## 5 Cyberattack Scenarios and the Obtained Results
### Probe Performance Tests on Linux  
In addition to the domain tests performed to check the detectors' sensitivity, performance tests were performed. A dedicated client-server connection was set up over the MODBUS protocol to perform a performance analysis of the detectors running on the probe Linux environment. The MODBUS client was run on the PLC side, while the MODBUSserver was run on the Linux server side. Traffic was routed to the configured SPAN port from which the probe detector received data. The client cyclically executed function 16 (writing multiple registers), and tests were performed for the different query frequencies (defined by sleep time) and the number of registers written.  
Figure 4 shows the change in the transfer amount between client and server depending on the number of registers. As expected, the traffic to the server increases as the number of registers written increases. We note that the increase is linear and proportional to the number of registers. Traffic from the server does not change, as the server only confirms the execution of the registers written.  
Similarly, the CPU load changes linearly as the number of registers increases, as shown in Figure 5.  
Figure 6 shows the change in transfer size between the client and server depending on the writing frequency. The frequency is determined by the sleep time. Reducing the sleep time doubles the traffic twice, resulting in an exponential relationship.  
Figure 4: Traffic as a function of the number of registers; the sleep time is 0.1 s.  
Figure 5: CPU usage as a function of the number of registers; the sleep time is 0.1 s.  
Similarly, the CPU load changes exponentially as the sleep time decreases, as shown in Figure 7.  
The goal of the tests is to determine the limiting query frequency and the number of registers checked. In short, the limit values, at 95% of CPU consumption, are obtained with 100 registers written at a frequency of 70 Hz. The collected data show that the probe detector has limitations; however, for the monitored traffic (from the selected zone), they do not cause any problems. The amount of monitored traffic from the selected mine zone does not exceed the limits.  
During the tests, RAM consumption was additionally monitored. It was noted that increasing the amount of network traffic had no significant effect on the probe's RAM consumption. RAM consumption depended on the number of communication channels in the observed traffic. In the monitored run, the number of channels was constant.  
The collected results allow us to assess the dependence of resources as a function of the number of registers and scanning frequency. The analysis conducted in this area provides valuable insight into the scalability and robustness of the proposed security solutions. It is worth emphasizing that the evaluation of resource consumption during intensive use  
Figure 6: Traffic as a function of sleep time; the number of registers is 100.  
Figure 7: CPU usage as a function of the sleep time; the number of registers is 100.  
can reveal bottlenecks and inform necessary optimizations, which are key to developing a resilient and efficient network defense system.