## 3 Methods
\(C_{T}\) represents the message sequence of the connection termination phase, which consists of one or more message subsequences, expressed as  
\[C_{T}=\left\langle C_{t_{1}}^{src},C_{t_{2}}^{dst},\cdots\right\rangle \tag{5}\]  
where \(C_{t_{i}}^{src}\) represents the sequence of packets initiated by the Client to terminate the TCP connection, and \(C_{t_{i+1}}^{dst}\) represents the corresponding sequence of packets returned by the Server. \(C_{t_{i}}^{src}\) and \(C_{t_{i+1}}^{dst}\) are expressed as follows:  
\[C_{t_{i}}^{src}=\left\langle P_{t_{i-1}}^{src},P_{t_{i-2}}^{src},\cdots\right\rangle \tag{6}\] \[C_{t_{i+1}}^{dst}=\left\langle P_{t_{i+1}}^{dst},P_{t_{i+1}}^{dst },\cdots\right\rangle\]  
Figure 5: ICS device communication process diagram. The types and quantities of packets contained in \(C_{T}\), \(C_{i_{t}}^{src}\), and \(C_{i_{t+1}}^{dst}\) are determined by the specific implementation of the industrial control device protocol stack. Based on the aforementioned industrial control protocol communication model (ICS_CM), this chapter designs the ICS device fingerprint vector (DF) from the perspective of the differences in the hardware and software implementations of industrial control devices, specifically expressed as  
\[ \begin{split} DF=\{ITTL,IPDF,IDD,IWS,MSS,WSC,\\ SAP,ILRT,TON,TSCON,TCF,RTD\}\end{split}  \tag{7}\]  
The explanations of the relevant features of the ICSDFs are shown in Table 1. Examples of industrial control equipment fingerprints are shown in the Table 2.  
The aforementioned features of the DF can be broadly classified into two categories based on the characteristics they reflect: hardware features and software features. The soft \begin{table}
\begin{tabular}{c l} \hline \hline
**Fingerprint Feature Identifier** & **Fingerprint Feature Description** \\ \hline \(ITTL\) & indicates the initial value of the TTL field in the IP protocol header of packet \(P_{syn\_ack}^{dst}\) \\ \hline \(IPDF\) & indicates the value of the DF flag in the IP protocol header of packet \(P_{syn\_ack}^{dst}\) \\ \hline \(IDD\) & indicates the increment value of the ID field in the IP protocol header between packet \(P_{syn}^{src}\) and packet \(P_{ack}^{src}\) \\ \hline \(IWS\) & indicates the value of the window size field in the TCP protocol header of packet \(P_{syn\_ack}^{dst}\) \\ \hline \(MSS\) & indicates the initial value of the TTL field in the IP protocol header of packet \(P_{syn\_ack}^{dst}\) \\ \hline \(WSC\) & indicates the value of the window scale field in the TCP protocol header of packet \(P_{syn\_ack}^{dst}\) \\ \hline \(SAP\) & indicates the value of the SACK permitted field in the TCP protocol header of packet \(P_{syn\_ack}^{dst}\) \\ \hline \(ILRT\) & indicates the time interval between packet \(P_{i\_ack}^{dst}\) and packet \(P_{i\_res}^{dst}\) \\ \hline \(TON\) & indicates whether packet \(P_{syn\_ack}^{dst}\) includes the TCP timestamp option \\ \hline \(TSCON\) & indicates whether the TScer field value in the TCP timestamp option of packet \(P_{syn\_ack}^{dst}\) matches the TSval field value in the TCP timestamp option of packet \(P_{syn}^{src}\) \\ \hline \(TCF\) & indicates the update frequency of the TSval field value in the TCP timestamp option on the Server side \\ \hline \(RTD\) & indicates the difference between the time interval of packet \(P_{syn}^{src}\) and packet \(P_{syn\_ack}^{dst}\) and the time interval of packet \(P_{i\_res}^{src}\) and packet \(P_{i\_res}^{dst}\) \\ \hline \hline \end{tabular}
\end{table} 
Table 1: List of fingerprint features of ICS devices.