## 3 Laboratory Infrastructure
Notably, perfect or close-to-ideal replication required great attention to hardware and software to accurately simulate a real plant's operation. Since we were unable to perform tests in the actual coal mine setting, laboratory tests offer the only possibility to attempt to evaluate the system's resilience to a cyberattack. However, it should be noted that the lack of actual testing in a real mine environment means that the complexity and unpredictability of live industrial conditions are not fully captured. The reduced complexity may inadvertently overlook interactions and details that are critical to system reliability and security. Consequently, while laboratory simulations offer controlled insights into system behavior, they may not accurately reflect performance under the real-world operational stressors and dynamic factors inherent in a real-world environment. Therefore, special attention should be given to the issue of the performance and detection of bottlenecks that may arise in cybersecurity systems. That kind of test has been performed and teh results are presented in Section 5. The design, implementation, and maintenance of a proper laboratory test setup is expensive. All significant changes in hardware and software implemented in the actual system must be considered, and the laboratory environment must be modified accordingly. In addition to cost, we have to rely on highly skilled professionals who can deal with the laboratory setup, which is also expensive. Finally, cyber threats are constantly modified, particularly in a way that is hard to detect and mitigate. Therefore, the testing methods used in the laboratory must also be updated; software and hardware infrastructure modifications are also necessary in some cases. All things considered, it is important to have a laboratory test environment that mimics the behavior of the real critical infrastructure. It allows us to efficiently and inexpensively carry out many tests safely. Unfortunately, it is both a technological and financial challenge. When limited resources, time, and money are available, a practical solution is to design and implement only a simplified replica of the real system in the laboratory, where we only consider the necessary infrastructure elements and aim to mimic only the key subsystems. As a result, it is possible to obtain a functioning laboratory infrastructure, but we have to remember the existing simplifications and constraints. The laboratory test infrastructure used in this work is presented in Figure 3. We used a simplified laboratory infrastructure due to limited resources and time. The structure consists of a switch to which the server, test station, and programmable logic controller (PLC) are connected. The switch used has a switched port analyzer (SPAN) function, often called \"port mirroring\", that allows for traffic from one or more ports on the switch to be copied onto another port, which can then be analyzed by a monitoring tool. SPAN is particularly useful for monitoring, diagnosing network problems, and analyzing security. The architecture presented allows for the traffic to be replayed on the server and PLC, as well as for communication generation between the test station on the server and PLC. Recreating any traffic and redirecting it to the SPAN port prior to probing analysis are possible. The goal of the laboratory environment is to obtain the network traffic as close as possible to that which is observed in the real facility. Therefore, the focus is solely on network traffic, minimizing the contribution of specialized equipment. To achieve such a formulated goal, a laboratory infrastructure has been designed and implemented using specialized tools that allow for the mapping of any network traffic in a controlled manner. We assume that the generated traffic in the test network came from the real installation and, for the purposes of testing, was deliberately modified to simulate various network attacks. Figure 3: Laboratory test infrastructure.