# Rethinking the Operation Pattern for Anomaly Detection in Industrial Cyber-Physical Systems
## 5 The Framework of Proposed Unsupervised Anomaly Detection Model
### The Second Defence Line  
This line aims to detect malicious operations that violate the operation sequence pattern, such as unauthorised operations, unknown master-slave devices and out-of-sequence operations. This section first introduces the method that automatically learns the sequence pattern, followed by the method used to detect anomalies. Figure 3: The architecture of the proposed unsupervised anomaly detection model. The first line detects elementary attacks at the packet level by examining whether the traffic follows Modbus TCP protocol standards. The last three lines are designed to use the operation sequence, time interval and execution time to detect more advanced attacks. The operation sequence is learnt and described by the deterministic finite automaton (DFA), where nodes \(q\) represent states and edges \(s\) are the transitions triggered by operations. The operation time interval pattern is learnt on each edge to describe the transition time distribution. The execution time also is learnt on the edges to describe the time taken by slaves to execute this type of operation. **Learn sequence pattern. ** This work uses the Deterministic Finite Automaton (DFA) to describe the sequence pattern and examine whether an observed operation is abnormal. This learning approach is similar to the one proposed by [PERSON] et al. [13]. However, this paper extends their method by using the improved operation features and learning operation patterns on the master-slave channels. The classical DFA is a five-tuple \((Q,\Sigma,\delta,q_{0},F)\), where \(Q\) is the finite set of states, \(\Sigma\) is finite set of input symbols, \(\sigma\) is transition function: \(Q\times\Sigma\to Q\), \(q_{0}\in Q\) is the initial state, and \(F\subseteq Q\) are the accept states. Two modifications were made to use the DFA to model operation sequence patterns:  
* No initial state \(q_{0}\) and final accept states \(F\) are required. ICPS is running in endless repetition, so the end of the operation sequence cannot be observed. As the detection model can be deployed at any time, we cannot expect the first observed state \(q_{0}\) to be fixed. Thus, the state \(q_{0}\) is defined as the first state in the observed operation sequence. * The input symbol \(s\in\Sigma\) is defined as a combination of \(Add_{slv}\) and \(FN\). The symbol can be represented as four-tuple \((Add_{slv},FC,Reg_{start},Reg_{cnt})\). For example, a symbol could be {_*. *.41.10,520,0,4,0,38_}, where the _*.41.10_ is the slave IP address \(IP_{slv}\), 520 is the TCP port \(Port_{slv}\), 0 is the unit identity \(UI\), 4 is the function code \(FC\), 0 is the start address \(Reg_{start}\), and 38 is the counter of registers \(Reg_{cnt}\). Therefore, the DFA model used in this work can be represented as three-tuple \((Q,\Sigma,\delta)\). To model operation patterns, this work first splits the dataset \(D\) into master-slave channels according to the masters' addresses. Each channel consists of a unique master device and all connected slave devices. We would like to highlight that a slave device can be included in different channels depending on the ICPS's topology. Therefore, \(D\) is further represented as several subsets \(\{d_{1},\ldots,d_{k}\}\), as shown in line 3 of Algorithm 1, where \(k\) is the number of master devices in the ICPS. This work then extracts the symbol \(s\) of each operation \(op\) for each subset \(d\) by combining the slave device identifier \(Add_{slv}\) and operation type \(FN\). After symbol extraction, each subset is represented as a symbol string, and we then trained the DFA model on each string. Finally, several DFA models \(\{DFA_{1},\ldots,DFA_{k}\}\) were learnt to describe the operation sequence patterns, where \(DFA_{i}\) represents the pattern for the \(i\)-th master-slave channel. The detailed procedure of learning the operation sequence model is presented as the _LearnModel_ function in Algorithm 1.