## 2 Related Works
### Anomaly Detection Models for Industrial Control Devices  
Advancements in hardware and machine learning algorithms have enabled training complex models like deep learning for anomaly detection. Researchers have applied these algorithms to train ICS device fingerprint models for monitoring device security.  
[PERSON] et al. [12] enhanced ICS network security using ICS device fingerprinting and machine learning algorithms like Support Vector Machines (SVMs), Naive Bayes, and Decision Trees, achieving 99% identification accuracy. This approach combines ICS device fingerprinting with machine learning to improve system defense capabilities.  
[PERSON] et al. [24] used Deep Convolutional Neural Networks (DCNNs) to analyze network traffic, converting inter-arrival times into images processed by models like ResNet-50, improving device identification accuracy and defending against signature attacks. This method leverages machine learning characteristics to enhance network security through pattern recognition in large datasets.  
[PERSON] et al. [25] introduced an unsupervised learning approach using K-Nearest Neighbors and feature clustering to classify IoT device types without labeled data, achieving comparable accuracy to supervised methods. The automated feature selection and threshold creation framework enhances device identification accuracy, demonstrating scalability in dynamic environments.  
[PERSON] et al. [26] proposed the IoTTFID model, an incremental learning system identifying evolving IoT device types by extracting \"traffic fingerprints\" from communication  
Figure 3: Hierarchical architecture of software protocol stack.  
traffic. These are converted into input vectors for neural network training, enabling effective identification. The model adopts an incremental learning strategy, continually expanding recognition capabilities without forgetting previous information, addressing the \"catastrophic forgetting\" problem and improving scalability. The IoTTFID model demonstrated high accuracy and low resource consumption across multiple datasets, proving its practicality in network security and device management.  
[PERSON] et al. [27] proposed a method for classifying unknown attack traffic in SCADA systems using a novel Density-Based Heuristic Clustering (DBHC) technique. This method automatically discovers cluster centers and dynamically creates new clusters, introducing a self-growing attack traffic classification model for real-time detection without relying on pre-trained samples. It improved classification accuracy and optimized data processing through effective traffic characterization and nonlinear features, enhancing adaptability and detection performance for unknown attack types. This study leveraged unsupervised learning advantages in dynamic environments, providing a new machine learning solution for ICS network security.  
[PERSON] et al. [28] developed a deep learning-based honeypot system to enhance interaction with attackers and detect malicious traffic. Contributions include a sequence-to-sequence time series prediction model for simulating long-term physical process changes, a Modbus honeypot framework for fine-grained parameter simulation, and a malicious traffic detection model with an innovative loss function to improve detection effectiveness for known and unknown threats. These methods increased system interactivity and significantly enhanced threat identification capabilities.  
Overall, integrating advanced fingerprint extraction methods and sophisticated anomaly detection models is pivotal for enhancing the security and reliability of ICS. Continuous developments in machine learning offer promising avenues for more accurate and adaptable anomaly detection solutions in dynamic industrial environments.