## 3 Methodology
### Network Simulation  
Network simulation has become an essential tool in the evaluation and optimization of complex networks, particularly in the context of OT systems. While physical testing can provide a highly realistic and accurate assessment of system behavior under real-world conditions, it often requires a significant investment in physical infrastructure, which may not be feasible for all testing scenarios. By leveraging data and parameters collected from our HIL-driven device profiling stage, our network simulation allows for creating a fully virtualized network that closely mirrors the behavior of an actual OT system without the need for constructing a costly and resource-intensive testbed. When integrated with the data collected through our device profiling stage, the advantage of this approach is that it enables researchers and engineers to simulate a wide range of network configurations and operational conditions using accurate and detailed real-world data. For instance, parameters such as message latency, jitter, packet loss, and device interoperability, which are captured during our device profiling stage, can be incorporated into the simulation to ensure that the virtual model reflects the actual performance characteristics observed in the field. This combination of real-world data and simulation allows for an accurate and dynamic representation of the network's behavior, offering insights into potential issues like network congestion, protocol inefficiencies, or security vulnerabilities that may not be apparent during a limited physical testbed session. Moreover, network simulation offers substantial flexibility and scalability compared to physical testbeds. Once the relevant parameters are extracted from on-device tests,  
Figure 2: Network emulation overview. the simulated network can be rapidly reconfigured to explore different topologies, device configurations, or traffic patterns. This makes it possible to test various scenarios at a fraction of the cost and time required for physical setups. Furthermore, simulations can be executed in parallel across different environments or scaled to handle larger networks, enabling comprehensive testing that might otherwise be impractical. In this way, network simulation enhances the value of a physical testing approach or an HIL-driven emulation approach by extending its reach and providing deeper insights into system performance without the logistical and financial constraints of building large-scale physical testbeds. In network performance analysis, the latency distribution often exhibits a skewed, heavy-tailed behavior. One common statistical model for such data is the log-normal distribution, which is used to model variables that are the product of many independent, identically distributed random variables and was proven effective in previous works [27]. Given the observation that network latency data frequently follow this pattern, we employ curve fitting to a log-normal distribution for device characterization. Given this assumption, we characterize \(X\) as a log-normal distribution, such that \(Y=\ln(X)\), follows a normal Gaussian distribution. This distribution is parameterized by its shape and skew parameters, \(\mu\) and \(\sigma\), where \(\mu\) is the mean and \(\sigma\) is the standard deviation of the underlying normal distribution of \(Y\). Then, the probability density function (PDF) is given by the following:  
\[f_{X}(x;\mu,\sigma)=\frac{1}{x\sigma\sqrt{2\pi}}\exp\left(-\frac {(\ln x-\mu)^{2}}{2\sigma^{2}}\right) \tag{1}\] \[\text{where:}\quad x>0,\,\mu\in\mathbb{R},\,\sigma>0 \tag{2}\]  
To fit a log-normal distribution to latency data, we first collect a set of latency measurements \(\{x_{1},x_{2},\dots,x_{n}\}\), where \(x_{i}\) represents the latency observed for the \(i\)-th measurement.