# Anomaly Detection Method for Unknown Protocols in a Power Plant ICS Network with Decision Tree
###### Abstract  
This study aimed to enhance the stability and security of power plant control network systems by developing detectable models using artificial intelligence machine learning techniques. Due to the closed system operation policy of facility manufacturers, it is challenging to detect and respond to security threats using standard security systems. With the increasing digitization of control systems, the risk of external malware penetration is also on the rise. To address this, machine learning techniques were applied to extract patterns from network traffic data produced at an average of 6.5 TB per month, and fingerprinting was used to detect unregistered terminals accessing the control network. By setting a threshold between transmission amounts and attempts using one month of data, an anomaly judgment model was learned to define patterns of data communication between the origin and destination. The hypothesis was tested using machine learning techniques if a new pattern occurred and no traffic occurred. The study confirmed that this method can be applied to not only plant control systems but also closed-structured control networks, where availability is critical, and other industries that use large amounts of traffic data. Experimental results showed that the proposed model outperformed existing models in terms of detection efficiency and processing time. ICS; unknown protocol; fingerprint; anomaly detection; AI +
Footnote †: journal:  
The control system in Korean power plants operates as a closed network that is directly disconnected from external networks, and remote security installation is not possible. In addition, it is difficult to apply the security system in the field because it is limited to installing a separate security solution in the control system due to the manufacturer's policy. Therefore, there is a lack of real-time identification of assets in the control network and methods for obtaining network visibility, which makes it impossible to verify the stable operating state of the control network. When a problem occurs in the control network, there is no information to identify the cause, making it difficult to analyze the cause and hindering the establishment of a plan for stable operations [7,8]. Thus, it is necessary to collect network traffic data without affecting the control system's availability to detect and record any anomalies in the control system. In order to solve these problems, this study aimed to use a machine learning-based approach that extracts communication patterns from network traffic data and a fingerprinting technique that detects unauthorized terminals attempting to access the control network. In this study, white fingerprinting is used as the primary method for TCP (Transmission Control Protocol), which increases the probability of identifying human communication. On the other hand, UDP (User Datagram Protocol) is primarily used for automated processing, and pattern extraction can more easily distinguish what is not a pattern. We propose a technique for detecting anomalous traffic that involves comparing detection rates by applying machine learning to traffic data accumulated in the control network based on big data analytics. Machine learning techniques can be classified into supervised learning, unsupervised learning, and reinforcement learning [9,10]. Our approach can accurately identify new patterns of data communication between the source and destination by setting a threshold between transmission amounts and attempts and using one month's worth of data to learn an anomaly detection model. Our technique can help protect industrial assets from potential threats caused by changes in the industrial environment and meet operator requirements for a secure industrial control environment. In this paper, we propose a detection technique for anomalous traffic that compares detection rates by applying machine learning to traffic data accumulated in the control  
Figure 1: Network configuration of the power generation control system.