Firewall Log-Based Rule Extraction and Passive Anomaly Detection for Tobacco ICS Security

Industrial control systems in tobacco manufacturing are increasingly exposed to cyber threats due to interconnected network architectures. To address the limitations of static firewall policies and the lack of interpretable anomaly detection solutions, this paper proposes a rule-mining-based anomaly detection method leveraging historical firewall logs. By applying the Apriori algorithm, frequent communication patterns are extracted to construct behavior models representing normal device interactions. A passive detection prototype is implemented in bypass mode, supporting real-time traffic analysis, rule-based matching, and topology-aware visualization without interfering with production processes. Compared with conventional machine learning approaches, the proposed method emphasizes interpretability, lightweight deployment, and adaptability to evolving industrial environments. Experimental results on real-world firewall logs from a tobacco manufacturing plant validated the feasibility and effectiveness of the proposed approach in identifying anomalous communication behaviors.