# Anomaly Detection Method Considering PLC Control Logic Structure for ICS Cyber Threat Detection
## 5 Comparative Study  
Section 5 qualitatively compares existing control logic tampering detection studies with the proposed method. The proposed control logic anomaly detection method trains AI models using PLC control logic to detect anomalies. This approach is unprecedented in existing ICS anomaly detection research, which primarily focuses on monitoring network packets and processing data. Due to this fundamental difference, direct comparison with conventional ICS anomaly detection studies is challenging. Therefore, we compare our method with control logic tampering detection research, which shares a similar objective of identifying anomalies within PLC control logic. Existing studies primarily focus on detect \begin{table}
\begin{tabular}{c c c} \hline \hline \multirow{2}{*}{**Model**} & \multicolumn{3}{c}{**F1 Score**} \\ \cline{2-3}  & **Proposed Embedding Methods** & **General Embedding Methods** \\ \hline LSTM & 0.812944 & 0.74079 \\ LSTM-Autoencoder & 0.816012 & 0.756549 \\ Transformer & 0.811663 & 0.723404 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Comparison of the proposed embedding method and general embedding methods in terms of performance. ing whether control logic has been tampered with, while research on utilizing the structural characteristics of control logic for anomaly detection remains limited. As a result, direct quantitative comparison with previous studies is challenging. Instead, the comparison analyzes detection objectives, detection methods, additional storage requirements, tampering detection capability, and anomaly detection capability. The detection objective refers to the purpose of the study. The objectives are classified into tampering detection and anomaly detection. The detection method refers to the approach used to achieve the detection objective. Additional storage requirement refers to whether extra storage space is needed. Tampering detection capability refers to whether tampering can be detected. Anomaly detection capability refers to whether anomaly detection is possible. Table 7 compares the proposed method with existing control logic tampering detection approaches. Existing studies, except for our research, focus on detecting tampering. Our study detects control logic anomalies using AI. Traditional control-logic tampering detection studies identify modifications through blockchain, message digests, and line-by-line code comparisons. Choia, M.K. and J.C. Lee require additional storage for storing hashes or normal control logic. Tampering detection studies can identify modifications, whereas our research detects anomalies to infer tampering. Anomaly detection in control logic is not possible in previous studies, but our research enables it. Additionally, since existing studies detect only code modifications, even legitimate changes may be misclassified as tampering. Answer to (RQ3): Unlike traditional tampering detection methods, the proposed approach detects anomalous control logic by reflecting the structural characteristics of control logic. While existing studies focus solely on determining whether modifications have occurred, the proposed method can identify patterns that deviate from normal control flow. Through this approach, anomalies can be detected, allowing the identification of vulnerable code embedded within control logic and precisely analyzing which parts of the code cause abnormalities. This capability is not achievable with conventional methods. Additionally, since the model learns normal control logic to detect anomalies, there is no need for separate storage to retain normal control logic. The proposed control logic anomaly detection method utilizes IL code standardized under IEC 61131-3. PLC models that comply with this standard support cross-language conversion regardless of the manufacturer, ensuring high scalability and broad applicability across various PLC models. However, some ICS infrastructures do not fully follow the IEC