## 3 Methods  
This chapter addresses the shortcomings of existing anomaly detection methods for industrial control devices, such as the generality of ICS device fingerprints and the accuracy of anomaly detection models. We propose an anomaly detection method for industrial control devices based on the fine-tuned Llama3 model. As shown in Figure 4, this method consists of three main components: industrial control network traffic preprocessing, ICS device fingerprint extraction, and the anomaly detection model. The main innovation of this method lies in the introduction of ICS device fingerprints that comprehensively consider the software and hardware characteristics of the devices and can be obtained in both active and passive network communication environments. Additionally, the method features a powerful anomaly detection model based on the fine-tuned Llama3 model. This approach not only eliminates dependence on specific industrial control scenarios and protocols but also significantly improves the accuracy of detecting anomalous industrial control devices. Fingerprint Extraction Method for Industrial Control Devices Based on the Industrial Control Protocol Communication Mode  
As shown in Figure 5, industrial control devices typically communicate with each other using an industrial control protocol to facilitate the upload of process data and the issuance of control commands. This chapter focuses on industrial control protocols that are based on the TCP/IP protocol and utilize a Client/Server communication model. Protocols such as Modbus/TCP, EtherNet/IP, and S7 comm are widely used in various industries, including oil, chemical, and water resources, and thus have broad representativeness. This chapter aims to propose a fingerprint extraction method that can comprehensively reflect the software and hardware characteristics of industrial control devices and can be obtained in both active and passive network communication environments, thereby improving the distinguishability among different industrial control devices. Based on the summary of the industrial control device communication process in Figure 5, this chapter proposes the corresponding industrial control protocol communication model ICS_CM to formally describe the aforementioned communication process. Specifically, it is represented as follows:  
\[ICS\_CM=(C_{E},C_{D},C_{T}) \tag{1}\]  
In this model, \(C_{E}\) represents the message sequence of the connection establishment phase, expressed as  
\[C_{E}=\left\langle P_{syn}^{src},P_{syn\_ack}^{dst},P_{ack}^{src}\right\rangle \tag{2}\]  
Figure 4: Architecture of anomaly detection of ICS devices. In this context, \(P_{syn}^{src}\) represents the SYN packet in the connection establishment phase, \(P_{syn,ack}^{dst}\) represents the SYN_ACK packet in the connection establishment phase, and \(P_{ack}^{src}\) represents the ACK packet in the connection establishment phase. The superscripts \(src\) and \(dst\), respectively, indicate that the sender of the packet is the host requesting to establish the TCP connection, i.e., the Client, and the host agreeing to establish the TCP connection, i.e., the Server. The subscripts indicate the packet type. \(C_{D}\) represents the message sequence of the data transmission phase, which consists of one or more data transmissions, expressed as  
\[C_{D}=\left\langle C_{d_{1}},C_{d_{2}},\cdots,C_{d_{n}}\right\rangle \tag{3}\]  
where \(C_{d_{i}}\) represents the \(i\)-th data transmission, with \(i=1,\cdots,n\) and \(n\) denotes the total number of data transmissions. \(C_{d_{i}}\) is expressed as  
\[C_{d_{i}}=\left\langle P_{i\_req}^{src},P_{i\_ack}^{dst},P_{i\_res}^{dst}\right\rangle \tag{4}\]  
where \(P_{i\_req}^{src}\) represents the request packet of the \(i\)-th data transmission, \(P_{i\_ack}^{dst}\) represents the TCP protocol ACK response packet of the \(i\)-th data transmission, and \(P_{i\_res}^{dst}\) represents the industrial control protocol data response packet of the \(i\)-th data transmission.