## 3 Background  
The ICS bridges the virtual and natural worlds with many physical components [31], such as sensors and controllers, making ICS interact with the physical system and information system [32]. The physical apparatus in which the ICS resides is called the plant. Control systems can be decomposed into three elements within the plant: control inputs, control outputs, and control logic. Control inputs are used to communicate the status with the plant. For example, temperature, level, or pressure sensors can detect and transmit physical states. Others are human-driven, such as switches, dials, and buttons. ICS usually sends control output signals to some external devices affecting the physical world. For example, turn on/off a light, open/close valves, or raise/lower temperature. Control logic is essentially a broad virtual concept that drives physical machinery and determines the overall operation process of ICS. To describe accurately, in this paper, we assume the control logic is the software control logic that works in the PLC, which can repeatedly receive, compute and send the control signals.  
The control logic for a sequential process is codified as a Boolean circuit set and then compiled into the PLC's native instruction set architecture (ISA). An ISA defines a family of implementations, such as the supported instructions, data types, registers, fundamental features, and the input/output model. All PLC control logic programs must be compiled into ISA-ruled machine language before being executed. Although the ISA of PLC varies between manufacturers, most are equivalent to the International Electrotechnical Commission (IEC) 61131-3 standard for the Instruction List (IL) programming language [33]. IEC 61131 is an open international standard for PLCs, and the third part (IEC61131-3) deals with basic software architecture and programming languages of the control program within PLC.  
PLC is the primary operating carrier of control logic which can be modularized by internal CPU, instruction and data memory, input and output unit, power supply module, and digital-analog [34]. The input/output module receives (input)/sends (output) multiple electrical or electronic signals and controls or supervises almost any mechanical and electrical system. There are three layers of the PLC: the programming layer, the firmware layer, and the hardware layer. The programming layer is the primary interaction model between the operator and the PLC. The firmware layer is the connection between the programming and hardware layers, which is often referred to as the operating system of an embedded device. The hardware layer of PLC, as with the personal computer, includes the microprocessor, memory (volatile and nonvolatile), and bus. The PLC microprocessor can receive the input from the operator and collect the status data from filed equipment simultaneously.  
Extension loads are connected to PLC input/output modules. Most modern PLCs have the function of network communication and use BUS cables, RS-232 interfaces, USB interfaces, and Ethernet ports for communication links.  
The unique characteristics of PLCs determine that it is an operational technology system (OT system), not an Information Technology system (IT system) similar to PCs and servers. An IT system is necessary for monitoring, managing, and securing enterprise functions, while OT is for connecting, monitoring, managing, and securing industrial operations. IT is centered on front-end informational activities, while OT is focused on back-end production (machines). IT is responsible for the informational infrastructure, while OT is responsible for the equipment on industrial sites. These significant differences are challenges of ICS-focused ransomware attacks, which is also one of our focuses in this paper. Subsequently, we will continue to discuss ICS-ARC by providing the system model in the next section.