Rethinking the Operation Pattern for Anomaly Detection in Industrial Cyber–Physical Systems

Anomaly detection has been proven to be an efficient way detect malicious behaviour and cyberattacks in industrial cyber–physical systems (ICPSs). However, most models are not entirely adapted the real world as they require intensive computational resources labelled data lack interpretability. This study investigated traffic of a coal mine system proposed improved features describe its operation pattern. Based on these features, this work combined basic deterministic finite automaton (DFA) normal distribution (ND) build unsupervised anomaly model, which uses hierarchical structure pursue To demonstrate capability, model was evaluated seven simulated attack types further compared with nine state-of-the-art works. The evaluation comparison results show that method achieved 99% F1-score is detecting sophisticated attacks. Furthermore, it average 17% increase precision 12% F1-Score previous These confirm advantages method. suggests future works should investigate pattern rather than pursuing complex algorithms.