  Traffic of Industrial Control System (ICS) between the Human Machine
Interface (HMI) and the Programmable Logic Controller (PLC) is known to be
highly periodic. However, it is sometimes multiplexed, due to asynchronous
scheduling. Modeling the network traffic patterns of multiplexed ICS streams
using Deterministic Finite Automata (DFA) for anomaly detection typically
produces a very large DFA, and a high false-alarm rate. We introduce a new
modeling approach that addresses this gap. Our Statechart DFA modeling includes
multiple DFAs, one per cyclic pattern, together with a DFA-selector that
de-multiplexes the incoming traffic into sub-channels and sends them to their
respective DFAs. We demonstrate how to automatically construct the Statechart
from a captured traffic stream. Our unsupervised learning algorithm builds a
Discrete-Time Markov Chain (DTMC) from the stream. Next it splits the symbols
into sets, one per multiplexed cycle, based on symbol frequencies and node
degrees in the DTMC graph. Then it creates a sub-graph for each cycle, and
extracts Euler cycles for each sub-graph. The final Statechart is comprised of
one DFA per Euler cycle. The algorithms allow for non-unique symbols, that
appear in more than one cycle, and also for symbols that appear more than once
in a cycle. We evaluated our solution on traces from a production ICS using the
Siemens S7-0x72 protocol. We also stress-tested our algorithms on a collection
of synthetically-generated traces that simulated multiplexed ICS traces with
varying levels of symbol uniqueness and time overlap. The algorithms were able
to split the symbols into sets with 99.6% accuracy. The resulting Statechart
modeled the traces with a low median false-alarm rate of 0.483%. In all but the
most extreme scenarios the Statechart model drastically reduced both the
false-alarm rate and the learned model size in compare to a naive single-DFA
model
