# Anomaly Detection Method Considering PLC Control Logic Structure for ICS Cyber Threat Detection
## 6 Conclusions  
Anomaly detection systems have been introduced to detect cyber threats in ICS. Traditional ICS anomaly detection systems monitor network packets or process data. However, these systems cannot detect control logic tampering attacks. Various studies have been conducted to detect control logic tampering. However, tampering detection focuses on identifying code modifications rather than determining whether the control logic is functioning normally. As a result, even legitimate modifications to normal operations are detected as anomalies, leading to an increase in false positives. For this reason, this paper proposes an anomaly detection method that considers the structure of control logic to detect ICS cyber threats. The proposed method performs embedding on IL code. To preserve the context and structure of IL code, opcodes and operands are embedded separately using different embedding models. The embedded values are then combined sequentially to maintain the IL code structure. This embedding approach effectively preserves the relationships between operators and operands in IL code, making it useful for future anomaly detection and code analysis. To validate the effectiveness of the embedded values, LSTM, LSTM-Autoencoder, and Transformer models were implemented for anomaly detection. All models achieved an F1 score of 0.81 or higher. These models learn normal control logic and detect control logic exhibiting anomalous behavior. This approach enables the detection of not only anomalous code but also code containing vulnerabilities. Additionally, the proposed embedding method was compared with an approach that embeds opcodes and operands into a single vector without differentiation. When applying the proposed embedding method, the anomaly detection model achieved an F1 score that was 0.088259 higher. Experimental results demonstrate that the proposed embedding method allows the anomaly detection model to better understand the execution flow and structural relationships of control logic instructions. Existing ICS anomaly detection methods cannot detect malicious control logic injection attacks targeting critical infrastructure, such as power plants and smart grids. These attacks can cause abnormal operations in critical infrastructure, leading to financial and physical damage. The proposed control logic anomaly detection method enhances ICS cybersecurity and minimizes damage by detecting control logic anomalies that existing ICS anomaly detection methods fail to identify. Additionally, this study provides a foundation for further research on AI-based ICS anomaly detection. As future work, a model will be proposed to expand the monitoring scope by simultaneously analyzing both control logic and process data. Conceptualization, J.H.L. and S.H.J. ; methodology, J.H.L. and S.H.J. ; validation, J.H.L. and I.H.J. ; formal analysis, J.H.L. ; investigation, J.H.L. and I.H.J. ; resources, J.H.L. and I.H.J. ; data curation, [PERSON] and I.H.J. ; writing--original draft preparation, [PERSON] and I.H.J. ; writing--review and editing, S.H.J. and J.T.S. ; visualization, [PERSON]; supervision, S.H.J. and J.T.S. ; project administration, S.H.J. and J.T.S. ; funding acquisition, J.T.S. All authors have read and agreed to the published version of the manuscript. This work was partly supported by the Institute of Information and communications Technology Planning and Evaluation (IITP) grant funded by the Korean government (MSIT) (No. RS-2024-00354169, Technology Development of Threat Model/XAI-based Network Abnormality Detection, Response and Cyber Threat Prediction, 90%) and the Gachon University research fund of 2025 (GCU-202406180001, 10%). Not applicable. Data Availability Statement: Data are openly available in a public repository.