# Rethinking the Operation Pattern for Anomaly Detection in Industrial Cyber-Physical Systems
## 4 Features and Preprocessing
### Data Preprocessing  
In order to extract features from industrial traffic, this work first reassembles requests and corresponding responses by examining transaction identifiers, followed by extracting features by observing request and response messages. As the ICPS might use gateways when reassembling, this work identifies slave devices using a three-tuple symbol \(Add_{slv}\), which consists of the slaves' IP address \(IP_{slv}\), TCP port \(Port_{slv}\), and the unit ID \(UI\). In the following, the method used to extract features is described. **Operation sequence-related features. ** Previous works used the function code \(FC\) to describe the meaning of the observed operation [13; 24; 27]. However, this description is limited because requests that use the same function code to read/write different registers have significantly different meanings in ICPS scenarios. This work addressed this limitation by describing the observed operation type using a three-tuple \(FN\), which consists of a function code \(FC\), starting address \(Reg_{start}\) and the number of accessing registers \(Reg_{cnt}\). Therefore, our model learnt not only the function code but also detailed information about the operating registers. **Time interval-related features. ** The method of extracting time interval-related features is similar to the one proposed by [PERSON] et al. [24]. They proposed two methods to measure the time interval. One measured the elapsed time from the last operation, and the other measured the elapsed time from the last similar operation that has the same \(FN\). This work expanded on their extraction method by calculating the time that elapsed when using master-slaves channels rather than master-slave channels. This improvement enabled our model to learn the operation sequence information between slave devices. For example, the system operates the gas valve using device \(A\) only after reading the temperature from the sensor device \(B\) and takes around 500 ms to calculate the control logic. **Execution time-related features. ** It is difficult to obtain an execution time from response messages because the slave devices do not report this information [17]. This work calculates the execution time by measuring the time that elapsed between the last request packet and the first response packet. This time is measured at the detection system that feeds the mirrored industrial traffic from network switches. We would like to clarify that this is an approximate execution time because it contains transmission latency. In the normal network environment, this latency is unstable and is affected by network quality, e.g., network jitters. However, this calculation is reasonable in ICPS because the transmission latency is very small due to the high real-time requirement of ICPS. For example, according to the electric power systems reference architecture IEC 61850, the maximum transmission latency is 3 ms [11]. In summary, this work presents the following feature improvements. (1) A combination of function code \(FC\) and the starting and the total number of operation registers \(Reg_{start}\) and \(Reg_{cnt}\) are used to represent the operation function type, rather than solely using \(FC\). (2) The time interval features are learnt using master-slaves channels rather using than master-slave channels to learn the inter-dependency between slave devices. (3) The execution time is measured by comparing the request and response packets to enable the detection model to learn the execution time for different operation types. The proposed features are summarised in Table 1, where the features are structured into four groups. The first is identity-related features, which uniquely identify the master and slave devices. The operation sequence-related feature describes the semantics of each operation, and the time interval-related feature measures the interval between contiguous operations. The final feature is the execution time-related feature, \(RT\), which measures the time required by slave devices to process operations.