## 1 Introduction  
An ICS consists of automation and process control components designed for real-time data collection and monitoring, facilitating automated operations in industrial infrastructure [1]. These systems--including SCADA, DCS, PLC, and PCS--are widely used across industries such as power generation, water treatment, oil refining, nuclear energy, and manufacturing. In multiple experimental trials, an industrial control equipment anomaly detection model, based on fine-tuned Llama 3, was employed for ICS device fingerprint recognition. The recognition accuracy consistently exceeded 98%.  
Originally deployed in isolated environments prioritizing functionality over security, ICSs have increasingly become connected to enterprise networks for remote control and supervision [2]. This connectivity elevates exposure to cyberattacks, posing significant risks to human safety, environmental security, and economic stability. Ensuring the security and stability of ICSs is thus paramount.  
ICS communication methods encompass both wired and wireless communication [3]. Wireless communication offers flexibility in equipment layout, reduces wiring needs and deployment costs, enables rapid installation, and allows for remote monitoring and management. Wireless Sensor Networks (WSNs) facilitate detailed monitoring and control of production processes, especially in widely distributed or hard-to-reach facilities. Inhazardous environments, wireless solutions mitigate personnel risks and enable real-time data communication for tracking mobile equipment.  
However, wireless communication is vulnerable to attacks due to data visibility to any device within a signal range [4]. Common attacks on ICSs include Distributed Denial of Service (DDoS), unauthorized device access, man-in-the-middle attacks, and malicious code injection [5; 6; 7; 8]. These attacks can lead to data leaks, service interruptions, and compromise system integrity.  
To address these challenges, we propose the following strategies:  
1. We develop an ICS device fingerprint that comprehensively reflects software and hardware characteristics, obtainable in both active and passive network communication environments.  
2. By scanning numerous ICS devices exposed on public networks, we collect communication traffic from different manufacturers and models to establish a database of abnormal ICS device fingerprints.  
3. We capture and extract fingerprints from target industrial control network traffic to form a database of normal ICS device fingerprints.  
4. By applying an anomaly detection model based on the fine-tuned Llama3 model, we maximize the correlation mining between ICS device fingerprint features, improving the model's applicability and accuracy in actual production sites.  
The rest of this paper is organized as follows. In Section 2, we first decompose the anomaly detection of industrial control devices and detail existing problems, including general methods of fingerprint feature extraction and common anomaly detection models. In Section 3, We introduce our method for fingerprint extraction based on the ICS protocol communication model and an anomaly detection model fine-tuned using the Llama3 model. In Section 4, we experimentally validate the proposed methods using real industrial wireless network data collected from an oil production site and analyze the threat characteristics in industrial wireless networks. Section 5 gives the discussions, the conclusions and future research.