Detecting anomaly behaviors in ICSs

Anomaly detection in ICSs is a critical aspect of cybersecurity and operational reliability. It involves identifying patterns or activities within the system that deviate from the established normal behavior. These anomalies can indicate potential cybersecurity threats, such as cyberattacks or malware infections, as well as operational issues such as equipment failure, process deviations, or safety risks.

In the following content, we will show various techniques to detect the anomaly behaviors. We start with the classification of various detection techniques and then give examples of each.

Classification

Techniques for anomaly detection in ICSs are primarily classified into four groups: data-driven, model-based, knowledge-based, and also a combination of these. Let us understand each of these in the following sections.

Data-driven techniques

Although data-driven methods can cover a bigger scope than deep learning, here, we primarily...