# Unsupervised Learning Approach for Anomaly Detection in Industrial Control Systems
###### Abstract  
Industrial control systems (ICSs) play a crucial role in managing and monitoring critical processes across various industries, such as manufacturing, energy, and water treatment. The connection of equipment from various manufacturers, complex communication methods, and the need for the continuity of operations in a limited environment make it difficult to detect system anomalies. Traditional approaches that rely on supervised machine learning require time and expertise due to the need for labeled datasets. This study suggests an alternative approach to identifying anomalous behavior within ICSs by means of unsupervised machine learning. The approach employs unsupervised machine learning to identify anomalous behavior within ICSs. This study shows that unsupervised learning algorithms can effectively detect and classify anomalous behavior without the need for pre-labeled data using a composite autoencoder model. Based on a dataset that utilizes HIL-augmented ICSs (HAIs), this study shows that the model is capable of accurately identifying important data characteristics and detecting anomalous patterns related to both value and time. Intentional error data injection experiments could potentially be used to validate the model's robustness in real-time monitoring and industrial process performance optimization. As a result, this approach can improve system reliability and operational efficiency, which can establish a foundation for safe and sustainable ICS operations. industrial control system (ICS); unsupervised learning; SCADA; cyber-physical system; OT (operational technology) +
Footnote †: journal: Medical  
As recent cyberattacks have shown, securing ICSs is imperative. However, detecting anomalies in these systems poses several challenges. The ICS is characterized by the use of diverse equipment from multiple vendors, proprietary protocols, and complex communication methods that add to the complexity of securing these systems [11]. The continuous operation of these vital infrastructure management systems further limits access to real-world environments for security research. In addition, the application of security patches or updates to ICSs operating in environments such as production lines and energy infrastructures can be delayed, limiting their practical implementation [12]. Past cyberattacks, such as the Stuxnet event and the Ukrainian power grid attack, underscore the challenge of detecting system anomalies before they cause damage [13]. Anomaly detection in industrial control systems is a significant challenge due to the variety of devices from different vendors, each operating with proprietary protocols and complex communication methods [14]. It is critical to provide timely information to operators to prevent actual damage before it occurs. Our research focused on OPC servers to address these challenges. Figure 1 shows the conceptual diagram between OT, ICSs, and SCADA. It also shows the OT portion of the Purdue model. The function of an OPC server is to process signals and data from field devices in a standardized manner and convert them into a format that clients can understand. This is accomplished by assigning a unique identifier, or tag, to each piece of data. Tags allow users to identify and retrieve data collected by the OPC server from field devices. These tags typically contain information about the device's location, data type, and value, and are organized in a way that is easy for humans to understand. However, in the domain of the ICS, the absence of descriptive annotations for tag values can significantly impede user interaction with the system, making configuration and management tasks more complex. This research aims to solve the problem of detecting anomalies within a complex system composed of different devices, each characterized by its own protocols and communication methods. This research focuses on the use of unsupervised learning techniques as a solution to this problem.