## 2 Related Work  
In light of complex threats such as the Stuxnet malware [1], there have been numerous attempts made towards enhancing the security of existing and future industrial installations [15; 16]. In fact, a considerable amount of research has been allocated to understanding the design of comprehensive anomaly detection systems for the industrial realm [17]. Anomaly detection techniques can learn the normal behavioral patterns of the underlying infrastructure (both physical and cyber) and detect APTs [5]. To this end, we start by mentioning the work of [PERSON], et al. [18], where it was demonstrated that, by incorporating knowledge of the physical process in the control loop, it is possible to detect traditional computer attacks that change the behavior of the underlying physical process. Consequently, by leveraging the knowledge of the physical process, the detection can focus on the attack target, rather than on the various strategies that an adversary may undertake. More recently, in [19], [PERSON], et al., stepped further and designed an attack-resilient controller. In terms of detection, [19] adopted the non-parametric cumulative sum model. The work of [PERSON], et al. [20; 21] built on the assumption that every attack on ICS will ultimately lead to a transition of the system from a secure state to a critical state. Criticalstate descriptions are created by process engineers and are used by detection engines to estimate the state of the process. Essentially, in their work, the authors elaborated a new critical state-based industrial firewall that blocks commands that would force the process to a critical state. More recently, the applicability of data clustering techniques for anomaly detection was explored by the work of [PERSON], et al. [22]. The Gaussian mixture model was compared to the K-means clustering technique, and the superior performance of the former was demonstrated in the context of a chemical process. A similar attempt for the classification of different events was undertaken by [PERSON] and [PERSON] in [23]. Here, an ensemble of two models of one-class classification was developed. Its performance was demonstrated in the context of two industrial installations (an electric arc furnace and a wind tunnel) and several public datasets. In the direction of multivariate statistical analysis, we find the work of [PERSON], et al. [24]. Here, the multi-mode principal component analysis (PCA) was used together with the K-nearest neighbor algorithm for process monitoring and data classification. The approach was evaluated in the context of a mixed refrigeration physical process. In a similar direction, [PERSON], et al. [25] developed a weighted adaptive recursive PCA approach for fault detection in a natural gas transmission pipeline. Conversely, [PERSON], et al. [26], aimed at reducing the size of the monitored parameter space with the help of a multisensor fusion strategy. The approach was tested in the context of state estimation of a small power network. Similarly, [PERSON], et al. [27] developed a PCA-based anomaly detection strategy to reduce the data dimensionality and to detect anomalies in the industrial Internet of Things. By leveraging Dempster-Shaffer's Theory of Evidence, [PERSON], et al. [28] fused evidence from several detectors. Each detector was built as a neural network-based estimator of the next process measurement. Especially in power systems, the problem of defending against cyber attacks has received significant attention. Accordingly, [PERSON], et al. [29], used the measurements from a limited number of Phasor Measurement Units (PMUs) in conjunction with robust projection statistics to perform effective statistical consistency verification against measurements. In [30], the secure state estimation problem was formulated as a non-convex minimization problem. In the same work, the satisfiability modulo theory was used to derive a detection engine for the power system's abnormal behavior.