" /></figure>

<figure><img src="image_52.png" /></figure>

<figure><img src="image_53.png" /></figure>

Standard approaches to detect an attack

* Solutions in IT (Information Technology) not sufficient to stop OT attacks (Raman, Ahmed et Mathur 2021)

* Firms use attacks history signature-based methods (Umer et al. 2022), but

* what happens with a novel type of attack?

* What happens if the signature is not well-chosen?

* Anomaly detection is the most efficient to stop a new attack since it can detect deviation of the normal behaviour (Raman, Ahmed et al. 2021)

Thus we focus on signature-free anomaly detection...

<figure><img src="image_54.png" /></figure>

<figure><img src="image_55.png" /></figure>

<figure><img src="image_56.png" /></figure>

<figure><img src="image_57.png" /></figure>

<figure><img src="image_58.png" /></figure>

<figure><img src="image_59.png" /></figure>

<figure><img src="image_60.png" /></figure>
<figure><img src="image_61.png" /></figure>

<figure><img src="image_62.png" /></figure>

<figure><img src="image_63.png" /></figure>

<figure><img src="image_64.png" /></figure>

Graph anomaly detection

Graphs as natural structures to detect attack Neil et al. 2013
"Attacks do not happen in isolation on a single endpoint. Instead, they are exhibited across multiple endpoints, and in the communications between these endpoints."

OT: up to our knowledge, no graph anomaly detection

IT: graphs have been already used, for instance:

Calls of binary functions (Cohen, Yger et Rossi Nov 2021)

Stream of messages sent between IP adresses (in classification
see Xiao et al. 2020; Abou Rida, Parrend et Amhaz 2021, in
unsupervised learning with community detection, auto-encoder
and scan statistics see Ding et al. 2012; Neil et al. 2013;
Leichtnam et al. 2020)

But only one statistical work to test if there is an anomaly
(Neil et al. 2013), otherwise **poor statistical framework...**

<figure><img src="image_65.png" /></figure>
<figure><img src="image_66.png" /></figure>

<figure><img src="image_67.png" /></figure>

<figure><img src="image_68.png" /></figure>

<figure><img src="image_69.png" /></figure>

Our data: dynamical graphs of counting

■ $\mathcal{N}$ IP adresses communicate over a time $[0, T]$ at different times $t \in [0, T]$ by sending messages

■ $[0, T] = \cup_{i=1}^n I_i$ divided into $n$ intervals of equal length $\Delta_t$

■ Only the number of messages is recorded for each $I_i$

■ The aggregated data is $\mathcal{G} = (\mathcal{G}_i)_{1 \le i \le n}$ where $\mathcal{G}_i = (\mathcal{N}, \mathcal{E}_i)$ with the set of nodes $\mathcal{N} = \{1, \dots, N\}$ and $\mathcal{E}_i$ the list of (possibly duplicated) edges which send messages during $I_i$

■ Equivalently to the $\mathcal{G}_i$s, we can construct the adjacency matrices $X^i$s such that $\forall 1 \le k, l \le N, X_{k,l}^i$ is the number of messages sent by the IP address $k$ to the IP address $l$

<figure><img src="image_70.png" /></figure>

<figure><img src="image_71.png" /></figure>

<figure><img src="image_72.png" /></figure>

<figure><img src="image_73.png" /></figure>

<figure><img src="image_74.png" /></figure>

<figure><img src="image_75.png" /></figure>
<figure><img src="image_76.png" /></figure>

<figure><img src="image_77.png" /></figure>

<figure><img src="image_78.png" /></figure>

<figure><img src="image_79.png" /></figure>

# Outline

1. Graphs in OT

2. Testing Graph Abnormality

3. Application to a Real OT Data Set

4. Ongoing & Future Works

<figure><img src="image_80.png" /></figure>

<figure><img src="image_81.png" /></figure>

<figure><img src="image_82.png" /></figure>

<figure><img src="image_83.png" /></figure>

<figure><img src="image_84.png" /></figure>

<figure><img src="image_85.png" /></figure>
<figure><img src="image_86.png" /></figure>

<figure><img src="image_87.png" /></figure>

<figure><img src="image_88.png" /></figure>

<figure><img src="image_89.png" /></figure>

Our solution for testing abnormality of a graph

1. Learn a normal behaviour (distribution $P_0$) over a sequence of graphs $G = (G_i)_{1\le i\le n}$ with a flexible family $\mathcal{F}$ of probability distributions such that $P_0 \in \mathcal{F}$

