# Unsupervised Machine Learning Techniques for Detecting PLC Process Control Anomalies
## 4 Proposed Method
### OCNN-Based Detection Approach  
Neural networks for one-class classification have been proposed in [45, 46, 47]. However, this work presents OCNN algorithm formulated on the foundation of OCSVM optimization problem [43], and a proposed alternating minimization algorithm in [33] to form a feed-forward neural network architecture capable of detecting PLC anomalies. OCNN combines the ability of feed-forward neural network to extract features from the data along with a one-class objective to become a universal anomaly detector. Given a feed-forward neural network with a hidden layer, activation function \(g\), and an output node, the alternate minimization algorithm proposed by [33] is used to obtain the objective function. Derivation of the OCNN follows the overall OCSVM objective function in (3). The resulting objective function is used to solve the scalar output obtained from the hidden layer to the output layer \(w\), and the weight matrix from the input to the hidden node \(V\) as  
\[\arg\min_{w,V}\frac{1}{2}\|w\|^{2}+\frac{\|V\|^{2}}{2}+\frac{1}{vN}\sum_{n=1}^{ N}\ell(y_{n},\hat{y}(w,V))\]  
where  
\[\ell(y,\hat{y})=\max(0,y-\hat{y}),\;y_{n}=b,\;\text{and}\;\hat{y}(w,V)=\langle w,g(VX_{n})\rangle\]  
Using the same alternate minimization approach as [33], the optimization problem for the bias, \(b\) is  
\[\arg\min_{b}\left(\frac{1}{vN}\sum_{n=1}^{N}\max(0,b-\hat{y})\right)-b\]  
Finally, the OCNN objective function generalization is  
\[\min_{w,b,V}\frac{1}{2}\|w\|^{2}+\frac{1}{2}\|V\|^{2}\frac{1}{vN}\sum_{n=1}^{ N}\max(0,b-\langle w,g(VX_{n:})\rangle)-b \tag{4}\]  
where \(v\) parameter controls the trade-off between maximizing the distance of the hyperplane from the origin and the number of data points allowed to cross the hyperplane. This approach allows the model to utilize rich features obtained from unsupervised transfer learning, particularly for anomaly detection in a complex dataset where the decision boundary between the normal data points is highly nonlinear. The solution to optimizing (4) is summarized in Algorithm 3.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Parameter** & **Description** & **Choice** \\ \hline kernel & Type of kernel used in the algorithm & polynomial \\ degree & Degree of polynomial kernel function & 3 \\  & Controls how much the model is influenced by & \\ coef0 & high-degree polynomials versus low-degree polynomials & 4 \\  & An upper bound on the fraction of training errors and a & \\ nu(\(v\)) & lower bound of the fraction of support vectors & 0.1 \\ gamma & Defines the level of a single training example’s influence & 0.1 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Model hyperparameters for OCSVM.  
Given a training dataset \(\{X_{i}|i=1,2,3...,n\}\), the width \(b\) of the hyperplane margin is first initialized. The model uses backpropagation to learn the neural network parameters \((w,V)\). The model then iteratively updates \(b\) to achieve convergence. Then, the scoring function \(S_{n}\) labels the data points as normal and anomalous instances based on the convergence criterion \(\epsilon\) with:  
\[y=\begin{cases}1&\text{if }S_{n}(x)>\epsilon\\ -1&\text{if }S_{n}(x)\leq\epsilon\end{cases} \tag{5}\]  
where \(y\) represents binary classes of the decision function scores, \(S_{n}(x)\).  
The OCNN architecture consisted of 32 hidden layers with rectified linear activation (ReLU) function. Various hyperparameters are used to configure the OCNN model. Table 3 shows the optimal hyperparameters chosen for the OCNN after hyperparameter tuning.