## 6 Summary and Conclusions  
The properties of the tools discussed above were used in a project to develop detectors for network traffic anomalies at a coal mine. Due to the inability to perform quality tests in the mine facility, a test laboratory environment was developed. It was intentionally simplified compared to the industrial infrastructure but allowed for the reproduction of traffic prevailing in real industrial conditions. The developed test environment and the tools used made it possible to reproduce real conditions in a very short time with the involvement of minimal financial resources. Furthermore, the tests helped us to verify the effectiveness of the developed cybersecurity algorithms. In addition, the operation of the probe on a PLC and a Linux server was confirmed. Using the developed laboratory environment and the software tools, tests of the detectors were successfully carried out in the Linux server environment and the PLC environment. Various attack generation techniques were used during the tests. GAN neural networks and Caldera software solutions were used to modify the register values in the MODBUS protocol. Caldera was also used for both the network scanning and man-in-the-middle attacks. In addition, performance tests were conducted. Importantly, the described virtual environment enabled advanced testing in a piecemeal fashion, limited to the scope of testing, thus greatly minimizing the need to purchase dedicated hardware. The ability to simulate traffic in virtual environments, such as containers or virtual machines, eliminates the need to invest in physical testing hardware, further increasing testing flexibility. The developed solution was successfully used to verify security solutions for the Modbus protocol. This article presents the experience gained while developing a cyber security system for a mine. Special attention was paid to the limitations and conditions occurring in the real industrial installations of such critical infrastructure. In particular, the absolute prohibition of disrupting communications resulted in the inability to conduct tests in a production environment. The solution to such constraints was to develop a methodology to recreate a realistic test environment with minimal time and money. The developed approach focused on security, cyberattacks, and vulnerabilities, describing the input data and the tools used to carry out the attacks. During the preparation of the data, attention was paid to the issues of data selection and the aspect of performance as key features to achieve reliable results to demonstrate the effectiveness and robustness of the proposed system in dealing with cyberattacks in a real coal mine environment. Further work has been planned to consider other communication protocols and to evaluate the effectiveness of other anomaly detection algorithms. Secondly, we intend to apply the presented approach to other processes. This is because the presented approach to replicating the IT/OT infrastructure is flexible and can be applied not only in mine systems but also in different industrial systems. Moreover, it can find its use in embedded systems, e.g., automotive applications [69], robotics [70], and drones [71]. Conceptualization, S.P., M.L. and E.N.-S.; methodology, S.P., P.C., M.L., R.N., E.N.-S., J.S., K.Z., A.K. and A.S.; software, S.P., P.C., A.K., R.N., J.S. and K.Z. ; validation, S.P., P.C., R.N., J.S. and K.Z. ; formal analysis, S.P., P.C., R.N., J.S. and K.Z. ; investigation, S.P., P.C., R.N., J.S. and K.Z. ; resources, S.P., P.C., R.N., E.N.-S., J.S. and K.Z. ; data curation, S.P., P.C., R.N., J.S. and K.Z. ; writing--original draft preparation, S.P., P.C., M.L., R.N., E.N.-S. and K.Z. ; writing--review and editing, S.P., P.C., M.L., R.N., E.N.-S. and K.Z. ; visualization, S.P., P.C., R.N. and K.Z. ; supervision, S.P., M.L. and E.N.-S.; project administration, S.P., M.L. and E.N.-S.; funding acquisition, E.N.-S. All authors have read and agreed to the published version of the manuscript.