2. Test if a new graph $G_i$ has the normal behaviour ($i \ge n+1$)

$$ \begin{cases} H_0 : G_i \sim P_0 \\ H_1 : G_i \not\sim P_0 \end{cases} $$

Use the general bootstrap principle

Compute the distribution of the log-likelihood $L_0$ of the distribution $P_0$ with a bootstrap to get a quantile $q_{0.05}$: for $i \ge n+1$, $H_0$ is said to hold if $L_0(G_i) \ge q_{0.05}$

<figure><img src="image_90.png" /></figure>
<figure><img src="image_91.png" /></figure>

<figure><img src="image_92.png" /></figure>

<figure><img src="image_93.png" /></figure>

<figure><img src="image_94.png" /></figure>

Flexible candidate families (competitors) $\mathcal{F}$ for $\mathbb{P}_0$

Given a graph $\mathcal{G}^*$, and considering graphs of the learning set as iid:

* Stochastic bloc model (SBM) with the number of classes $K$ as hyperparameter. A variational EM (VEM) (Mariadassou, Robin et Vacher 2010) is adapted to learn over $\mathcal{G}$. The log-likelihood associated to $\mathcal{G}^* L_0^K(\mathcal{G}^*)$ (intractable) is approximated with the log-likelihood of the complete data.

* Gaussian kernel with the window $h > 0$:

$$L_0^h(\mathcal{G}^*) = \sum_{k \neq l} \log \left( \frac{1}{nh} \sum_{i=1}^n \frac{1}{\sqrt{2\pi}} e^{-\frac{1}{2} \left( \frac{X_{kl}^* - \bar{X}_k}{h} \right)^2} \right)$$

* Poisson kernel with the window $h > 0$:

$$L_0^h(\mathcal{G}^*) = \sum_{k \neq l} \log \left( \frac{1}{n} \sum_{i=1}^n \frac{(X_{kl}^i + h)^{X_{kl}^*}}{X_{kl}^*!} e^{-(X_{kl}^i + h)} \right)$$

<figure><img src="image_95.png" /></figure>

<figure><img src="image_96.png" /></figure>

<figure><img src="image_97.png" /></figure>

<figure><img src="image_98.png" /></figure>

<figure><img src="image_99.png" /></figure>

<figure><img src="image_100.png" /></figure>

<figure><img src="image_101.png" /></figure>

<figure><img src="image_102.png" /></figure>

<figure><img src="image_103.png" /></figure>

<figure><img src="image_104.png" /></figure>

<figure><img src="image_105.png" /></figure>

<figure><img src="image_106.png" /></figure>
<figure><img src="image_107.png" /></figure>

<figure><img src="image_108.png" /></figure>

<figure><img src="image_109.png" /></figure>

<figure><img src="image_110.png" /></figure>

<figure><img src="image_111.png" /></figure>

<figure><img src="image_112.png" /></figure>

<figure><img src="image_113.png" /></figure>

Choosing between different competitors

Retain the distribution family $\mathcal{F}$ which products the greater power for a given alternative distribution $\mathbb{P}_1$ ($i > n$)

$$H_1 : \mathcal{G}_i \sim \mathbb{P}_1$$

The distribution $\mathbb{P}_1$ represents a kind of attack, thus different scenarios to be tested...

<figure><img src="image_114.png" /></figure>

<figure><img src="image_115.png" /></figure>

<figure><img src="image_116.png" /></figure>

<figure><img src="image_117.png" /></figure>

<figure><img src="image_118.png" /></figure>

<figure><img src="image_119.png" /></figure>

<figure><img src="image_120.png" /></figure>
<figure><img src="image_121.png" /></figure>

<figure><img src="image_122.png" /></figure>

<figure><img src="image_123.png" /></figure>

<figure><img src="image_124.png" /></figure>

# Outline

1. Graphs in OT

2. Testing Graph Abnormality

3. Application to a Real OT Data Set

4. Ongoing & Future Works

<figure><img src="image_125.png" /></figure>

<figure><img src="image_126.png" /></figure>

<figure><img src="image_127.png" /></figure>

<figure><img src="image_128.png" /></figure>

<figure><img src="image_129.png" /></figure>

<figure><img src="image_130.png" /></figure>
<figure><img src="image_131.png" /></figure>

