Fig. 1From: An improved content-based outlier detection method for ICS intrusion detectionStepwise procedure of SMLC. A flow set D containing only normal flow is used to construct the normal flow model, and the flow in D is multi-layer clusteredBack to article page