# Rethinking the Operation Pattern for Anomaly Detection in Industrial Cyber-Physical Systems
## 5 The Framework of Proposed Unsupervised Anomaly Detection Model
### The Second Defence Line
Figure 4 shows an operation sequence example learnt from the coal mine factory, where the node indicates the internal state, and the edge represents the transition from one state to another. In the detection phase, the DFA model determines the transition edge according to the current state \(q_{curr}\) and the observed symbol \(s\). For example, if the current state is \(q_{2}\) and the observed symbol is \(s_{3}\), the state that is reached should be \(q_{4}\). Figure 4: An example of an operation sequence pattern represented by the DFA model. The transition edge is determined based on the current state \(q_{curr}\) and the observed symbol \(s\). The ground-truth operation cycle of this pattern is shown in Table 2.  
```
Input: dataset of operations \(D\) Output: operation sequence model \(M\) Function LearnModel(\(L\)):
2\(M=\{\}\) split \(D\) into \(\{d_{1},\cdots,d_{k}\}\) according to master address \(IP_{\textit{mat}}\), where \(k\) is the number of master devices for each \(\{d_{1},\cdots,d_{k}\}\)do
3\(\textit{string}\leftarrow\emptyset\) for each operation \(op\) in \(d\)do
4\(IP_{\textit{mat}}\), \(\textit{Par}_{\textit{mat}}\), \(UI\), \(FC\), \(Reg_{\textit{mat}}\), \(Reg_{\textit{mat}}\leftarrow\texttt{op}\);// extract features construct symbol \(s\) using the combination \(\{IP_{\textit{mat}}\), \(\textit{Par}_{\textit{lat}}\), \(UI\), \(FC\), \(Reg_{\textit{mat}}\), \(Reg_{\textit{mat}}\)} append \(s\) into \(str\)
5 end for
6\((\emptyset,\emptyset,\emptyset,\emptyset)\leftarrow\) DFA(\(str\))
7 append \((\emptyset,\emptyset,\emptyset)\) into \(M\) with the index \(IP_{\textit{mat}}\)
8 end for
9 return\(M\)
10 end for Input: observed operation \(op\), operation sequence model \(M\) Output: classification result Function DetectModel(\(M\), \(op\)):
11\(IP_{\textit{mat}}\leftarrow\texttt{op},s\leftarrow\texttt{op}\);// extract features ifIP_{\textit{mat}}\) in \(M\)then
12\((\emptyset,\emptyset,\emptyset)\leftarrow\texttt{M}\);// retrieve DFA according to \(IP_{\textit{mat}}\)
13\(\textit{dev}\);// current state if\(s\in\)\(\Sigma\)then
14 ifexist transition for ascending to \(\delta\) and \(d_{\textit{mat}}\)then
15\(d_{\textit{mat}}\leftarrow\delta(q_{i};s)\);// update state return normal else
16 return abnormal:// deviation transition
17 end if
18 else
19 return abnormal:// unknown symbol
20 end if
21
22 end for Output:
23
24 end for
```  
**Algorithm 1**Operation sequence model  
**Detect anomalies. ** This defence line identifies malicious operations by examining if they obey the normal operation sequence pattern. The examination is performed according to the following steps. The observed symbol \(s\) is first constructed by extracting and combining the slave device identifier \(Add_{\textit{slv}}\) and function type \(FN\). The associated DFA model \(DFA_{i}\) is then retrieved based on the master device's address, and this model is then used to determine if the observed operation is out-of-sequence based on current state \(q_{\textit{curr}}\) and observed symbol \(s\). The detailed procedure of examining the observed operations is presented as the _DetectionModel_ function in Algorithm 1. The transition results typically fall into one of the following four categories:  
* **No matching master. ** The master device \(IP_{\textit{mst}}\) has not been observed in the training dataset. This often means attackers are simulating master devices to operate the slave devices to inject malicious commands. * **Unknown symbol. ** The symbol has never been observed in the training dataset. Several attacks, such as reconnaissance and scanning attacks, could generate unknown symbols. * **Deviation transition. ** There is no transition for the observed symbol, or the transmitted state is different from expected. This transition often means the observed operation violates the normal operation sequence though its function type \(FN\) is legitimate. Several attacks, such as replay, impersonation, or selective forwarding attacks, could lead to this violation. * **Normal. ** The state transits as expected.