<figure><img src="image_132.png" /></figure>

<figure><img src="image_133.png" /></figure>

Tuning the hyperparameters for a targeted level

■ We use the dataset of a firm in OT (confidential)

■ It is split into 3 datasets: a learning dataset to learn $P_0$, a validation dataset to tune the hyperparameter for a targeted level, a test dataset to estimate the (unbiased) level

<table><thead><tr><th>Model</th><th>Hyperparameter</th><th>Empirical level</th><th>Time of learning</th></tr></thead><tbody><tr><td>SBM</td><td>$K = 30$</td><td>4%</td><td>46 hours</td></tr><tr><td>Gaussian kernel</td><td>$h = 90$</td><td>5%</td><td>1/2 hours</td></tr><tr><td>Poisson kernel</td><td>$h = 150$</td><td>10%<sup>1</sup></td><td>1/2 hours</td></tr></tbody></table>

<figure><img src="image_134.png" /></figure>

<figure><img src="image_135.png" /></figure>

<footnote n="1">1. This model was not flexible enough to reach the targeted level of 5%</footnote>
## Two realistic hypotheses $H_1$: "star" and "path"

According to Neil et al. 2013, star and directed path in graphs are typical of cyber attacks.

### Star construction

Star of size $\theta_s \in [1, N-1]$ with $\beta$ edges on each couple of nodes

- Take a normal graph from the test set

- Choose uniformly a node $k$ which will be the center of the star

- Choose uniformly $\theta_s$ nodes in $\{1, \dots, N\}_{\{k\}}$

- Add a value $\beta$ on the edges of the star

### Path construction

Directed path of length $\theta_p \in [1, N]$ with $\beta$ edges on each couple of nodes

- Take a normal graph from the test dataset

- Choose uniformly $\theta_p$ nodes

- Add a value $\beta$ on the edges of the path

<figure><img src="image_136.png" /></figure>
<figure><img src="image_137.png" /></figure>

<figure><img src="image_138.png" /></figure>

<figure><img src="image_139.png" /></figure>

<figure><img src="image_140.png" /></figure>

Illustrating star and path

<figure><img src="image_141.png" /><figcaption>Normal graph (left), graph with a path (middle), graph with a star (right)</figcaption></figure>

<figure><img src="image_142.png" /></figure>

<figure><img src="image_143.png" /></figure>

<figure><img src="image_144.png" /></figure>

<figure><img src="image_145.png" /></figure>

<figure><img src="image_146.png" /></figure>

<figure><img src="image_147.png" /></figure>
<figure><img src="image_148.png" /></figure>

<figure><img src="image_149.png" /></figure>

<figure><img src="image_150.png" /></figure>

<figure><img src="image_151.png" /></figure>

Empirical power

<figure><img src="image_152.png" /></figure>

Empirical power for the path

<figure><img src="image_153.png" /></figure>

Empirical power for the star

The SBM greatly outperforms Gaussian and Poisson kernels

<figure><img src="image_154.png" /></figure>

<figure><img src="image_155.png" /></figure>

<figure><img src="image_156.png" /></figure>

<figure><img src="image_157.png" /></figure>

<figure><img src="image_158.png" /></figure>

<figure><img src="image_159.png" /></figure>

<figure><img src="image_160.png" /></figure>
<figure><img src="image_161.png" /></figure>

<figure><img src="image_162.png" /></figure>

<figure><img src="image_163.png" /></figure>

<figure><img src="image_164.png" /></figure>

# Outline

1. Graphs in OT

2. Testing Graph Abnormality

3. Application to a Real OT Data Set

4. Ongoing & Future Works

<figure><img src="image_165.png" /></figure>

<figure><img src="image_166.png" /></figure>

<figure><img src="image_167.png" /></figure>

<figure><img src="image_168.png" /></figure>

<figure><img src="image_169.png" /></figure>

<figure><img src="image_170.png" /></figure>
<figure><img src="image_171.png" /></figure>

<figure><img src="image_172.png" /></figure>

<figure><img src="image_173.png" /></figure>

<figure><img src="image_174.png" /></figure>

Ongoing work: a sparse SBM as a new competitor (1/3)

