## 4 Experiments and Results
### Description of Experimental Data  
The experimental data used in this section consist of two parts: a real industrial control network traffic dataset from an oilfield station and a large dataset of network traffic scans of industrial control devices exposed on the public internet, obtained through network scanning tools. Due to security considerations, it is not feasible to perform network attacks directly on the real ICS of the oilfield station to obtain anomalous device data. Therefore, the network traffic scans of the numerous industrial control devices exposed on the public internet are used as anomalous device data, while the network traffic data from the oilfield station is used as normal device data. Since the proposed method does not rely on specific features of the industrial control network for anomaly detection, the differences in the network environments between the two datasets do not affect the validity of the experimental results. As shown in Figure 8, the network architecture of the oilfield station includes both OT hardware such as Allen-Bradley PLC and Schneider RIO, and IT software and hardware such as SCADA, HMI, and Historian, supporting both wired and wireless communication methods. IT and OT components coexist on a single network, which follows the ICS Purdue model and uses EtherNet/IP as the main communication protocol. SCADA supervises the production process of the oilfield station through periodic monitoring and can manually control the entire station via pre-written PLC programs. SCADA also works with the Historian, which is primarily used to record and store process data. The oilfield station includes segmented communication networks, both wired and wireless communication, distributed dynamic control, interconnection between PLCs, and full access to control logic within PLCs and HMIs. The station uses wireless access points \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Model** & **CPU** & **Memory** & **GPU** & **Hard Drive** \\ \hline X3650M5 & 2\(\times\)E5-2620v4 (8 C, 85 W, 2.1 GHz) & 4 \(\times\) 16 = 64 GB DDR4 & GPU: NVIDIA GeForce RTX 2080 SUPER. Max memory: 7.787 G & 8 \(\times\) 2.5\({}^{\prime\prime}\) slots, 2 \(\times\) 2 TB \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Hardware configuration. (WAPs) to achieve wireless communication. The distribution of industrial control devices in the station is shown in Table 4.  
The network traffic data from the oilfield station, used as normal device data in this section, cover communication traffic involving six PLCs and various devices such as SCADA and engineering stations. A continuous 30-minute segment of communication traffic (44,956,192 packets) was captured and randomly split into 70% training data, 20% validation data, and 10% test data, with no overlap between these subsets. The specific data distribution is shown in Figure 9.  
Regarding anomalous device data, this section uses network scanning tools to simulate network communication in the station environment for 1012 industrial control devices \begin{table}
\begin{tabular}{c c c} \hline \hline
**End Device** & **Communication Mode** & **IP Address** \\ \hline SCADA & wired wireless & 192.168.1.100 \\ \hline PLC1 & wired wireless & 192.168.1.10 \\ \hline PLC2 & wired wireless & 192.168.1.20 \\ \hline PLC3 & wired wireless & 192.168.1.30 \\ \hline PLC4 & wired wireless & 192.168.1.40 \\ \hline PLC5 & wired wireless & 192.168.1.50 \\ \hline PLC6 & wired wireless & 192.168.1.62 \\ \hline Engineering Station & wired & 192.168.1.201 \\ \hline HMI & wired & 192.168.1.202 \\ \hline Historian & wired & 192.168.1.200 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: List of wired/wireless devices at oilfield stations. Figure 8: Oilfield station network architecture diagram. and honeypots exposed on the public internet over 10 rounds, collecting a total of 131,215 network communication packets. Since DFs are independent of the network environment, the aforementioned data can be used for relevant validation in this section.