An Anomaly Detection Method for Oilfield Industrial Control Systems Fine-Tuned Using the Llama3 Model

Abstract

The device anomaly detection in an industrial control system (ICS) is essential for identifying devices with abnormal operating states or unauthorized access, aiming to protect the ICS from unauthorized access, malware, operational errors, and hardware failures. This paper addresses the issues of numerous manufacturers, complex models, and incomplete information by proposing a fingerprint extraction method based on ICS protocol communication models, applied to an anomaly detection model fine-tuned using the Llama3 model. By considering both hardware and software characteristics of ICS devices, the paper designs a fingerprint vector that can be extracted in both active and passive network communication environments. Experimental data include real ICS network traffic from an oilfield station and extensive ICS device traffic data obtained through network scanning tools. The results demonstrate that the proposed method outperforms existing methods in terms of accuracy and applicability, especially in differentiating devices from various manufacturers and models, significantly enhancing anomaly detection performance. The innovation lies in using large language models for feature extraction and the anomaly detection of device fingerprints, eliminating dependency on specific ICS scenarios and protocols while substantially improving detection accuracy and applicability.