# Rethinking the Operation Pattern for Anomaly Detection in Industrial Cyber-Physical Systems
## 8 Conclusions  
In this paper, we investigated the operation pattern of a real coal mine system and improved the operation pattern features compared to previous works. Based on the improved features, this work combined the basic deterministic finite automaton (DFA) and normal distribution (ND) models to build an unsupervised anomaly detection model that uses a hierarchical structure to pursue interpretability. The evaluation results show that this model has a good detection performance of a 97% F1-Score. This model also achieved a 17% increase in precision and a 12% increase in F1-Score compared to previous works. These evaluation results confirmed the advantage of the proposed operation pattern features.  
This work combined basic techniques to build the detection model; however, we would like to classify the advantages of the proposed model, as follows. (1) With improved features, the proposed model is able to achieve a better detection performance than complex models. This means that, for the same performance, the proposed model uses fewer computational resources and can meet the strict resource requirement of ICPSs. (2) The techniques used in this work are easy to interpret, which enables the proposed model to provide human-readable classification causes to help experts understand ongoing attacks. The black-box machine learning or deep learning algorithms often lack this interpretability. (3) The unsupervised techniques enable the proposed model to automatically learn the operation pattern without requiring labelled data. The realistic labelled data required by most ML or DL algorithms are difficult to collect because it is prohibited to launch attacks in real systems. These three advantages make the proposed model adaptable to more real systems, and it can be easily retrained if the operation patterns have been upgraded.  
In conclusion, this work proposed a novel operation pattern-based anomaly detection model for ICPS, which uses improved features and combines basic techniques to detect attacks. The advantages of this model suggest that future researchers could focus on using the operation patterns to build intuitive, interpretable models rather than leveraging more complex machine learning or deep learning algorithms. For future works, we plan to test additional semi-supervised algorithms by labelling the class of some of the instances. We also plan to investigate the ability to learn the operation pattern from raw industrial traffic without requiring these patterns to be decoded into plain text request and response messages.  
Conceptualisation, methodology, software, validation, formal analysis, visualisation, writing--original draft preparation Z.C.; investigation, writing--review and editing, funding acquisition J.F.; resources, data curation, supervision, project administration B.C. All authors have read and agreed to the published version of the manuscript.  
This work was supported by the National Natural Science Foundation of China under Grant 62001055.  
Not applicable.  
This data can be found here [[https://github.com/WingPig99/ICPS-Dataset](https://github.com/WingPig99/ICPS-Dataset)]([https://github.com/WingPig99/ICPS-Dataset](https://github.com/WingPig99/ICPS-Dataset)), accessed on 28 February 2023.  
The authors declare no conflict of interest. The funders had no role in the design of the study; in the collection, analyses, or interpretation of data; in the writing of the manuscript; or in the decision to publish the results.