Industrial protocol behaviour anomalies

1. 01

   Challenge

   Attacks on control systems often use legitimate protocols in unusual ways that no signature describes.

2. 02

   What WireTrace sees

   The fields and values each industrial protocol carries between each pair of devices.

3. 03

   What WireTrace understands

   An approved baseline of the fields and values that are normal.

4. 04

   What WireTrace decides

   A new field or value, such as a previously unseen function code, raises a deviation.

5. 05

   Integration / action

   Deviations reach the Alert Queue and the SIEM, with the baseline they deviate from.

6. 06

   Outcome

   Unusual use of a legitimate protocol is caught without writing a signature for it.

Condition: Deviation alerting requires an approved baseline.