## 4 Methodology and Detailed Entropy Analysis  
This work extends our previous work. In this work, we conducted a detailed entropy analysis using a larger feature set and shorter clusters. We chose seven features--packet size, inter-packet delay, packet process time, Modbus frame length, function code, protocol overhead, and data. The final four features represent the Modbus protocol. Another feature--CRC--that showed high information gain, as presented in [10], was omitted as it does not apply to Modbus over TCP traffic. We chose to use a 3000-packet cluster size to analyze how entropy values change for each feature. We intentionally deviated from using a time-based cluster as network activities in the datasets were inconsistent and would not give us a true picture of entropy changes with malicious activities. We decided to use a 3000-packet cluster after a careful review of the 5000-packet cluster size and 10,000-packet cluster size. Again, we chose to focus on the top three attacks--MITM, DOS, and Reconnaissance. Figure 2 shows a high-level block diagram of our approach. Figures 3 and 4 show the percentage of malicious traffic overall and the same with different attack types, respectively. Figure 5 shows packet size entropy per cluster. As entropy reflects the degree of randomness in network traffic, a general expectation is that entropy will be low when network traffic demonstrates similarity in pattern, be it for non-malicious traffic or otherwise. We can observe similar patterns with packet-size entropy except for a few clusters, namely 46-60, 71-74, 106-107, and between 131 and 136. To analyze this behavior, we refer to the entropy analysis graph with attack types in Figure 6. For clusters 46-60, we see a high percentage of MITM attacks resulting in higher entropy. The same pattern can be seen for 106-107. For clusters 71-74, we see a decrease in MITM traffic, resulting in a decrease in entropy for malicious traffic, and it (entropy) going up again as MITM traffic increases. For clusters 131-136, we can see packet-size entropy for malicious traffic decreasing and then going up, which can be attributed to a rise in MITM, as well as other attacks. Other attacks have been defined in the datasets as \"overheat\", \"overcool\", \"display fake values\", \"simultaneous heating and cooling\", \"system shutdown\", and \"setpoint changing\". Figure 4: Percent of malicious traffic per cluster with attack type. Figure 3: Percentage of malicious traffic per cluster. Figure 2: Block diagram of our approach. We also see a consistent pattern of higher packet-size entropy for malicious traffic over non-malicious traffic during MITM and DOS attacks. This is evident from Figure 7, where we have plotted entropy for both malicious and non-malicious traffic with a 1000-packet cluster size. Figure 5: Packet size entropy per cluster. Figure 6: Packet size entropy per cluster with attack type. Figure 7: Packet size entropy per cluster with attack type for 1000-packet cluster. Inter-Packet Delay (IPD): A similar pattern is observed for IPD in Figures 8 and 9, where entropy values, represented by the black line in Figure 8, move up and down and remain steady for a prolonged period of similar traffic patterns, malicious or otherwise. One outlier observation is noted for clusters 59-61 in Figure 8, where entropy drops even in the middle of malicious activity, showing less randomness than we anticipated. This can be attributed to high MITM attacks when IPD entropy for malicious traffic is high, which can be observed in Figure 9. Overall, IPD entropy for malicious traffic shows a consistent pattern of higher values during MITM and DOS attacks, as evident from Figure 10, showing malicious and non-malicious entropy values with a 1000-packet cluster. Packet Process Time (PPT): Similar patterns are observed in Figures 11 and 12 with outlier clusters 58-61, 96-100, and 132-133. We can use a similar line of reasoning to explain the outliers. PPT entropy consistently shows higher values during MITM and DOS attacks.