## 4 Experiments and Results
### Experimental Results
#### 4.3.3 Performance Analysis of Different Anomaly Detection Methods  
Finally, this section compares the proposed method with the advanced anomaly detection methods NeuPot and DBHC in the field of industrial control device anomaly detection. The analysis is conducted from the perspectives of different types of anomalous data and various evaluation metrics. The experimental results are shown in the following figures. Figure 16: Accuracy and validation loss of equipment anomaly detection under different training epochs. \begin{table}
\begin{tabular}{c c c c} \hline \hline \multirow{2}{*}{**Number of Samples**} & \multirow{2}{*}{\begin{tabular}{c} **Number of Training** \\ **Epochs** \\ \end{tabular} } & \multirow{2}{*}{\
\begin{tabular}{c} **Fine-Tuned Model** \\ **Accuracy** \\ \end{tabular} } & \multicolumn{2}{c}{
\begin{tabular}{c} **The Number of** \\ **Training Epochs** \\ \end{tabular} } \\  & & **Epochs** & **Accuracy** & **Derived from the** \\  & & & **Function** \\ \hline \multirow{4}{*}{1200} & 68 & 84.1\% & \multirow{4}{*}{78} \\  & 73 & 87.1\% & \\  & 78 & 98.7\% & \\  & 83 & 99.9\% & \\  & 88 & 99.8\% & \\ \hline \multirow{4}{*}{2000} & 73 & 87.9\% & \multirow{4}{*}{84} \\  & 78 & 94.8\% & \\  & 83 & 96.5\% & \\  & 88 & 99.8\% & \\  & 93 & 99.8\% & \\ \hline \multirow{4}{*}{2800} & 78 & 91.1\% & \multirow{4}{*}{88} \\  & 83 & 95.1\% & \\  & 88 & 97.7\% & \\  & 93 & 99.7\% & \\  & 98 & 99.7\% & \\ \hline \multirow{4}{*}{3600} & 83 & 99.3\% & \multirow{4}{*}{92} \\  & 88 & 99.4\% & \\  & 98 & 99.4\% & \\  & 103 & 99.5\% & \\ \hline \multirow{4}{*}{4400} & 88 & 99.0\% & \multirow{4}{*}{95} \\  & 93 & 99.9\% & \\  & 98 & 99.8\% & \\  & 103 & 99.9\% & \\  & 108 & 99.9\% & \\ \hline \multirow{4}{*}{5200} & 93 & 94.3\% & \multirow{4}{*}{98} \\  & 98 & 95.8\% & \\  & 103 & 97.4\% & \\  & 108 & 98.2\% & \\  & 113 & 98.7\% & \\ \hline \multirow{4}{*}{6039} & 98 & 93.8\% & \multirow{4}{*}{100} \\  & 103 & 98.0\% & \\ \cline{1-1}  & 108 & 99.0\% & \\ \cline{1-1}  & 113 & 99.2\% & \\ \cline{1-1}  & 118 & 99.8\% & \\ \hline \hline \end{tabular}
\end{table} 
Table 5: List of wired/wireless devices at oilfield stations. As shown in Figures 17 and 18, the proposed method performs comparably to the NeuPot method on the Others dataset and outperforms the other compared methods on the other datasets and the overall data. The experimental results indicate that all three methods perform better on the Others dataset than on the other datasets. This is primarily because the industrial control devices in the Others dataset have the most significant hardware and software differences compared to the PLCs in the oilfield station, making them easier to identify. Conversely, all three methods achieve the lowest F1-Score on the Honeypot dataset. This is mainly because honeypots typically simulate the communication methods of industrial control devices, resulting in smaller software differences and thus reduced performance. Overall, the proposed industrial control device anomaly detection model based on the fine-tuned Llama3 model can better learn the deep correlations between DF features, forming more accurate feature representations for identifying anomalous devices, thereby effectively improving the performance of the classification model in detecting anomalies. Compared with existing anomaly detection models, the industrial control equipment anomaly detection model based on fine-tuning the Llama3 model has the advantage of leveraging the contextual understanding and reasoning capabilities of the original Llama3 model to identify the underlying causes of abnormal patterns, thereby providing more precise diagnostic information. It dynamically adjusts anomaly detection thresholds based on historical data and current environmental changes, making the system more intelligent. When an anomaly is detected, the model can automatically generate detailed natural language reports based on the detection results, enabling technical personnel to quickly grasp the situation. An illustrative example of the proposed method is presented as follows.