## 5 Conclusions  
This paper has presented a pipeline for classifying SCADA images as belonging to IT or OT systems using transfer-learning- and fine-tuning-based approaches on a custom SCADA dataset named CRINF-300. Moreover, we have applied it to a real-case scenario where we classify images to enhance surveillance tasks on critical infrastructure systems to detect and prevent potential security breaches. We have analyzed nine different CNN architectures using their pre-trained weights on the ImageNet dataset to train three different approaches for image classifiers: transfer  
Figure 4: Time comparison of the results obtained in our proposed pipeline using the CPU (**a**) and the GPU (**b**). learning with a logistic regression classifier or with an SVM classifier and fine-tuning. We also register the average time in the classification of each image on both the CPU and GPU. For transfer learning, we validated our approach using the F1-score, and accuracy, and five-fold cross-validation during training. We trained and tested the architectures on a 337 image dataset provided by INCIBE, containing 74 IT images and 263 OT images. We proposed a new model head after freezing the last layers of the selected architectures and adding a custom set of layers for fine-tuning. We enhanced our images with data augmentation and trained our model using training-testing validation. Our results show that the best CNN architectures for our problem are Inception-ResNet-V2, as it is the best architecture performance-wise with a 98.32 and 98.13 F1-score on our transfer-learning-based approach, and MobileNet-V1, as it has the best performance-speed trade-off, with an F1-score of 97.58 and a speed of 0.06 s on the CPU. Out of the two classifiers proposed for transfer learning, although close in performance, the logistic regression model seems to be better suited for our problem, with higher average scores, reduced performance variance, and decreased computational time. We conclude that transfer learning is the better approach for our problem based on the performance of the Inception-ResNet-V2 and MobileNet-V1 networks. While VGG16 obtained a noticeable improvement when fine-tuning the architecture, it did not surpass MobileNet's original score, even when increasing our total number of images by up to five times using data augmentation. Our future work will be focused on further improving the proposed solution, increasing our training images, and adding new layers on top of the given architectures based on our VGG16 results. Another possibility is to extend the current study further to include different architectures, such as VGG19 [26]. The inclusion of more detailed classes is also a future line of investigation for this image classification task. Finally, after classification is performed, images can be further analyzed by retrieving information found within them [8], such as brand or company names, using text spotting [43; 44]. Conceptualization, P.B.-M., E.F., and E.A. ; methodology, P.B.-M., E.F., and E.A. ; software, P.B.-M.; validation, P.B.-M., E.F., and E.A. ; formal analysis, P.B.-M., E.F., A.R.A.V.-C., F.J.-M., and V.F.V. ; investigation, P.B.-M.; resources, E.F. and E.A. ; data curation, P.B.-M.; writing--original draft preparation, P.B.-M.; writing--review and editing, P.B.-M., E.F., E.A., R.A.V.-C., F.J.-M., and V.F.V. ; visualization, P.B.-M.; supervision, E.F. and E.A. ; project administration, E.F. and E.A. ; funding acquisition, E.A. All authors have read and agreed to the published version of the manuscript. This research was supported by the grant \"Ayudas para la realizacion de estudios de doctorado en el marco del programa propio de investigacion de la Universidad de Leon Convocatoria 2018\" and by the framework agreement between Universidad de Leon and INCIBE (Spanish National Cybersecurity Institute) under Addendum 01. Not applicable. Data Availability Statement: Data sharing is not applicable in this article.