# Anomaly Detection Method Considering PLC Control Logic Structure for ICS Cyber Threat Detection
## 2 Background and Related Works
### Related Works  
Most studies on anomaly detection in PLC control logic focus on detecting control logic tampering. Control logic tampering detection research aims to identify attacks that modify control logic, such as Stuxnet. [PERSON], [PERSON] et al. [7] used encryption algorithms and blockchain technology to monitor PLC tampering. The study aimed to ensure the integrity of PLC logic and protect it from cyber threats such as modifications to deployed logic or configuration values. The code deployed in PLC memory is hashed using a hashing algorithm and recorded in the blockchain. This study was the first to apply blockchain technology to the cybersecurity of nuclear power instrumentation and control (I&C) systems. [PERSON] et al. [8] proposed a novel resilience method for PLCs to counter data tampering attacks. This study generates message digests for communication data (control logic) between PLCs and determines whether the transmitted data have been tampered with. If tampering is detected, we use a data recovery algorithm to resend the data in encrypted form for restoration. [PERSON] et al. [13] analyzed the project file structure of PLC control logic to detect manipulation attacks and verify control logic tampering. The proposed PLC control logic tampering detection method stores the control logic from the Engineering Workstation (EWS) and compares it with the extracted control logic from the PLC to check for tampering. The detection method converts LD code into a binary file and identifies discrepancies by comparing it with the extracted logic source code from the PLC. [PERSON], [PERSON] et al. [14] proposed a program called the Control Program Logic Change Detector (CPLCD) to detect PLC tampering. CPLCD operates with a set of detection rules to identify and log unintended incidents that disrupt the normal operation of a PLC. It organizes reserved variables and logical expressions used in the PLC, such as I (input), Q (output), and Database, on a per-Rung basis. A Rung represents a single line of control logic code. CPLCD generates detection rules for each Rung to identify modifications in control logic. Studies utilizing AI for anomaly detection in PLCs have primarily focused on monitoring process data, such as PLC power consumption, input/output signals, CPU usage, PLC log information, and runtime data. [PERSON] et al. [15] analyzed PLC power consumption to detect malicious software execution as a means of protecting PLCs from cyberattacks. Their study measured power consumption during command execution within the PLC. Using an LSTM-based anomaly detection approach, their method achieved a 99.83% accuracy in detecting malicious code. [PERSON] et al. [16] proposed an error and behavior monitoring tool for PLCs to detect faults and anomalies in PLC operations. Their study constructed a nominal deterministic finite-state automaton-based model of the PLC control process and utilized this model to detect and isolate faults and behavioral anomalies. The system was considered free of faults and behavioral anomalies if there was little to no difference between the observed behavior of PLC input/output signals and the behavior predicted by the model. [PERSON] et al. [17] proposed a method for detecting abnormal temporal behavior by monitoring CPU usage to identify denial-of-service (DoS) attacks targeting PLCs. When a temporal anomaly is detected, the proposed method examines function call se quences to identify control flow anomalies, followed by the detection of stack-based buffer overflow attacks. [PERSON] and [PERSON] [18] proposed a PLC logging-based anomaly detection system to detect anomalous PLC behavior. Their study introduced a new framework and preprocessing method to improve the quality of PLC log data. The extracted data were then used to train an unsupervised machine learning model, enabling precise monitoring of anomalous behavior in PLC systems. [PERSON] [19] proposed a detection framework that captures and analyzes PLC runtime data to identify control logic attacks.