Attackers inside a control network can move quietly for months, because PLC protocols accept commands from almost anyone. Listening passively to that traffic reveals unusual behaviour without touching the process or adding any delay at all.
Control networks carry a small, repetitive set of messages, which makes unusual traffic easier to spot than on an office network. Passive monitoring tools learn that normal pattern and raise alerts when something changes.
What Is OT Intrusion Detection?
OT intrusion detection is the passive monitoring of industrial network traffic to find attacks, misuse and abnormal behaviour in SCADA, DCS and PLC networks. It complements the preventive controls described in SCADA network security.
SentryWire notes that Modbus, DNP3 and S7comm lack authentication, so a valid looking command from the wrong host is accepted. It also notes that industrial intrusions have persisted for months before detection.
According to SentryWire, passive capture adds no latency because the sensor sits outside the data path. A failure of the sensor therefore cannot stop the process.
How Passive Monitoring Works
SPAN ports on managed switches are cheap but can drop packets under load, while hardware TAPs copy every frame. Switch features are covered in network switches for SCADA and DCS.
Place sensors at the key boundaries of the Purdue model, especially between levels 2 and 3 and inside critical cells. Monitor the conduits defined in IEC 62443 zones and conduits.
Detection Methods Compared
Matches known attack patterns and malware.
Compares traffic with a learned baseline.
Checks commands against allowed function codes.
NIST studied behavioural anomaly detection tools on a manufacturing test bed in NISTIR 8219. The report shows how such tools detect unusual commands, new hosts and changed traffic patterns.
A baseline period of 30 to 90 days is common guidance, so that shift changes, batches and maintenance activities are all captured. Too short a baseline creates many false alerts.
6 Smart OT Intrusion Detection Steps
Alerts are useful only when someone acts on them, and responders should know common attack patterns described in types of cyber attacks. Train staff using resources from free OT cybersecurity training.
Packet Retention Storage Formula
Total storage = Storage per day × Retention days
Example:
Average mirrored traffic 50 Mbps
Per day = 50 × 1000000 ÷ 8 × 86400 ÷ 10^12 = 0.54 TB
30 days × 0.54 TB = 16.20 TB
Use the average rate, not the link speed, and add headroom for growth. The unit conversions are explained in network speed, bandwidth and throughput.
SPAN and TAP Storage Calculator
Many sites keep full packets for a shorter time and metadata for much longer. Metadata needs only a small fraction of the storage.
Plan retention around how long an investigation might need to look back. If intrusions can stay hidden for months, a few days of full packets plus long term flow records is a sensible balance.
- No latency or risk to the process.
- Finds unknown and insider threats.
- Builds a live asset inventory.
- Packet records support investigations.
- Detects but does not block attacks.
- Baselines need time and tuning.
- Encrypted traffic limits visibility.
- Full capture needs large storage.
Detection works best alongside segmentation, see air gapped vs segmented ICS networks and zero trust for OT networks. Use the SCADA security checklist to find other gaps.
NIST Anomaly Detection PDF
Safe Network Monitoring Video
OT Intrusion Detection FAQ
Related Articles
- SCADA Network Security
- Purdue Model for ICS Cybersecurity
- IEC 62443 Zones and Conduits
- SCADA Security Checklist
- Types of Cyber Attacks
External References
- NISTIR 8219 Securing Manufacturing ICS: Behavioral Anomaly Detection, NIST
- Why Passive Packet Capture Is Critical for ICS and OT Security, SentryWire
- Intrusion Detection System, Wikipedia
What We Learn Today
- OT intrusion detection passively watches control traffic for threats.
- Baselines of 30 to 90 days reduce false alerts.
- Full packet retention storage grows with average traffic and days.