- The SBM showed promising results

- However, 99% of the data in the adjacency matrices equal 0

- SBM doesn't take into account this great sparsity

Definition of the sparse SBM

We take into account sparsity by changing the Poisson distribution with a mixture of a Dirac in 0 and a Poisson truncated in 0 ($\beta \in [0, 1]$, $\lambda \in \mathbb{R}_+$):

$$F(x; \beta, \lambda) = \mathbb{1}_{x=0}\beta + \mathbb{1}_{x \neq 0}(1 - \beta) \frac{\lambda^x}{(e^\lambda - 1)x!}$$

<figure><img src="image_175.png" /></figure>

<figure><img src="image_176.png" /></figure>

<figure><img src="image_177.png" /></figure>

<figure><img src="image_178.png" /></figure>

<figure><img src="image_179.png" /></figure>

<figure><img src="image_180.png" /></figure>
<figure><img src="image_181.png" /></figure>

<figure><img src="image_182.png" /></figure>

<figure><img src="image_183.png" /></figure>

<figure><img src="image_184.png" /></figure>

## Ongoing work: a sparse SBM as a new competitor (2/3)

Fix the value of *K* for a targeted theoretical level

<table><thead><tr><th><i>K</i></th><th>Empirical level</th><th>Time of learning</th></tr></thead><tbody><tr><td>1</td><td>4.4%</td><td>2 hours</td></tr><tr><td>2</td><td>4.4%</td><td>4 hours</td></tr><tr><td>3</td><td>5.8%</td><td>6 hours</td></tr><tr><td>5</td><td>5.8%</td><td>18 hours</td></tr></tbody></table>

### Effect of sparsity

We notice that we need much lower *K* value for reaching a given level than with SBM...

<figure><img src="image_185.png" /></figure>

<figure><img src="image_186.png" /></figure>

<figure><img src="image_187.png" /></figure>

<figure><img src="image_188.png" /></figure>

<figure><img src="image_189.png" /></figure>

<figure><img src="image_190.png" /></figure>

<figure><img src="image_191.png" /></figure>
<figure><img src="image_192.png" /></figure>

<figure><img src="image_193.png" /></figure>

<figure><img src="image_194.png" /></figure>

<figure><img src="image_195.png" /></figure>

Ongoing work: a sparse SBM as a new competitor (3/3)

Empirical power of the star with the sparse SBM ($K = 3$)

<figure><img src="image_196.png" /></figure>

The sparse SBM gives poor result in comparison with the SBM, thus this exploring work should be still continued...

<figure><img src="image_197.png" /></figure>

<figure><img src="image_198.png" /></figure>

<figure><img src="image_199.png" /></figure>

<figure><img src="image_200.png" /></figure>

<figure><img src="image_201.png" /></figure>

<figure><img src="image_202.png" /></figure>

<figure><img src="image_203.png" /></figure>

<figure><img src="image_204.png" /></figure>
<figure><img src="image_205.png" /></figure>

<figure><img src="image_206.png" /></figure>

<figure><img src="image_207.png" /></figure>

<figure><img src="image_208.png" /></figure>

# Future works

* Pursue competitor proposals for $P_0$

* Use scan statistics for relaxing iid assumption?

* Accelerate/avoid SMB-like estimation (hierarchical SBM)?

* Adapt the test to multiple testing (Benferroni correction)

* Investigate other real OT data sets

* Try different values of split $\Delta_t$

<figure><img src="image_209.png" /></figure>

<figure><img src="image_210.png" /></figure>

<figure><img src="image_211.png" /></figure>

<figure><img src="image_212.png" /></figure>

<figure><img src="image_213.png" /></figure>

<figure><img src="image_214.png" /></figure>

<figure><img src="image_215.png" /></figure>
<figure><img src="image_216.png" /></figure>

<figure><img src="image_217.png" /></figure>

<figure><img src="image_218.png" /></figure>

<figure><img src="image_219.png" /></figure>

Thank you for your attention

<figure><img src="image_220.png" /></figure>

<figure><img src="image_221.png" /></figure>

<figure><img src="image_222.png" /></figure>

<figure><img src="image_223.png" /></figure>

<figure><img src="image_224.png" /></figure>

<figure><img src="image_225.png" /></figure>

<figure><img src="image_226.png" /></figure>
<figure><img src="image_227.png" /></figure>

<figure><img src="image_228.png" /></figure>

<figure><img src="image_229.png" /></figure>

<figure><img src="image_230.png" /></figure>

<figure><img src="image_231.png" /></figure>

Abou Rida, Amani, Pierre Parrend et Rabih Amhaz (2021). "Anomaly Detection for CyberSecurity Using Inductive Node Embedding with Convolutional Graph Neural Networks". In:

Complex Networks and their Applications 2021, 30 novembre - 2 décembre 2021, Madrid, Madrid, Spain. url: https://hal.archives-ouvertes.fr/hal-03393640.

