יוסי אורן

Industrial control systems increasingly rely on digital monitoring, but cyberattacks can directly affect physical processes controlled by programmable logic controllers (PLCs). Although anomaly detection helps in discovering adverse effects, it is typically deployed outside the controllers that execute the process logic. This paper investigates whether a windowbased Long Short-Term Memory (LSTM) anomaly detector can be implemented inside the same PLC that processes sensor data and drives actuators. We train a sequence-toone LSTM detector on the SWaT dataset and implement it in Siemens Structured Control Language (SCL) for the S7-1500. We evaluate nine configurations on virtual and physical S7-1500 execution environments, analyzing how input-window length and hidden-state size affect detection accuracy and execution time. We also compare step-wise and single-cycle implementations to characterize PLC-side timing limits. The results show that lightweight configurations remain executable on real PLC hardware while providing competitive anomalydetection performance, whereas larger configurations expose clear latency constraints. Overall, the study provides a timing-focused feasibility analysis of PLC-resident LSTM anomaly detection and quantifies the trade-off between detection quality and PLC execution time associated with model complexity.