# Anomaly Detection Method for Unknown Protocols in a Power Plant ICS Network with Decision Tree
## 3 Results
### Test Verification
#### 3.2.2 Analysis of the Feature Verification Results  
To verify the proposed method, the operational data of a power plant was simulated for 4 months in a real environment, and the performance aspect of detecting anomalous traffic was evaluated. The verification process consisted of two stages: stage 1 involved verifying the method with a simulator, and stage 2 involved deriving the values of K and T to test the hypothesis.  
To determine the type of traffic size per packet generated in the control network, the frequency of occurrence according to the type of traffic size generated from SRC_PORT to DST_PORT in the experimental data was measured and shown in Figure 11. The results showed that the traffic size per packet was classified into eight cases, and the communication pattern was defined as the analysis target.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Item** & **1** & **2** & **3** & **4** & **5** \\ \hline Processed & 100,4094 & 1,004,094 & 1,004,093 & 1,004,093 & 1,004,096 \\ Packets & 964,819 & 964,819 & 964,819 & 964,819 & 964,819 \\ \hline Captured syn & 27,761 & 27,761 & 27,761 & 27,761 & 27,761 \\ TCP Packets & 2030 & 2030 & 2030 & 2030 & 2030 \\ \hline Normal & 27,761 & 27,761 & 27,761 & 27,761 & 27,761 \\ Packets & 27,761 & 27,761 & 27,761 & 27,761 & 27,761 \\ \hline Processed SYN & 25,844 & 25,844 & 25,844 & 25,844 & 25,844 \\ ACK TCP Packets & 53,605 & 53,605 & 53,605 & 53,605 & 53,605 \\ \hline Fingerprinted & 35,571 & 35,571 & 35,571 & 35,571 & 35,571 \\ Packets & 636 & 636 & 636 & 636 & 636 \\ Flows & 10.316506 & 11.188549 & 10.172895 & 9.555932 & 12.131023 \\ \hline Packet Process Speed (packets/s) & 97,328.88441 & 89,743.00147 & 98,702.78314 & 105,075.3616 & 82,770.92337 \\ Flow Generating & 61.64878 & 56.84383 & 62.519079 & 66.555518 & 52.427564 \\ Speed (flows/c) & 5196.042252 & 4791.058998 & 8269.395056 & 5609.604647 & 4418.835796 \\ \hline Fingerprinting Speed (packets/s) & 5196.042252 & 4791.058998 & 8269.395056 & 5609.604647 & 4418.835796 \\ \hline \hline \end{tabular}
\end{table}
Table 11: Experiment results for the metadata creation success rate.  
Figure 11: Packet size count of the proposed model.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Item** & **1** & **2** & **3** & **4** & **5** \\ \hline Processed Packets & 1,000,000 & 1,000,000 & 1,000,000 & 1,000,000 & 1,000,000 \\ \hline Processed TCP Packets & 121,248 & 121,248 & 121,248 & 121,248 & 121,248 \\ \hline Captured SYN TCP Packets & 4576 & 4576 & 4576 & 4576 & 4576 \\ \hline Duped Packets & 562 & 562 & 562 & 562 & 562 \\ \hline Lost Packets & 0 & 0 & 0 & 0 & 0 \\ \hline Normal Packets & 4576 & 4576 & 4576 & 4576 & 4576 \\ \hline Processed SYN TCP Packets & 4576 & 4576 & 4576 & 4576 & 4576 \\ \hline Processed SYN \_ & 2693 & 2693 & 2693 & 2693 & 2693 \\ ACK TCP Packets & 7269 & 7269 & 7269 & 7269 & 7269 \\ \hline Fingerprinted Packets & 842,217 & 842,217 & 842,217 & 842,217 & 842,217 \\ \hline Processed UDP Packets & 30,670 & 30,670 & 30,670 & 30,670 & 30,670 \\ \hline Generated Flows & 1.428743 & 1.422007 & 1.403228 & 1.425827 & 1.421129 \\ \hline Fingerprinting (packets/s) & 699,916.043 & 703,231.3445 & 712,642.3966 & 701,347.1469 & 703,665.6886 \\ \hline Flow Generating Speed (flows/s) & 21,466.42504 & 21,568.10534 & 21,856.7423 & 21,510.317 & 21,581.42667 \\ \hline Fingerprinting Speed (packets/s) & 5087.689716 & 5111.788643 & 5180.197571 & 5098.092411 & 5114.945891 \\ \hline \end{tabular}
\end{table}
Table 12: Test results for the metadata storage speed.  
Based on the real data, the thresholds for K and T were derived as 8 and 400, respectively, through the verification process.  
To diagnose anomalies, it is necessary to identify a pattern in the traffic that exceeds a certain communication frequency threshold K. Based on the results of the analysis, it was found that the majority of communications meeting this threshold had a packet size of 8 or less, which supports the alternative hypothesis H1 proposed by DMP (Detection Model P) and rejects the null hypothesis H0.