# Anomaly Detection Method Considering PLC Control Logic Structure for ICS Cyber Threat Detection
## 3 Proposal for PLC Control Logic Embedding and Anomaly Detection
### Control Logic Embedding  
The proposed PLC control logic embedding method was inspired by Asm2 Vec [20] and restructured to suit control logic. Asm2 Vec is a technique for embedding assembly language. The objective of the Asm2 Vec model is to learn vector representations that reflect the semantic similarity of functions and instruction sequences in assembly code. The model aims to maximize log-likelihood to construct a vector space that best preserves the structure and semantics of the code. In other words, the Asm2 Vec model seeks to maximize the value of Equation (1) [20]. \[\sum_{f_{n}}^{RP}\sum_{seq_{i}}^{S(f_{n})}\sum_{inj_{j}}^{I(seq_{i})}\sum_{t_{ c}}^{T(inj_{j})}\log P(t_{c}|f_{s},\;inj_{-1},\;inj_{+1}) \tag{1}\]  
\(RP\) represents all functions within the binary code being analyzed. \(f_{n}\) refers to the function contained in the binary code. \(S(f_{n})\) is the set of specific instruction sequences extracted from the function \(f_{n}\). \(seq_{i}\) refers to a specific instruction sequence extracted from \(f_{n}\). \(I(seq_{i})\) is the set of individual instructions contained within the sequence \(seq_{i}\). \(in_{j}\) represents a specific instruction within a given sequence \(j\). \(T(inj_{j})\) is the set of individual tokens that make up the instruction \(inj_{j}\). Assembly code consists of multiple tokens, such as opcodes and operands. \(t_{c}\) refers to an individual token, which is a specific code included in an opcode or operand. For example, if the opcode is'mov exa, ebx', then'mov', 'eax', and 'ebx' are each considered tokens. \(\log P(t_{c}|f_{s},\;inj_{-1},\;inj_{+1})\) represents the probability of a specific token \(t_{c}\) occurring given the function \(f_{s}\) and the surrounding instructions \(in_{j-1}\) and \(in_{j+1}\). In other words, the Asm2 Vec model learns to maximize the probability of a specific token appearing within a given context. The proposed control logic embedding method embeds IL code, which consists of opcodes and operands. Since opcodes and operands have distinct characteristics, they contain only designated data. For example, a command like'mov' can only be assigned to an opcode. Therefore, opcode values cannot appear in operands, and embedding must be performed independently for each. For this reason, opcodes and operands are embedded using separate embedding models. Algorithm 1 presents the proposed control logic embedding process. The control logic embedding algorithm first takes the control logic IL code \(X\) as input. \(X\) is then separated into opcodes and operands. To perform integer encoding, the opcodes and operands are mapped to integer indices \(O\) and \(P\) using the mapping function \(f_{map}\). \(O\) and \(P\) are transformed into the vectorized representations \(E_{Opcode}\) and \(E_{Operand}\) through the embedding function \(f_{emb}\). The embedding dimension is determined by the configuration of \(f_{emb}\). The final value of \(E_{Operand}\), denoted as \(E_{Operand}^{final}\), is computed by summing the embedding vectors \(E_{Operand}(p_{i})\) assigned to the opcode and averaging them based on the number of operands in the set, \(|P_{O}|\). In other words, when an opcode has multiple operands, the final vector representation of the operands is defined as the average of their embeddingvectors. Finally, to preserve the IL code format, the generated \(E_{Opcode}\) and \(E_{Oprand}^{final}\) are sequentially combined to form the control logic vector \(V\). This process ensures that the IL code structure is maintained while minimizing information loss during the vectorization process. Figure 3 is an example of the proposed control logic embedding approach. The control logic embedding process consists of five steps:  
1. The IL code is divided into opcode and operands. 2. Since the embedding layer cannot process text directly, opcode and operands are separately converted into integers using distinct integer encoding methods. 3. The integer-encoded opcode and operands are embedded using their respective embedding layers.