# Rethinking the Operation Pattern for Anomaly Detection in Industrial Cyber-Physical Systems
## 5 The Framework of Proposed Unsupervised Anomaly Detection Model
### The Third Defence Line  
The first and second defence lines detect attacks at the packet and operation sequence levels. However, some sophisticated attacks are able to bypass these lines because they will not trigger malformed packets or operation pattern disturbances. The goals and behaviours of these attacks are summarised below:  
* **MITM attack.**The attackers' goals are tampering or eavesdropping on the request or response messages without affecting their sequence and function type. Stuxnet is a typical instance of disrupting production processing by modifying the request commands and response results [14]. These attacks usually involve interception and forwarding processes. Therefore, the transmission time significantly increases [40].
* **Resource exhaustion attacks.** These attacks try to slow the processing of master or slave devices by exhausting computational resources (e.g., CPU, memory). Given their goal, the operation time interval or execution time increase.  
This work proposed using the operation time interval and execution time to detect these sophisticated attacks. The operation time interval is described in this section, and the execution time is discussed in the next section.  
**Learn time interval pattern.** This work uses the normal distribution (ND) model to describe the operation time interval pattern because master devices usually rely on automatic polling procedures to initiate requests. For instance, the system checks the temperature every 5 s [36]. Specifically, ND models are learnt on each transition edge (e.g., the edge from state \(q_{1}\) to \(q_{2}\) in Figure 4) of each DFA model.  
The normal distribution is a common rule used to find outliers. This depends on the assumption that the data are normally distributed, which is often not the case. In ICPS, the time intervals on a transition edge could be mixed because the transition could repeat several times, with different intervals, in one operation cycle. For example, the transition from \(q_{1}\) to \(q_{2}\) triggered by the symbol \(s_{1}\) repeats three times at \(i+1\),\(i+6\) and \(i+11\), as shown in Table 2.  
To address this challenge, this work proposes learning the operation time interval pattern as follows. (1) CKMeans [41] clustering algorithm is first used to cluster the time interval values into sub-clusters for each transaction. CKMeans is a dynamic programming algorithm for optimal 1D clustering. Similar to the widely used \(k\)-means algorithm, they partition complex datasets into \(k\) groups, such that the sum of squared Euclidean distances to each group mean is minimised, but the CKMeans guarantees optimality in the 1D clustering problem. (2) The model then learns the operation time interval pattern on each sub-cluster and describes its pattern using normal distribution \(\mathcal{N}(\mu,\sigma^{2})\), where the mean \(\mu\) is the execution time and deviation \(\sigma\) is the noise transmission latency. (3) Finally, the operation time interval pattern for each transition edge is represented as \(\{\mathcal{N}_{1},\mathcal{N}_{2},\dots,\mathcal{N}_{n}\}\), where \(n\) is the number of the sub-clusters for this transition edge. The detailed procedure of learning the time interval model is represented in Algorithm 2.  
**Detect anomalies.** This defence line detects malicious operations by examining whether the observed time that elapses satisfies the operation time interval pattern. After the inspection of the second defence line, this line can be made aware of the corresponding transaction edge based on the DFA model. Then, it retrieves the corresponding normal distribution modes based on the transaction edge. Finally, as shown in _DetectionModel_ function of Algorithm 2, this line uses the three-sigma rule to determine if the elapsed time satisfies each of these models. The operation is classified as normal if the elapsed time satisfies at least one model. Otherwise, this line reports the observed operation as anomalous with detailed causes and stops further inspection.