<figure><img src="image_232.png" /></figure>

Cohen, Roxane, Florian Yger et Fabrice Rossi (Nov 2021). "Adding semantic to level-up graph-based Android malware detection". In:

Complex Networks and their Applications 2021, 30 novembre - 2 décembre 2021, Madrid, Madrid, Spain. url: https://hal.archives-ouvertes.fr/hal-03393640.

<figure><img src="image_233.png" /></figure>

Ding, Qi et al. (2012). "Intrusion as (Anti)Social Communication : Characterization and Detection". In:

Proceedings of the 18th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining '12. Beijing, China : Association for Computing Machinery, p. 886-894.

isbn: 9781450314626. doi: 10.1145/2339530.2339670. url :

https://doi.org/10.1145/2339530.2339670.

<figure><img src="image_234.png" /></figure>

Leichtnam, Laetitia et al. (juin 2020). "Sec2graph : Network Attack Detection Based on Novelty Detection on Graph Structured Data". In:

DIMVA 2020 : 17th Conference on Detection of Intrusions and Malware, and Vulnerability
T. 12223. Lecture Notes in Computer Science. Lisbon, Portugal, p. 238-258. doi :
10.1007/978-3-030-52683-2\_12. url : https://hal.inria.fr/hal-02950489.

<figure><img src="image_235.png" /></figure>

Mariadassou, Mahendra, Stéphane Robin et Corinne Vacher (2010). "Uncovering latent structure in valued graphs : A variational approach". In:

The Annals of Applied Statistics 4.2, p. 715-742. doi: 10.1214/10-A0AS361.
url: https://doi.org/10.1214/10-A0AS361.

<figure><img src="image_236.png" /></figure>

<figure><img src="image_237.png" /></figure>

<figure><img src="image_238.png" /></figure>

<figure><img src="image_239.png" /></figure>

<figure><img src="image_240.png" /></figure>

<figure><img src="image_241.png" /></figure>

<figure><img src="image_242.png" /></figure>

<figure><img src="image_243.png" /></figure>

<figure><img src="image_244.png" /></figure>

<figure><img src="image_245.png" /></figure>

<figure><img src="image_246.png" /></figure>

<figure><img src="image_247.png" /></figure>

<figure><img src="image_248.png" /></figure>

<figure><img src="image_249.png" /></figure>
<figure><img src="image_250.png" /></figure>

<figure><img src="image_251.png" /></figure>

<figure><img src="image_252.png" /></figure>

<figure><img src="image_253.png" /></figure>

<figure><img src="image_254.png" /></figure>

Neil, Joshua et al. (2013). "Scan Statistics for the Online Detection of Locally Anomalous Subgraphs". In: *Technometrics* 55.4, p. 403-414. doi: 10.1080/00401706.2013.822830. eprint: https://doi.org/10.1080/00401706.2013.822830. url: https://doi.org/10.1080/00401706.2013.822830.

<figure><img src="image_255.png" /></figure>

Raman, Gauthama, Chuadhry Mujeeb Ahmed et Aditya Mathur (2021). "Machine learning for intrusion detection in industrial control systems: challenges and lessons from experimental evaluation". In: *IEEE Transactions on Industrial Informatics*. doi: 10.1186/s42400-021-00095-5.

<figure><img src="image_256.png" /></figure>

Umer, Muhammad Azmi et al. (2022). "Machine learning for intrusion detection in industrial control systems: Applications, challenges, and recommendations". In: *International Journal of Critical Infrastructure Protection*, p. 100516. issn: 1874-5482. doi: https://doi.org/10.1016/j.ijcip.2022.100516. url: https://www.sciencedirect.com/science/article/pii/S1874548222000087.

<figure><img src="image_257.png" /></figure>

Xiao, Qingsai et al. (2020). "Towards Network Anomaly Detection Using Graph Embedding". In: *Computational Science – ICCS 2020* 12140, p. 156-169.

<figure><img src="image_258.png" /></figure>