Earticle

Anomaly detection systems for Industrial Control System (ICS) cybersecurity are designed to identify irregularities in network packets or operational data. However, they cannot detect attacks like Stuxnet, which physically injects malicious control logic. While existing studies on control logic modulation address this issue, they rely on separate storage and produce false positives. To overcome these limitations, this paper proposes an anomaly detection method that embeds PLC control logic, preserving its structure. By training the model on this embedded control logic, it learns to detect anomalies effectively. Experiments using the PLC control logic from a power plant's water treatment system confirmed that the proposed method successfully detects anomalous control logic.