Summary

In this chapter, we introduced the basic knowledge about the ICS and its components, and then based on the aforementioned information, attacks targeting ICSs and their components were presented. With the categorization of various types of attacks, and fundamental techniques that cause these attacks, we now know that the attack section not only has similarity with the normal attacks targeting the IT/DT field but also the unique features for the anomaly detection system in the area of ICSs. Last but not least, we covered anomaly detection, which included not only general anomaly detection with consideration of structural information of the ICS but also one of the specific anomaly behaviors in ICSs: ransomware detection. For both examples, we introduced machine learning/deep learning-based methodologies to illustrate the state-of-the-art approaches.

Lastly, at the end of the chapter, we also summarized the challenges. We will discuss data quality and its influence on anomaly...