# Anomaly Detection Method for Unknown Protocols in a Power Plant ICS Network with Decision Tree
## 2 Materials and Methods
### Proposal
#### 2.2.1 Anomaly Detection Model Patterns  
To diagnose anomalies, traffic that meets the reference point K (over 400 traffic attempts) should be targeted for the number of communications. In natural traffic, defining a specific communication pattern is difficult because traffic with only packet headers (64 KB(Kilobyte)) includes attempted traffic with payloads of various sizes. Limited kinds of sizes are generated because they are generated by \"patterned communication\".  
**H\({}_{\mathbf{0}}\)**: _General Model \(O=K\times(T\geq 9)\)_.  
In the null hypothesis, general model O, the number of packet sizes T of the traffic that satisfies all the reference points K is 9 or more.  
**H\({}_{\mathbf{1}}\)**: _Detection Model P is \(P=K\times(T<9)\)_.  
The alternative hypothesis, detection model P, can be defined as \"patterned communication\" when the number of packet sizes T is 8 or less through an intended attempt for the traffic that satisfies all reference points K. The alternative hypothesis posits that pattern communication is performed in the control network of the private protocol. Pattern communication is defined as a control network communication with a P pattern that satisfies both K, the number of packet sizes generated from SRC (Source)_PORT to DST (Destination)_PORT, and T, the frequency of occurrence for each packet size.  
The AI decision tree algorithm is used to find the condition factors K and T for deriving the factor P of the hypothesis. K should derive the type of packet size to find an optimal factor, and T should derive a boundary value that exceeds the minimum frequency of occurrence for each K. If both conditions are satisfied, P is defined as a control network communication having a pattern, and if it deviates from the pattern, it can be determined as an abnormal symptom.  
The network traffic generated within the control network has the following basic structure: the number of bytes per IP, SRC_PORT, and DST_PORT. Figure 4 shows the system configuration used in this study. The traffic generated from the control network was collected in the collection area through a collection agent, and the collected data were transmitted to the analysis system and used for analysis.  
Figure 4: Network configuration for pattern detection.  
In the case where the traffic generated from SRC_PORT to DST_PORT exceeds a specific threshold (initially set value T learned from data), it is identified as an abnormal symptom. Examples of patterns registered between operations are configured to maintain detection patterns by applying set values accumulated through supervised learning.  
Traffic data within the control network is separated by the TCP and UDP protocols and preprocessed by composing XML (Extensible Markup Language) files. Figure 5 shows the TCP protocol metadata schema, and Figure 6 shows the UDP protocol metadata schema structure.  
The XML schema is a user-defined type with a flexible structure that can immediately reflect changes in control network items. The schema structure consists of the ID (Identifier), SRC_PORT, DST_PORT, input packets, input bytes, output packets, output bytes, protocol types (TCP:6 and UDP:17, etc.), and VLAN (Virtual Local Network) ID, which are indexes. The data type is defined as a number.  
To extract an anomaly pattern, the first step is pattern extraction, the second step is pattern communication count, and the third step is extraction of the anomaly time point.