Deep Packet Inspection (DPI)

DPI engines parse the complete structure of industrial protocols like Modbus TCP, DNP3, and IEC 61850 beyond simple header inspection. This enables the extraction of function codes, register addresses, and data payloads.

• Validates that a Modbus write command targets an authorized coil range
• Detects malformed packets designed to crash legacy PLCs
• Maps protocol fields against the MITRE ATT&CK for ICS framework

Function code inspection enforces a strict allowlist of permissible operational commands. A DPI sensor can block a Modbus Function Code 05 (Write Single Coil) if the target device should only accept read operations.

• Prevents unauthorized firmware uploads via Function Code 08 (Diagnostics)
• Blocks DNP3 STOP or RESTART commands from unapproved masters
• Logs every rejected command for forensic analysis

DPI provides the rich application-layer metadata required for behavioral analysis. By establishing a behavioral baseline of normal SCADA polling intervals and command sequences, the system flags deviations without relying on known threat signatures.

• Detects zero-day threats exploiting unknown protocol vulnerabilities
• Identifies a sudden burst of write commands during a normally read-only maintenance window
• Feeds sequence data into LSTM sequence models for predictive threat detection

DPI sensors in OT environments operate in passive monitoring mode, receiving traffic via a Network TAP or SPAN port. This ensures zero added latency and no risk of inline failure disrupting deterministic control loops.

• Physically cannot inject packets into the live network
• Compatible with unidirectional gateway architectures
• Integrates with Zeek for metadata extraction without active interrogation

Advanced DPI correlates network commands with the physical state of the industrial process. A command that is syntactically valid may still be blocked if it violates the current operational context.

• Prevents opening a circuit breaker while a downstream isolator is closed
• Validates command sequences against a digital twin simulation of the process
• Implements stateful whitelisting that tracks the logical state of each controlled asset

Modern DPI solutions integrate with OPC UA security models to inspect encrypted industrial communications. By terminating TLS sessions in a secure inspection zone, payloads can be analyzed before re-encryption.

• Inspects OPC UA binary-encoded messages after decryption
• Maintains certificate-based mutual authentication integrity
• Operates within an Industrial Demilitarized Zone (IDMZ) for policy enforcement

Passive monitoring is the non-intrusive deployment mode required for DPI in OT environments. By analyzing a copy of network traffic via a Network TAP or SPAN port, DPI sensors inspect payloads without adding latency or jitter to deterministic control loops. This ensures that deep inspection of Modbus TCP or DNP3 packets never risks dropping a critical trip signal or protective relay command.

Function code inspection is the DPI-driven validation of the specific operational command embedded within an industrial protocol packet. While basic firewalls filter on IP and port, DPI extracts the Modbus function code—such as write single coil (05) or write multiple registers (16)—and validates it against an authorized baseline. This prevents an attacker from issuing a legitimate but dangerous command like an unscheduled firmware update.

Stateful whitelisting extends DPI beyond single-packet analysis to validate the logical sequence of commands against the current process state. A DPI engine with stateful awareness knows that a 'start pump' command is invalid if the upstream valve has not received a confirmed 'open' status. This context-aware filtering blocks Living Off the Land (LOTL) attacks that exploit valid protocol functions in an illegal sequence.

Process-aware detection correlates DPI findings with the physical state of the industrial process. A DPI alert for a DNP3 write command to a circuit breaker is cross-referenced with SCADA telemetry. If the breaker's electrical load is non-zero, the command is blocked as a dangerous cyber-physical attack. This fusion of packet inspection and physics prevents false positives from benign network reconfiguration.

An IDMZ is the segmented network architecture where DPI sensors are strategically placed to inspect all traffic crossing between the enterprise IT network and the OT Purdue Model levels. DPI within the IDMZ enforces strict protocol break inspection, ensuring that no OPC UA or IEC 61850 traffic traverses the boundary without deep validation of its payload, structure, and authorization.

A unidirectional gateway, or data diode, provides a hardware-enforced complement to DPI. While DPI inspects bidirectional traffic, a data diode physically severs the return path, making remote command injection impossible. In a defense-in-depth strategy, DPI monitors the outbound telemetry stream for data exfiltration attempts, while the diode guarantees that no malicious packet can ever reach the protected OT asset.