Malware is the umbrella term for any software that was entirely developed to trigger unwanted or harmful actions in a network. In general, the harmful function is well disguised. Hence, malware can appear safe or even useful at first, starting its harmful actions later or even stealthy over a long period of time. Therefore, industrial control systems not only need security concepts that report new or unknown programs. They also need tactics to identify changing communication patterns and functionalities. Typical malware includes computer viruses, Trojan horses (e.g. ransomware), worms, adware, spyware as well as backdoor programs.