Anomaly Detection on the OT Network and Process

Continuous monitoring learns the plant's normal network and process behavior so deviations - a new flow, an odd command pattern - are flagged for response.

Detection complements prevention

Prevention (segmentation, identity, attestation) reduces the odds of compromise; detection assumes some attempts get through and aims to notice them fast. OT is an unusually good place for anomaly detection because the plant's behavior is highly regular: the same controllers talk to the same peers with the same cadence, and a discharge follows known sequences. Anything outside that baseline is suspicious in a way it would not be on a chaotic IT network.

Two layers of baseline

• Network baseline: which identities communicate, on which ports, at what rate - deviations from the microsegmentation allow-list or its normal volumes.
• Process baseline: whether commands and telemetry follow physically and procedurally normal patterns for the current plant mode.
• Correlation with attestation and access events so a flow anomaly can be tied to a node that recently failed attestation or an unusual privilege grant.

# Score a flow against the learned baseline; escalate on high anomaly
def monitor(flow, mode):
    s = baseline.score(flow, context=mode)      # 0..1, higher = stranger
    if s > policy.alert_threshold:
        alert(flow, s)
        record(flow, s)                         # into the audit log
    if s > policy.contain_threshold:
        propose_isolation(flow.src_id)          # human-confirmed, fail-safe

Careful about automated response

On a machine holding a live plasma, automated isolation is dangerous: cutting off a control node mid-discharge could itself be unsafe. So containment actions that touch control are proposed to operators and gated, while the independent safety path handles the physical safe state. Detection informs response; it does not blindly yank controllers offline during operation.

Design status: network and process baselining run against twin-generated traffic and simulated discharges. Tuning false-positive rates on real plant behavior is FOAK-era work; no live reactor traffic exists to learn from yet.