## 5 Discussion and Conclusions  
Industrial control device anomaly detection is the primary technical means for identifying abnormal operational states or unauthorized access to devices, effectively detecting various network attacks targeting industrial control devices, such as DDoS attacks, unauthorized device access, and man-in-the-middle attacks. Existing methods typically use limited or scenario-specific DFs combined with machine learning or deep learning algorithms to detect anomalous devices. These methods often exhibit significant accuracy fluctuations across different industrial control scenarios, leading to poor generalizability. To address these issues, this chapter proposes DFs that comprehensively consider the software and hardware characteristics of devices and can be obtained in both active and passive network communication environments, as well as an anomaly detection model based on the fine-tuned Llama3 model. This approach effectively enhances the performance and applicability of industrial control device anomaly detection. Experimental results demonstrate that under appropriate conditions, the anomaly detection model based on the fine-tuned Llama 3 achieves a stable accuracy of over 98% in recognizing anomalies in industrial control equipment. Finally, based on the network data of an oilfield station's ICS, this chapter constructs a representative experimental dataset for industrial control device anomaly detection. This dataset is used to comprehensively evaluate the proposed method. The Experimental section of this chapter not only assesses the effectiveness of the proposed DFs and the fine-tuned Llama3 model-based anomaly detection model, but also compares their performance with advanced existing methods in the field of industrial control device anomaly detection, demonstrating the superior performance of the proposed method. Meanwhile, with the continued development of industries such as power, water utilities, wastewater treatment, chemical, pharmaceutical, food, and discrete manufacturing (e.g., automotive and aerospace), the ICS in these sectors are increasingly required to connect to enterprise networks, leading to direct exposure to public networks and a heightened  
Figure 18: F1-Score comparison between our method and SOTA methods. risk of cyberattacks. These systems were not originally designed with information and network security in mind, and their hardware and software lack the necessary resources to accommodate upgrades essential for ensuring cybersecurity. As shown in Figure 19, this method can be applied to nearly all ICSs. Due to its characteristic of capturing information via side-channel techniques to generate DFs, it imposes no additional load on the system. Furthermore, by selecting appropriate hardware configurations and traffic capture intervals, the anomaly detection speed can be significantly improved, reaching sub-second levels. The anomaly detection model, based on the fine-tuned Llama 3, also demonstrates a considerably higher capability in detecting equipment anomalies compared to the most advanced existing methods in the field of ICS anomaly detection. It is anticipated that this method will greatly contribute to the advancement of anomaly detection in ICSs. In future research, our method can be improved in the following ways:  
1. Application and promotion of this method on data from other industries. All data in this experiment are sourced from an oilfield ICS. However, the author believes that DFs of ICSs are universal. We will endeavor to obtain traffic information from industries including, but not limited to, electric power, water supply, sewage treatment, chemical engineering, pharmaceuticals, food, and discrete manufacturing to test the universality of this method. 2. Large language models have significant potential in the domains of feature extraction and anomaly detection.