# Anomaly Detection Method for Unknown Protocols in a Power Plant ICS Network with Decision Tree
## 3 Results
### Test Environment Configuration  
The test environment for this study was carefully configured to accurately reproduce the actual environment of a power plant. The specifications for the test environment are shown in Table 5, and the configuration is shown in Figure 9. Past operational data were also implemented in the test environment to ensure accurate testing. \begin{table}
\begin{tabular}{c c} \hline \hline
**Type** & **Requirements** \\ \hline CPU (Central Processing Unit) & 2.2 GHZ (Gigahertz) \\ Core & 10 core \\ Memory & 64 GB (Gigabyte) \\ NIC (Network Interface Card) & 1 Giga NIC \(\times\) 4 port \\ SSD (Solid State Drive) & 512 GB \\ HDD (Hard Disk Drive) & 10 TB \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Hardware configuration of the test environment. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Item Name** & **Proposed Model** & **Darktrace** \\ \hline Data Collection Unit & Bytes, Sessions & Sessions \\ \hline Detection Technique & Network anomaly detection, illegal asset detection & Rule-based anomaly detection \\ \hline Traffic Analysis & Detailed analysis using packet and session data & Session data only \\ \hline Asset Detection & Unregistered, new, changed assets & New assets only \\ \hline Asset Management & Asset registration/modification/change & Automatic registration only \\ \hline Abnormal traffic analysis & \
\begin{tabular}{c} Identification of anomalies using traffic thresholds \\ for each asset and analysis of abnormal traffic using \\ ML techniques for collected traffic \\ \end{tabular} &
\begin{tabular}{c} Specific rule-based detection of collected \\ traffic using ML (unsupervised) method \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Detection model comparison. \begin{table}
\begin{tabular}{c c} \hline \hline
**Classification** & **Version** \\ \hline OS (Operation System) & Ubuntu 16.04 LTS \\ DB & MariaDB 10.3.14 \\ WAS (Web Application Server) & Tomcat 8.0.32 \\ JDK & Java 1.8.211 \\ WEB & Apache 2.4.39 \\ C Compiler & GCC 5.4.0 \\ Development Tool & Spring Framework 4.3 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Software configuration of the test environment. The network configuration of the test environment is shown in Table 7.  
The server communication settings of the test environment are shown in Table 8.  
Figure 10 shows the system configuration for the proposed test environment. It includes a closed structure control network with a functional structure for registering and investigating abnormal symptoms that occur in the actual operating environment. The test was run using 26 terabytes of control network traffic data collected for 4 months, and random traffic was generated in the existing training data to test the anomaly detection model. \begin{table}
\begin{tabular}{c c c c} \hline
**Port** & **Default** & **Description** & **Direction** \\ \hline \multirow{2}{*}{Conse} & \multirow{2}{*}{TCP 8443} & Web UI (User Interface) & \multirow{2}{*}{Inbound} \\  & & access port & \\ \hline \multirow{2}{*}{FTP Client} & \multirow{2}{*}{TCP 22} & SFTP \\  & & (Secure File Transfer Protocol) & \\ \hline \multirow{2}{*}{Conse} & \multirow{2}{*}{TCP 80} & SSL (Secure Socket Layer) & \multirow{2}{*}{Inbound} \\  & & encrypted communication uses & \\  & & port 443 & \\ \hline \multirow{2}{*}{Agent Download} & \multirow{2}{*}{TCP 88} & Agent downloads support port & \\  & & for compatibility with IE & \\  & & (Internet Explorer) 8 & \\ \hline \multirow{2}{*}{Syslog} & UDP 514 & Syslog & Outbound \\ \hline \multirow{2}{*}{SNMP} & \multirow{2}{*}{162} & SNMP & \multirow{2}{*}{Outbound} \\  & & & \\ \end{tabular}
\end{table} 
Table 7: Network configuration of the test environment. \begin{table}
\begin{tabular}{c c} \hline
**Function** & **URL (Uniform Resource Locator)** \\ \hline \multirow{2}{*}{Web console access} & HTTPS (Hyper Text Transfer Protocol over \\  & Secure Socket Layer)://\(<<\)server name or IP \\  & address\(>>\):8443 \\ \hline \end{tabular}
\end{table} 
Table 8: Server communication settings.