Abstract: Modern cyber attacks against industrial control systems (ICSs) are highly stealthy, persistent, and targeted. Existing anomaly detection methods are mainly based on a set of rules defining ...