detecting-anomalies-in-industrial-control-systems

name	detecting-anomalies-in-industrial-control-systems
description	Use when this skill covers deploying anomaly detection systems for industrial control environments using machine learning models trained on OT network baselines, physics-based process models, and behavioral analysis of industrial protocol communications. It addresses building normal behavior profiles for SCADA polling patterns, detecting deviations in Modbus/DNP3/OPC UA traffic, identifying rogue devices, and correlating network anomalies with physical process data from historians.
domain	cybersecurity
tags	["ot-security","ics","scada","industrial-control","iec62443","anomaly-detection","machine-learning"]
subdomain	ot-ics-security
version	1.0.0
author	oyi77
license	Apache-2.0
atlas_techniques	["AML.T0043","AML.T0018"]
nist_ai_rmf	["MEASURE-2.7","MEASURE-2.5","MAP-5.1"]
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"]

Detecting Anomalies In Industrial Control Systems

Overview

Cybersecurity skill for detecting anomalies in industrial control systems. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "detecting anomalies in industrial control systems"

• "This skill covers deploying anomaly detection systems for industrial control env"

• When deploying continuous monitoring for OT environments that lack intrusion detection

• When building behavior-based detection to complement signature-based IDS in OT networks

• When establishing baselines for deterministic SCADA communications to detect deviations

• When integrating machine learning anomaly detection with OT security monitoring platforms

• When investigating alerts from Nozomi Guardian or Dragos Platform that require deeper analysis

Do not use for signature-based detection of known exploits (see detecting-attacks-on-scada-systems), for IT network anomaly detection without OT protocols, or as a replacement for process safety systems (SIS).

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Passive network monitoring sensors on OT network SPAN/TAP ports
• Minimum 2-4 weeks of baseline traffic capture during normal operations
• Python 3.9+ with scikit-learn, numpy, pandas for ML model training
• Process historian access for physical process correlation data
• Understanding of normal operational patterns including shift changes, batch processes, and maintenance windows

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs() -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}