skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-anomalies-in-industrial-control-systems

Detect anomalies in Modbus, DNP3, and OPC UA traffic using ML baselines.

954|172|Updated Mar 13, 2026
Search Tags:#anomaly detection#Modbus#industrial control#SCADA#ICS#isolation forest#OT security
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-anomalies-in-industrial-control-systems
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-anomalies-in-industrial-control-systems
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/ot-ics-security/detecting-anomalies-in-industrial-control-systems
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-anomalies-in-industrial-control-systems

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires scikit-learn, numpy, pandas.

What problem does it solve?

OT and ICS environments often lack intrusion detection, leaving SCADA networks blind to rogue devices, unauthorized function codes, and subtle deviations in deterministic polling patterns that signature-based tools cannot catch.

Core Features & Use Cases

  • Multi-Dimensional Baselining: Builds communication profiles covering timing intervals, function codes, and network topology from 2-4 weeks of captured OT traffic.
  • ML-Based Detection: Trains an Isolation Forest model with scikit-learn to flag statistical deviations, plus rule-based checks for new communication pairs and unauthorized Modbus/DNP3 function codes.
  • Use Case: A security team deploys passive sensors on SPAN ports of a SCADA network, baselines normal polling behavior, then detects a rogue engineering workstation issuing FC16 write commands to a PLC outside the learned register range.

Quick Start

Analyze my captured OT network traffic and build an anomaly detection baseline that alerts on new devices, timing deviations, and unauthorized Modbus function codes.

Frequently Asked Questions about detecting-anomalies-in-industrial-control-systems

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect anomalies in Modbus and DNP3 network traffic?▼

Build baselines of communication pairs, polling intervals, and permitted function codes from 2-4 weeks of captured traffic, then flag deviations using statistical z-scores and an Isolation Forest model. New topology pairs and unauthorized function codes trigger high-severity alerts.

What machine learning model works for ICS anomaly detection?▼

Isolation Forest from scikit-learn works well for OT traffic because it isolates outliers in feature space and handles low anomaly rates, typically configured with a 1% contamination parameter. Features include interval timing, payload size, and function code counts.

Can passive network monitoring see all ICS traffic?▼

No. Serial Modbus RTU, HART, and fieldbus protocols like Profibus under a gateway never reach SPAN or TAP mirror ports, so PLC logic changes and field-level manipulation remain invisible at the network layer.

Why does ML anomaly detection miss malicious Modbus writes?▼

Modbus and DNP3 lack authentication, so an attacker reusing an authorized master IP with a permitted function code produces traffic that scores as normal. Pair timing and topology models with per-register value and setpoint bounds to catch these.

When should I not use behavior-based anomaly detection in OT?▼

Do not use it for signature-based detection of known exploits, for IT-only networks without OT protocols, or as a replacement for safety instrumented systems. It complements rather than replaces signature IDS and process safety controls.

Related Skills

Explore More Software Engineering Skills→
GeneralReasoningGeneralReasoning
4

pcap-analysis

Analyze PCAP files to extract network statistics and detect traffic patterns.

Official
Intermediate
starwreckntxstarwreckntx

Intrusion Detection Agent

Detect intrusions by correlating alerts and analyzing attack patterns in networked environments.

Community
Basic
drupadsachaniadrupadsachania

operational-technology

Automate OT/ICS risk assessment, asset discovery, and security governance.

Community
Advanced
davila7davila7
30.5k

ml-engineer

Implements production ML systems with PyTorch, TensorFlow, model serving, and monitoring.

Community
Intermediate