# Rethinking the Operation Pattern for Anomaly Detection in Industrial Cyber-Physical Systems
###### Abstract  
Anomaly detection has been proven to be an efficient way to detect malicious behaviour and cyberattacks in industrial cyber-physical systems (ICPSs). However, most detection models are not entirely adapted to the real world as they require intensive computational resources and labelled data and lack interpretability. This study investigated the traffic behaviour of a real coal mine system and proposed improved features to describe its operation pattern. Based on these features, this work combined the basic deterministic finite automaton (DFA) and normal distribution (ND) models to build an unsupervised anomaly detection model, which uses a hierarchical structure to pursue interpretability. To demonstrate its capability, this model was evaluated on real traffic and seven simulated attack types and further compared with nine state-of-the-art works. The evaluation and comparison results show that the proposed method achieved a 99% F1-score and is efficient in detecting sophisticated attacks. Furthermore, it achieved an average 17% increase in precision and a 12% increase in F1-Score compared to previous works. These results confirm the advantages of the proposed method. The work further suggests that future works should investigate operation pattern features rather than pursuing complex algorithms. anomaly detection; industrial cyber-physical systems; operation pattern +
Footnote †: journal: _Applied_  
banks, newspapers, Chernobyl nuclear power plant) in 2017. These ICPS attacks caused severe damage to national security and people's lives and drew the attention of researchers. However, defending against ICPS attacks is a challenging task for the following reasons [5; 9]: (1) ICPS often include legacy devices due to the lack of replacement options or costly upgrades [10; 11]. These legacy devices are usually equipped with limited computational resources. Therefore, updating programs to support additional security features is challenging. (2) Immediate software patching is always unrealistic, as most devices are critical in the sense that the enterprise cannot afford maintenance downtime [12]. Moreover, some programs are burned into read-only memories (ROMs). (3) Some de-facto protocols were originally designed for serial communication and lacked security mechanisms [13]. For instance, the Modbus TCP protocol does not provide integrity and confidentiality protection. (4) Attacks can damage ICPSs by disrupting control processes without requiring malicious commands. For example, the Stuxnet worm used man-in-the-middle (MITM) technology to intercept and manipulate communications between master and slave devices [14]. In this respect, intrusion detection systems (IDSs) failed to detect these attacks because they usually use legitimate function codes. To address the limitations of IDSs, researchers have proposed using anomaly-based detection methods to identify malicious operations and cyberattacks, because ICPSs' behaviours usually follow consistent patterns [4]. Once an ICPS is built, its topology and communication protocols are generally fixed (at least for a fairly long time), and frequent software patching and updating are unrealistic [8; 15]. Master devices repeatedly poll PLCs at a fixed frequency based on automatic polling programmes and issue repeating sequences of commands [13]. Machine learning (ML) algorithms, especially deep learning (DL) algorithms, provide the ability to learn regular patterns from raw data [16] and are widely used to build anomaly detection models. [PERSON] et al. [17] and [PERSON] et al. [18] evaluated several ML and DL algorithms and demonstrated their ability to detect ICPS attacks. However, as concluded in previous works [5; 19], ML-based and DL-based detection models are not entirely adapted to real ICPS systems due to ICPSs' limited computational resources. To address this limitation, [PERSON] et al. [20] proposed using an isolation forest to build anomaly detection models due to its proven effectiveness and low computational complexity. [PERSON] et al.