# Unsupervised Ensemble Methods for Anomaly Detection in PLC-based Process Control

arXiv: https://arxiv.org/abs/2302.02097 · HTML: https://mlsanity.com/paper/2302.02097/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 9 of its 80 references that are in the map.
- First posted on arXiv 4 Feb 2023.

## Builds on (most cited first, 9 of 9)

- [Ensemble deep learning: A review](https://mlsanity.com/paper/2104.02395/) (2021)
- [Anomaly Detection using One-Class Neural Networks](https://mlsanity.com/paper/1802.06360/) (2018)
- [Extended Isolation Forest](https://mlsanity.com/paper/1811.02141/) (2018)
- [Anomaly Detection for a Water Treatment System Using Unsupervised Machine Learning](https://mlsanity.com/paper/1709.05342/) (2017)
- [Presentation of a Recommender System with Ensemble Learning and Graph Embedding: A Case on MovieLens](https://mlsanity.com/paper/2008.01192/) (2020)
- [Efficient Neural Network Deployment for Microcontroller](https://mlsanity.com/paper/2007.01348/) (2020)
- [Detecting Anomalous User Behavior Using an Extended Isolation Forest Algorithm: An Enterprise Case Study](https://mlsanity.com/paper/1609.06676/) (2016)
- [Security Aspects of Internet of Things aided Smart Grids: a Bibliometric Survey](https://mlsanity.com/paper/2005.00915/) (2020)
- [A C Code Generator for Fast Inference and Simple Deployment of Convolutional Neural Networks on Resource Constrained Systems](https://mlsanity.com/paper/2001.05572/) (2020)

## Built on by (most cited first, 1 of 1)

- [Two-phase Dual COPOD Method for Anomaly Detection in Industrial Control System](https://mlsanity.com/paper/2305.00982/) (2023)

## Abstract (arXiv)

Programmable logic controller (PLC) based industrial control systems (ICS) are used to monitor and control critical infrastructure. Integration of communication networks and an Internet of Things approach in ICS has increased ICS vulnerability to cyber-attacks. This work proposes novel unsupervised machine learning ensemble methods for anomaly detection in PLC-based ICS. The work presents two broad approaches to anomaly detection: a weighted voting ensemble approach with a learning algorithm based on coefficient of determination and a stacking-based ensemble approach using isolation forest meta-detector. The two ensemble methods were analyzed via an open-source PLC-based ICS subjected to multiple attack scenarios as a case study. The work considers four different learning models for the weighted voting ensemble method. Comparative performance analyses of five ensemble methods driven diverse base detectors are presented. Results show that stacking-based ensemble method using isolation forest meta-detector achieves superior performance to previous work on all performance metrics. Results also suggest that effective unsupervised ensemble methods, such as stacking-based ensemble having isolation forest meta-detector, can robustly detect anomalies in arbitrary ICS datasets. Finally, the presented results were validated by using statistical hypothesis tests.