# Unsupervised Learning Approach for Anomaly Detection in Industrial Control Systems
## 2 Related Work
### Recent Approaches to the Study of Anomaly Detection in Industrial Control System  
Anomaly detection is emerging as a very important research topic, especially in industrial control systems. Industrial control systems play a pivotal role in many areas of production, energy management, traffic control, and more, and anomaly detection in these systems can significantly improve safety and efficiency. Recent studies, mentioned in Table 1, focus on improving intrusion detection and anomaly detection, specifically to address security and reliability issues in complex and diverse industrial environments such as ICS.  
They study how to accurately detect anomalous activities or attacks in high-dimensional and complex industrial data using various techniques and methodologies such as graph neural networks, semi-supervised learning, clustering, and mixed algorithms.  
However, this research is unique in two important ways.  
1. Data-driven tag analysis: The model in this study analyzes operational data from industrial control systems to accurately identify tags of abnormal operation. To do so, we introduce a novel methodology to identify the misbehavior of a particular device by defining its rate of change. This technique enables us to successfully identify complex anomalies that are difficult to detect using traditional methods.
2. Informatization of cluster changes: This research identifies tagged clusters and communicates their changes to control network operators, enabling a rapid response. This process allows security professionals to identify relevant sensors and contribute to the creation of a stable and secure industrial control system environment.  
As such, AI-based anomaly detection techniques play an important role in enhancing the security of industrial control systems. Each of these studies presents different methodologies and approaches, which provide a methodology for the more accurate detection of anomalies in different environments. In the future, these studies will continue to evolve and become more prominent as important research topics in cybersecurity.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Reference** & **Proposed** & **Method** & **Difference to Our Research** \\ \hline [PERSON] et al. [24] & CPS-GUARD & Based on a single semi-supervised autoencoder and outlier detection techniques & Focus on detection models based on Attack type \\ [PERSON] et al. [25] & ST-GNN & Dynamic graph modeling approach based on prior knowledge & Focus on anomaly detection after filtering out data noise \\ [PERSON] et al. [26] & VQ-OCSVM & Network intrusion detection based on hybrid algorithms & Focus on improving network intrusion detection rates \\ [PERSON] et al. [27] & SIMPLE-IID & Intrusion detection based on four simple IIDs (min-max, gradient, steady-time, and histogram) & Focus on improving industrial intrusion detection rates \\ [PERSON] et al. [28] & XGBOOST & Based on alert aggregation intrusion detection system & Focus on attack detection for this model of IDS by integrating many alerts \\ [PERSON] et al. [29] & LSTM & Correlation-coefficient-clustering-based performance improvement techniques & Focus on improving detection rates in simulated environments \\ [PERSON] et al. [30] & Deep SAD & regularity representation learning and normalization from a small number of abnormal samples & Focus on improving intrusion detection performance \\ [PERSON] et al. [31] & Neural Network AutoEncoder & Detects cyberattacks on battery electric storage systems (BESSs) in microgrid using neural network-based autoencoders. & Focus on outliers in electrical measurements \\ \hline \hline \end{tabular}
\end{table}
Table 1: Recent ICS research focused on improving intrusion detection.