Two-Phase Industrial Control System Anomaly Detection Using Communication Patterns and Deep Learning

Round 1

Reviewer 1 Report

The manuscript may be interesting and can be accepted after minor revision. However multiple problems might need to be considered.

1. Two sections in the paper have the same chapter numbers. If the content of these two sections is related, it is recommended to consolidate them into one section. If they cover different topics, adjusting the chapter numbers is suggested. "5. Evaluation" and "5. Discussion"

2. The paper contains a large number of tables, but the format of the tables needs improvement. It is recommended to adjust the table format to become three-line tables. Although Table 1 is a three-line table, the format is incorrect. Other tables should also be adjusted to three-line tables.

3. Figure 8 does not indicate the names of the x-axis and y-axis, making it difficult for readers to understand the data in the table when reading it.

Moderate editing of English language required.

Author Response

Thanks for your kind review for my manuscript. I have incorporated all your feedback into the manuscript. I think the readability is improved due to your comments. Please check the attached document.

Author Response File: Author Response.pdf

Reviewer 2 Report

The work is interesting. However, I am slightly disappointed by the results obtained. Here I would have observations that I still consider minor:

-         -  In introduction or related work section you must include a least one reference more recent than year 2020.

-         -  Section General results, table 3 and 4: for my point of view an accuracy less than 80% is not ok and an accuracy less than 70% is very poor (50% is obtained using a random detection …) . Insert in this section an explanation why is this low accuracy rate for Attack data 3 and why is a difference between Attack data 4 (91%) and attack data 3 (only 66%).

-         -  If these accuracy rates are specific to this kind of applications, a comparison should be made with other works papers in which the performance of the detection method used compared to what was achieved in other works should be highlighted. Enter the comparison also in this section (General results) or in Discussion section.

-         -  Retraining with FP seems to be improving accuracy which is good, however in table 7 there is a significant increase of FN compared with FP – which is not good. Explain in section Discussion why is that increasing of FN/FP ratio compared with table 5.

Author Response

Thanks for your valuable feedback. I agreed your comments and tried to reflect all of them. Please check the attached document.

Author Response File: Author Response.pdf