# Research on a PSO-H-SVM-Based Intrusion Detection Method for Industrial Robotic Arms
## 3 Intrusion Detection Method and Response Mechanism
### Intrusion Detection and Response Mechanism
The expressions of cs and S are as follows:  
\[\mathrm{cs}[\mathrm{i}]=\{\mathrm{cv}[\mathrm{i}][\mathrm{j}]|\mathrm{i}=1,2, \ \cdots,\mathrm{k},\ \mathrm{j}=1,2,\cdots,\mathrm{m}\},\ \mathrm{i}=1,2,\cdots,\mathrm{k} \tag{5}\]  
\[\mathrm{S}=\{\mathrm{cs}[\mathrm{i}]|\mathrm{i}=1,2,\ \cdots,\mathrm{k}\} \tag{6}\]  
\[\mathrm{SDS}=\{\mathrm{cs}[\mathrm{i}]\rightarrow\mathrm{cs}[\mathrm{j}]| \mathrm{j}-\mathrm{i}=\mathrm{e},\ \mathrm{e}=0,1\} \tag{7}\]  
where, \(\mathrm{cv}[\mathrm{i}][\mathrm{j}]\) is the ith eigenvalue in the ith state; \(\mathrm{cs}[\mathrm{i}]\) is the ith state, that is, \(\mathrm{cv}[\mathrm{i}][\mathrm{j}]\) synthesizes state \(\mathrm{i}\); \(\mathrm{k}\) is the number of all states; \(\mathrm{m}\) is the number of eigenvalues indicating each state; and \(\mathrm{e}\) is the difference of state values, taking only the two values of 0 and 1. The state eigenvalues are the joint-related parameters expressing each state, containing 23 sets of eigenvalue information on position, velocity, acceleration of the 7 joints, and the closing angle of the gripper joints. The pseudo-code for the intrusion detection algorithm is shown in Algorithm 2. The physical process intrusion detection module is to detect whether the operation state of the robotic arm is abnormal during the entire closure operation. If the state transition does not exist in the SDS during the operation of the robotic arm, it means there is an abnormality. The intrusion detection module is the first to build a state classifier, in the normal operation of the robotic arm, that completes the closure operation process and collects the joint position, joint speed, joint angular velocity and the closing angle of the jaws of each path. The collected data will be pre-processed to produce data sets, with all the data divided into five categories of states according to the actual operating conditions and marked with the corresponding labels. The PSO-H-SVM model mentioned in Section 3.2 is trained based on the dataset, and the model is saved for later state classification when the model training achieves the expected effect of state classification. In the real-time intrusion detection of the running robotic arm, the real-time running joint data are collected, and the data are pre-processed and inputted into the classification model to classify the current running state, and to judge whether the state transfer is in line with the situation in SDS. If it is in line, then detection of the next set of real-time data should continue; if not, it means that an abnormality is detected, and the response mechanism should be triggered to carry out security protection measures for the robotic arm. The response mechanism is an integral part of the intrusion detection system and is used to safeguard the system from malicious users [47]. The response mechanism module is triggered when a physical process logic anomaly is detected, and the response mechanism includes alarms, robotic arm protection measures, and logging functions. Among them, the alarm function is to display an alarm message at the detection terminal after detecting an abnormality: \(\{\)Alert: An abnormality in the system, the transfer of state x-> state x is illegal, please check\(\}\). This prompts the operator that an abnormality has occurred, and for them to manually intervene in the control of the robotic arm. The protection measure of the robotic arm is to continuously send the current control command of the joint position to keep the robotic arm in its current position and from no longer running. The measures used in engineering are generally to make the robotic arm power down and shut down; compared to the proposed method in this paper, the advantage is that there is no need to shut down the entire system, as the operator still has access to the robotic arm, which can be further secured. The logging function is to record abnormal information and state transition information when an abnormality is detected for subsequent analysis by the operator.