## 3 System Model, Threat Modeling Framework and Simulation Setup  
### Intrusion Detection Using Machine Learning Models  
This study reveals the different forms of unpatterned attacks on the PCN with their resulting effects on the people, assets, and the environment as depicted in Figure 1. The compromise of the intercommunication between the sensors, controllers, and the final control elements could lead to devastating outcomes which may range from fatalities to environmental impact. This study reviewed the application of different machine learning algorithms in the modeling of these attacks using the 68,722 real-time SCADA datasets from the oil and gas industry. The performances of the different machine learning algorithms were assessed, which include isolation forest, k-nearest neighbor (kNN), Python Outlier detection (PyOD) which incorporates interquartile range (IQR), kNN, local outlier factor (LOF), long short-term memory, support vector machines (SVM) and decision tree algorithms. The 68,722 real-life SCADA data were extracted from an oil and gas facility. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Reference** & **Major Findings** & **Limitations** \\ \hline [PERSON] et al. [17] & Integration of different techniques and algorithms for networking monitoring & i. Integration of the complex solution will require prolonged network downtime. \\ \hline [PERSON] et al. [27] & Quantitative comparison of 17 Unsupervised anomaly detection algorithms & i. High rate of misclassification of unknown attacks ii. High computational complexity, \\ \hline [PERSON] et al. [28] & Machine learning approach using different algorithms to solve intrusion detection problems (supervised learning) & i. The model could not detect zero-day attacks. ii. Not enough details in the public dataset, iii. Computational complex programs \\ \hline [PERSON] et al. [38] & Deep learning and decision tree algorithms for advanced persistent threat attack detection & i. Could not extract important features from the NSL-KDD dataset. ii. The dataset did not reflect the real scenario of the target idea. \\ \hline [PERSON] et al. [39] & Generalized ensemble deep learning for cyber-attack detection in industrial control system & i. Could not distinguish between system downtime and actual real-time attacks. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: _Cont._  
Figure 1: Interconnection of the PCN components under attack. To simulate the impact of amorphous cyber-attacks on the oil and gas industry, a three-phase separator was selected as a case study (see Figure 2). Usually, the natural crude oil flowing from the wellbore which contains entrapped gas and water is fed into a vessel called a three-phase separator. This gravity vessel separates the crude into oil, water, and gas based on their densities [48; 49; 50; 51]. In this study, a three-phase separator was used as a case study for ease of computation and simulation to showcase the effect of false data injection in SCADA. Figure 2 shows a three-phase separator that receives crude oil from the well bore through the shutdown valve and separates the received crude oil into gas, oil, and water. The three-phase separator has three outlets: gas outlet, crude oil outlet, and water outlet. The process variables measured from the vessel include supply pressure, discharge pressure, pressure in the vessel, level of oil with water, level of oil, the temperature of the supplied fluid, vessel temperature, and temperature of the individual discharge lines, whereas the flow was measured on the respective outlet lines. To prevent process upset and its escalation, there is a need for the continuous monitoring of the multivariable inputs with consideration to their interactions in the vessel during the retention time. The 68,722 dataset used in this study's simulation are the three-phase separator vessel pressure data. The outcomes of the simulations using the different machine learning algorithms on the same  
Figure 2: A three-phase separator.