## 6 Related Work  
There exist several techniques for anomaly detection in ICS. This section summarizes recent work in data-driven anomaly detection.  
The authors of [17] proposed a distributed anomaly detection architecture based on autoencoders, Transformer, and Fourier mixing sublayer. The proposed unsupervised approach was evaluated on several benchmark datasets such as SWaT, HAI, Gas pipeline, and power demand, and proven to achieve better detection precision and F1 score.  
STGNN [18], a spatio-temporal graph neural network, is proposed to monitor ICS processes. Initially, using variational decomposition mode, dimensions of the incoming data from the ICS are reduced and fed into a graph neural network for anomaly detection. The proposed approach dominates the eight existing state-of-the-art algorithms in terms of recall, precision, and F1 score. In [19], the authors have proposed a self-supervised contrastive learning methodology for anomaly detection in large-scale industrial data. In this approach, a deep neural network is employed to accurately detect the anomaly patterns. In [20] the authors present an integrated framework based on Kalman filter and permutation entropy for detecting stealthy attacks against an ICS. As an extension, [PERSON] et al. [21] integrated Kalman filter with residual skewness for detecting process anomalies.  
[PERSON] et al. [22] proposed a multivariate time series prediction approach to ensure reliable operation of ICS. In this work, both neural graph networks and gated recurrent units are integrated to accurately model the dependencies among the sensors for the anomaly detection process. This approach was evaluated on SWaT and WADI datasets and proven to achieve a better detection rate compared to the nine state-of-the-art algorithms. The author of [23], has proposed a bi-anomaly-based IDS for industrial cyber-physical systems. The proposed approach integrates IDS based on neural networks and decision-making systems. The proposed approach was evaluated on both benchmark and non-industrial datasets  
Figure 2: Comparison of feature statistics: (**a**) behaviour of DPIT-301 in 2021 (minimum value = 0.02, maximum value = 20.00, std = 6.87); (**b**) histogram plot of (**a**); (**c**) behaviour of DPIT-301 in 2022 (minimum = 0.01, maximum = 0.0608, std = 0.0027) (**d**) histogram plot of (**c**); \(p\)-value of K-S test [16] is 0; hence, rejecting the null hypothesis, i.e., the distributions are not identical.  
and found to achieve a higher detection rate with minimal false alarms. [PERSON] et al. [24] proposed a supervised learning approach named Logical Analysis of Data (LAD) to extract rules from historical data for several operating conditions of the plant. The efficiency of the proposed approach was evaluated on sensor measurements from SWaT data and compared with other anomaly detection approaches. Although the proposed approach can effectively localize the anomalies, it can detect anomalies that target only the sensors.  
The authors of [25] proposed a physics-informed gated recurrent graph neural network for anomaly detection in industrial cyber-physical systems. Initially, the dependencies among the variables are modeled using directed graphs, and their interactions are learned using the recurrent graph neural network. The proposed approach was evaluated on SWaT and WADI datasets and proved to be better in detection ability compared with ten state-of-the-art methods.  
To summarize, the techniques mentioned above are evaluated on a benchmark dataset or in a simulated environment. Such evaluation does not necessarily ensure that, when deployed in an operational environment, the techniques will lead to similar results. We believe that, when feasible, testing an anomaly detector as described in this work, leads to more repeatable results than testing on synthetic or even benchmark datasets such as those offered by itrust [11].