# Anomaly Detection Method Considering PLC Control Logic Structure for ICS Cyber Threat Detection
## 1 Introduction
Since control logic is structured in graph or text format, embedding must be performed to make it suitable for AI model input. However, embedding should preserve the relationships and structure of the code while considering the characteristics of control logic. To perform embedding suitable for control logic, embedding is conducted based on the Instruction List (IL) [9] code of the control logic. The proposed control logic embedding method separates the opcode and operand in the IL code, embedding them individually before combining them. This approach preserves the structure and context of the IL code. Since the resulting embedding vectors reflect the structure of the control logic, the anomaly detection system can learn the control logic structure and effectively detect anomalous control logic. For this reason, this paper proposes a control logic anomaly detection method that considers the PLC control logic structure to detect ICS cyber threats. The proposed method embeds control logic composed of IL code to enable AI-based learning. The proposed embedding preserves the structural and syntactic relationships of the control logic. The control logic anomaly detection model detects anomalous code within control logic by learning control logic embedding vectors based on deep learning algorithms. This approach enables the identification of which PLC control logic code is anomalous. Furthermore, it allows the detection of code with embedded vulnerabilities. The proposed AI-based control logic anomaly detection method is the first approach of its kind for detecting ICS cyber threats, as it has not been previously explored. The proposed method can detect cyberattacks that conventional anomaly detection systems fail to identify. To validate the proposed method, publicly available datasets containing both normal and anomalous control logic were used for anomaly detection. Experimental results show that all models achieved an F1 score of at least 0.81. The proposed control logic anomaly detection method identifies anomalous code that deviates from the normal control flow. The contributions of this paper are as follows. * Propose an embedding method optimized for PLC control logic by embedding PLC IL code while preserving the structure and context of the control logic;
* Develop a control logic-based anomaly detection model to identify anomalous patterns within PLC control logic;
* Conduct experiments using 30 normal control logic samples and 30 malicious control logic samples, demonstrating that the proposed control logic anomaly detection method achieved an F1 score of 81% in detecting anomalous control logic code. This paper's composition is as follows: Section 2 introduces the background knowledge of PLC control logic and existing research on detecting PLC control logic modulation. Section 3 describes a control logic anomaly detection method that considers the structure of PLC control logic. Section 4 verifies the proposed anomaly detection method. Section 5 compares the proposed method with existing control logic tampering detection approaches. Finally, it concludes with a conclusion in Section 6.