# Rethinking the Operation Pattern for Anomaly Detection in Industrial Cyber-Physical Systems
###### Abstract
[21] combined echo state networks (ESNs) and auto-encoders for detecting anomalies to pursue a trade-off between memory footprint and inference time. However, most ML and DL algorithms face the \"black box\" problem, which means that these models can not give human-readable causes for classification results [22]. In addition to the learning algorithms, the description of regular patterns is also vital when building anomaly-based detection models and directly affects detection performance, such as the detection accuracy and the recognition of novel or sophisticated attacks. However, the features, especially the operation pattern features, used in current state-of-the-art works are insufficient. They either use the function code sequence, operation time interval or a combination of the two to describe the operation patterns [13; 23; 24] or use ML and DL algorithms to automatically learn the representation of operation patterns [25; 26]. A vulnerability of this insufficiency is that the models lack the ability to detect sophisticated attacks (e.g., eavesdropping and tampering attacks). This work investigated real ICPS traffic in a coal mine factory. Then, three features, including operation sequence, operation time interval and execution time, were used to represent the operation patterns. Although operation sequence and time interval were proposed in [13; 24], this work expanded on them to improve their descriptive ability. Based on the improved features, this work implemented an unsupervised anomaly detection model by combining basic deterministic finite automaton (DFA), CKmeans and normal distribution (ND) algorithms. This model does not require labelled datasets and has good interpretability, which makes it more adaptable to real ICPS applications. Especially its interpretability could help security experts to understand ongoing attacks and react quickly. The evaluation results regarding real traffic and seven simulated attacks show that this model achieved a 99% F1-Score with a 1.19% false detection rate. The comparison between the results of the proposed model and nine state-of-art works shows that the proposed model is more efficient in detecting sophisticated attacks and achieves 17% and 12% increments in precision and F1-Score. These evaluation results confirm that well-defined operation pattern features could also improve detection performance. Therefore, this work suggests that future researchers should explore ICPSs' nature and use them to build straightforward, interpretative and unsupervised anomaly detection modes rather than pursuing more complex ML or DL algorithms. The main contributions of this work are listed as follows:  
1. This work improved the features to describe operation patterns and implemented an unsupervised anomaly-based detection model. The evaluation results for real traffic and seven attack types and a comparison of the results with other works confirm the advantages of the improved features. Additionally, this model does not require labelled datasets and has good interpretability. 2. This work could inspire further studies of the operation patterns of ICPSs and use them to detect malicious behaviours and cyberattacks. This paper is organised as follows. Section 2 will discuss the related works. Section 3 provides a brief description of the Modbus TCP protocol. The improved operation pattern features and preprocessing methods are shown in Section 4, followed by the details of the detection model in Section 5. The experiment setup, evaluation and a comparison of the results will be presented in Section 6. A discussion follows in Section 7. Section 8 will conclude the paper.