## 1 Introduction  
Supervisory Control And Data Acquisition (SCADA) is a distributed cyber-physical system that seamlessly integrates sensing, communication, computing, and control technologies [1] and provides fine-grained monitoring and control in many key infrastructure fields of the state, such as smart grids, smart transportation, environmental monitoring, and healthcare. SCADA is mainly composed of sensors, actuators, remote state estimation systems and controllers. The remote state estimation system triggers the control algorithm or control condition of the controller according to the monitoring data returned by the sensor, and sends the control command to the actuator; the actuator executes the command to control the physical process, and forms a closed-loop feedback control system; the operational security of its cyber-physical system highly depends on the network control system [2; 3]. Due to the deep interconnection of modern SCADA system equipment and the wide application of information infrastructure, the SCADA system itself is exposed to attackers [4; 5]; the standard communication protocols used in general control systems (such as MODBUS, DNP3, and EtherNET/IP) lack identity verification, which enables the vulnerability mining and attack methods of the traditional information security domain to be used in the SCADA system [6]. Therefore, attacks on SCADA systems have appeared continuously in recent years, such as the \"Stuxnet\" virus targeting Iranian nuclear facilities in 2010, the \"Duqu\" worm virus targeting industrial control system information in 2011, the \"Flame\" cyber spyware in 2012, the \"Havex\" malicious program found in more than a thousand energy companies in Europe and the United States in 2014, and the \"Black Energy\" attack that occurred in a Ukrainian substation in 2015. They are all typical industrial control security incidents with extensive and far-reaching impacts, such as heavy economic losses and extremely high social harm. Sequential logic attack is a unique attack in industrial control systems which highly depends on the control process. By modifying the time logic or sequence logic of the messages or commands sent by the control system, it disturbs or destroys the process control sequence of the actuators in order to destroy the physical process and even the equipment. Since the data value of the message size and time, the command sequence, and the ICS state are completely legal, it is difficult to analyze and detect with the traditional intrusion detecting method based on \"semantics\" [7]. In recent years, the problem in the sequential logic of industrial control has gradually attracted great attention from academia and industry. [PERSON] et al. [8] used an experimental prototype in which high-pressure steam flowing on a pipeline is adjusted by the control valve, in order to study the impact and harm of sequential attacks on the pipeline. The high-pressure steam flowing on the pipeline is controlled by two valves (V1 and V2). By closing and opening these two valves (V1 and V2) at the right time, the pressure can be successfully increased to a critical value or can even break the pipeline. In fact, in 1997, a similar case based on sequential attack was proposed in the report of the Critical Infrastructure Protection Committee of the President of the United States [9]. The report analyzed the urban water supply pipe network system and found that if an attacker quickly sent a legal control command to certain main control valves to trigger valve opening or closing commands in a short period of time, these valves would be opened or closed quickly at the same time, leading to the so-called \"water hammer effect\" directly causing many major pipelines to break at the same time.