Behavioral Baseline

An effective baseline must capture cyclical patterns in ICS traffic to avoid flagging routine operational shifts as anomalies. This includes time-of-day patterns (shift changes), day-of-week cycles (weekend maintenance windows), and seasonal variations (winter heating vs. summer cooling loads).

• Fourier analysis decomposes signals into constituent frequencies to identify dominant cycles.
• LSTM sequence models learn long-term dependencies, predicting expected command volumes for a given timestamp.
• Without seasonality, a baseline will generate a flood of false positives during every scheduled batch poll or shift handover.

A single aggregate traffic model is insufficient. The baseline must decompose behavior by industrial protocol and function code to establish distinct normalcy profiles. A Modbus 'Write Single Register' command has a vastly different risk profile and frequency than a DNP3 'Read' request.

• Function Code Inspection: Models the expected distribution of commands (e.g., 70% reads, 25% writes, 5% diagnostics).
• Point Mapping: Tracks which specific data points (coils, registers) are typically accessed by each master device.
• This granularity allows the detection of a malicious firmware upload command disguised within a normally high-volume write channel.

Effective baselines move beyond univariate thresholds (e.g., 'packet rate > X') to model the correlation between multiple features. An anomaly is often not a single metric spiking, but a normal metric occurring in an impossible combination.

• Feature Vectors: Combine packet size, inter-arrival time, connection duration, and TCP flags.
• Autoencoders learn a compressed representation of these correlated features; a high reconstruction error indicates an impossible combination.
• Example: A high packet rate with an unusually small average payload size might indicate a scanning reconnaissance attack, even if both metrics individually fall within historical min-max ranges.

An ICS environment is not static; new devices are commissioned, firmware is updated, and production quotas change. A baseline must adapt to this concept drift without manual recalibration to prevent model staleness.

• Online learning algorithms update the statistical model incrementally with each new data point.
• Sliding window techniques discard obsolete data, ensuring the model reflects the most recent operational reality.
• A robust system distinguishes between gradual drift (legitimate engineering change) and a sudden, malicious shift, often using a CUSUM algorithm for changepoint detection.

The baseline must map the logical topology of allowed peer-to-peer relationships between devices. In a properly segmented OT network, a PLC should only communicate with its designated HMI and engineering workstation, not initiate connections to other PLCs or external servers.

• Connection Graphs: Model the normal set of source-destination IP pairs and their permitted protocols.
• Stateful Whitelisting: Validates that a command not only uses a valid function code but originates from an authorized master for that specific slave device.
• A new lateral connection from a PLC to a file server is a high-fidelity indicator of an attacker pivoting within the OT network, regardless of the packet content.

Beyond metadata, an advanced baseline fingerprints the static payload structures of legitimate commands. Many ICS protocols have highly deterministic data fields for routine operations, making any structural deviation a clear anomaly.

• Entropy Estimation: Measures the randomness of payload data. A command that normally contains structured ASCII text suddenly carrying high-entropy binary data is suspicious.
• Byte Frequency Distribution: Profiles the expected histogram of byte values for specific function codes.
• This technique detects attacks that exploit protocol vulnerabilities by injecting malformed payloads, even if the packet rate and connection patterns appear completely normal.

A Long Short-Term Memory recurrent neural network that learns temporal dependencies in SCADA command sequences. By training on historical traffic, the model predicts the next expected command and its timing. A deviation between the predicted and observed command—such as an unexpected write operation—triggers an alert.

• Sequence window: Number of prior commands used for context
• Prediction error: Residual between predicted and actual command parameters
• Stateful inference: Maintains hidden state across packet boundaries

A non-intrusive data collection method that copies network traffic via a SPAN port or Network TAP for analysis. Passive monitoring is essential for behavioral baseline construction because it observes real traffic patterns without adding latency or risking disruption to deterministic control loops.

• Zero impact: No packets are modified, delayed, or injected
• Out-of-band: Analysis occurs on a separate monitoring appliance
• Full fidelity: Captures inter-packet timing and protocol nuances

The Cumulative Sum control chart is a sequential changepoint detection method that accumulates deviations from a target mean. When the cumulative sum exceeds a threshold, it signals a shift in behavior. CUSUM is widely used in OT environments for detecting subtle, persistent deviations from a behavioral baseline.

• Upper and lower control limits: Define the acceptable deviation band
• Reset mechanism: CUSUM resets to zero when within normal bounds
• Sensitivity parameter: Controls how quickly the statistic accumulates drift

An advanced methodology that correlates network anomalies with the physical state of the industrial process. A command that deviates from the behavioral baseline may be benign if the process state justifies it. Process-aware detection uses digital twin models or PLC register values to validate whether an anomaly constitutes a genuine cyber-physical threat.

• State vector: Current valve positions, tank levels, and breaker statuses
• Contextual whitelisting: Commands validated against process phase
• False positive reduction: Eliminates alerts for maintenance windows