# Anomaly Detection Method for Unknown Protocols in a Power Plant ICS Network with Decision Tree
## 2 Materials and Methods
### Proposal
#### 2.2.2 Anomaly Pattern Extraction Relation Algebra  
The three-step process mentioned above is aimed at detecting and deriving anomaly points using real traffic data. The following describes the process for verifying the anomaly pattern.  
Step 1 relational algebra--pattern extraction relational algebra  
\(\pi\)G\({}_{\texttt{S}}\),G\({}_{\texttt{D}\texttt{-P}}\),F\({}_{\texttt{COUNT(T)}}\),F\({}_{\texttt{SUM}}\)(F\({}_{\texttt{COUNT(S)}}\))(\({}^{\texttt{G}}\),S\({}_{\texttt{S}\cdot\underline{\texttt{SB}}}\)(\({}^{\texttt{GP}}\),COUNT(T))\(\leftarrow\)\(\underline{\texttt{TB}}\)(FR))\({}_{\texttt{D}}\)  
G: Group & F: Function & S: SOURCE_PORT  
D: DESTINATION_PORT & p: IP_PROTOCOL & T: IN_BYTES/IN_PKTS (Packets)  
FR: FLOW_RAW_DATA & \(\underline{\texttt{SB}}\): COUNT(SRC_PORT) & \(\underline{\texttt{TB}}\): COUNT(IN_BYTES/IN_PKTS)  
In Step 1, the types of patterns and traffic figures for each protocol (mainly TCP and UDP) are obtained from SRC_PORT to DST_PORT. Cases where the number of occurrences is T or more and the pattern type is K or less are sorted in order of occurrence frequency and then checked.  
Step 2 relational algebra--pattern communication count relational algebra  
\(\pi\)G\({}_{\texttt{S}}\),G\({}_{\texttt{D}\texttt{-P}}\),G\({}_{\texttt{T}}\),F\({}_{\texttt{COUNT(S)}}\)((\({}^{\texttt{G}}\),S\({}_{\texttt{S}\geq\underline{\texttt{ST}}}\),S\(\leq\underline{\texttt{ST}}\),D\(\geq\underline{\texttt{DT}}\),D\(\leq\underline{\texttt{DT}}\),D\(\leq\underline{\texttt{DT}}\),D\(\leq\underline{\texttt{DT}}\),(^{\texttt{GF}}\),COUNT(S))\(\rightarrow\)\(\underline{\texttt{SB}}\) (FR))\({}_{\texttt{D}}\)  
G: Group & F: Function & S: SOURCE_PORT  
D: DESTINATION_PORT & p: IP_PROTOCOL & T: IN_BYTES/IN_PKTS  
FR: FLOW_RAW_DATA & \(\underline{\texttt{SB}}\): COUNT(SRC_PORT) & \(\underline{\texttt{ST}}\): SRC_PORT & \(\underline{\texttt{DT}}\): DST_PORT &  
Based on the SRC_PORT and DST_PORT of the highest frequency detected in Step 1, the flow pattern and the number of times communicated through the corresponding port are derived as the pattern type. SRC_PORT and DST_PORT are initially selected by assigning a range, and then, as learning proceeds, the range is narrowed by directly selecting the target.  
Step 3 step relational algebra--anomaly extraction relational algebra  
\(\pi\)W,A,R,S,D,P,B,K,T((^{\texttt{G}}\),S\({}_{\texttt{S}\geq\underline{\texttt{ST}}}\),S\(\leq\underline{\texttt{ST}}\),D\(\geq\underline{\texttt{DT}}\),D\(\leq\underline{\texttt{DT}}\),D\(\leq\underline{\texttt{DT}}\), \(\wedge\)-T(\(\underline{\texttt{TG}}\))) (FR)\({}_{\texttt{D}}\)  
G: Group & F: Function & W: FIRST_SWITCHED  
A: SOURCE_ADDRESS & R: DESTINATION_ADDRESS & S: SOURCE_PORT  
D: DESTINATION_PORT & p: IP_PROTOCOL & B: IN_BYTES  
k: IN_PACKETS & T: IN_BYTES/IN_PACKETS & FR: FLOW_RAW_DATA  
G: & ST: SRC_PORT & \(\underline{\texttt{DT}}\): DST_PORT & ROUND((IN_BYTES/IN_PKTS), 2)  
The time of occurrence, protocol, packet, and bytes of traffic which is not the pattern derived in Step 2 are derived in Step 3. The source port and destination port and pattern are inputted; the record that did not communicate with the entered pattern among the communication through the corresponding port is determined, and it is read as an abnormal time point to be observed.