# Anomaly Detection Method Considering PLC Control Logic Structure for ICS Cyber Threat Detection
## 1 Introduction  
With the advent of the Fourth Industrial Revolution, various technologies and systems have been introduced to industrial control systems (ICSs). While these advancements enhance ICS efficiency, they also increase external network exposure, leading to a surge in cyberattacks [1]. Recent studies on ICS cybersecurity have focused on AI-based anomaly detection systems to detect increasingly sophisticated and complex ICS cyberattacks [2]. AI-based anomaly detection systems in ICSs typically monitor network packets or process data to detect anomalies. Network packet-based anomaly detection systems cannot monitor all network segments in ICSs, so they collect and monitor network packets at specific segments or root switches [3]. Process data-based anomaly detection systems monitor power and sensor data generated within ICSs [4]. However, network packet-based or process data-based anomaly detection systems cannot detect programmable logic controller (PLC) [5] control-logic-tampering attacks such as Stuxnet [6]. Stuxnet physically accessedthe system via a Universal Serial Bus (USB) and installed malware on the Engineering Workstation (EWS). The infected EWS then uploaded malicious control logic to the PLC, causing abnormal operations. Subsequently, the compromised EWS altered abnormal process data to appear normal before transmitting it to the monitoring system. Since Stuxnet used a USB for physical access, it cannot be detected by network packet-based anomaly detection systems. Additionally, since anomalous process data are altered to appear normal, they cannot be detected by process data-based anomaly detection systems. To detect PLC control-logic-tampering attacks, studies have been conducted to identify control logic modifications. However, these tampering detection methods determine only whether the code has been modified, which can lead to false positives by detecting minor changes in normal control logic as unauthorized tampering. [PERSON], [PERSON] et al. [7] used encryption algorithms and blockchain technology to verify the integrity of PLC control logic and detect tampering. This study detected tampering by storing the hash values of PLC control logic in the blockchain. [PERSON] et al. [8] proposed a resilience approach to protect PLCs from control logic data tampering attacks. This study detects tampering in transmitted PLC control logic packets using message digests and restores devices from anomalous states. However, these studies determine code modifications rather than assessing the normality of control logic. If normal control logic is modified for maintenance purposes, it may be mistakenly classified as anomalous despite being a legitimate change. Additionally, they require a storage system, such as a blockchain or database, to store normal control logic hashes. The threat model presented in this study involves a malicious control logic upload attack, which manipulates PLC control logic to induce unintended system behavior. In this attack, an attacker (e.g., an individual with access to EWS) utilizes physical storage media to access EWS and inject malware. The compromised EWS subsequently uploads malicious control logic to the PLC. The primary targets of this attack include industrial processes that rely on PLCs. Malicious control logic can lead to physical damage, operational disruptions, or safety hazards. Such attacks modify anomalous process data to appear normal. Additionally, they inject malicious control logic through trusted communication channels, enabling them to evade traditional anomaly detection systems. Given these challenges, an AI-based control logic anomaly detection method is required to distinguish between legitimate modifications and malicious alterations in PLC control logic. Therefore, an AI-based control logic anomaly detection technique is needed to detect anomalous control logic that deviates from the normal operating range without requiring additional storage.