OT Security Protocol Attack and Anomaly Detection

OT Security Protocol Attack and Anomaly Detection | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article OT Security Protocol Attack and Anomaly Detection Minal Moharir, Adithya Ranjith, Jnyanadeep Bandaru, Chirag Kumar Jaiswal, and 2 more This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-7222815/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract As the convergence of Information Technology (IT) infrastructures with Industrial Control Systems (ICS)progresses, ensuring the security of Operational Technology (OT) has grown vastly important, with vulnerabilitiesarising from insufficient encryption and authentication in protocols like Modbus/Transmission Control Protocol(TCP). This paper introduces a flexible real-time simulation framework designed for Operational Technology (OT)threat detection, integrating protocol-specific traffic parsing with anomaly detection driven by machine learning.Through the use of algebraic modelling, extraction of statistical features, and examination of temporal behaviourin a multistage detection pipeline, and by employing both supervised and unsupervised models like Random Forestand Autoencoders, the system is able to efficiently detect threats. By using a preprocessing layer custom-tailoredto normalize Modbus/TCP inputs, we are able to improve detection precision and scalability. By using toolslike Docker, Flask and PyShark, the framework allows for flexible traffic replay and surveillance. Using publicICS datasets like the Secure Water Treatment Dataset (SWaT) and the Battle of Attack Detection AlgorithmsDataset (BATADAL), the framework simulates both realistic attack scenarios and normal operations, boostingdetection accuracy by up to 18% compared to rule based methods and the tree-based models demon- strate superiorperformance with 99-100% F1 scores and sub-millisecond inference times, confirming their exceptional suitabilityfor real-time OT anomaly de- tection. A real-time Flask-SocketIO dashboard facilitates live system monitoring andvisualization, demonstrating the system’s robustness in dynamic ICS contexts and underscoring its readiness forOperational Technology (OT) security solution prototyping Operational Technology Security Industrial Control Systems Anomaly Detection Modbus/TCP Machine Learning Real-Time Simulation Cyber-Physical Systems ICS Datasets Network Traffic Analysis Flask-SocketIO Dashboard Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-7222815","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":499535233,"identity":"f7bd98f7-4989-432f-a8ab-f06c5ab4a47f","order_by":0,"name":"Minal Moharir","email":"","orcid":"","institution":"RV College of Engineering","correspondingAuthor":false,"prefix":"","firstName":"Minal","middleName":"","lastName":"Moharir","suffix":""},{"id":499535235,"identity":"c2be0058-e323-4fe8-96ac-70af8f0c1eb8","order_by":1,"name":"Adithya Ranjith","email":"","orcid":"","institution":"RV College of Engineering","correspondingAuthor":false,"prefix":"","firstName":"Adithya","middleName":"","lastName":"Ranjith","suffix":""},{"id":499535236,"identity":"98d1f970-daa7-499c-8c23-51c898c9cf25","order_by":2,"name":"Jnyanadeep Bandaru","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAABK0lEQVRIie2PMUvDQBTH33ESlytdL0j8DFcOUoqln6VByFQcRejQuFyWxKz1WwRc3LwSaJdrZsXBTk4KGVuo1GttC2JSV8H7wXHc/97v8R6AwfAHYSA3Nwq+3u3T+vZHJ7vwsOJzO/hV2RdsyLxUfk9+0ETTMV3cd5zkOJawEBjdPatGUUDbSSUWsxKlFeS+HatzfhvlXRQLC7t5j9tDPWEqUchKFCaVS2sCe+ljj2EkiOUqy8dkMyEStEKxP8TAe3h5WyuU8EgrS1gdVE5qQvekZK0wyggeYwBZqbQCxc8cMeFDddEd6X0YVTizI6a3y8qVJlWNp3fRd5JwOprNL1eDJELXxfyq49xMwtcyBag82uYEJLL2A+uDy+o19QAXOwVgWVFlMBgM/5pPPaFrOSsGwJ0AAAAASUVORK5CYII=","orcid":"","institution":"RV College of Engineering","correspondingAuthor":true,"prefix":"","firstName":"Jnyanadeep","middleName":"","lastName":"Bandaru","suffix":""},{"id":499535237,"identity":"7a686121-0c2d-4b94-ba62-0416b4268fb8","order_by":3,"name":"Chirag Kumar Jaiswal","email":"","orcid":"","institution":"RV College of Engineering","correspondingAuthor":false,"prefix":"","firstName":"Chirag","middleName":"Kumar","lastName":"Jaiswal","suffix":""},{"id":499535238,"identity":"3939a520-2419-4f7b-8ff1-db93e149bc98","order_by":4,"name":"Bipin Raj C","email":"","orcid":"","institution":"RV College of Engineering","correspondingAuthor":false,"prefix":"","firstName":"Bipin","middleName":"Raj","lastName":"C","suffix":""},{"id":499535239,"identity":"0896eeb1-406e-44ea-9ae3-a36b50b81536","order_by":5,"name":"Ayush Ratan","email":"","orcid":"","institution":"RV College of Engineering","correspondingAuthor":false,"prefix":"","firstName":"Ayush","middleName":"","lastName":"Ratan","suffix":""}],"badges":[],"createdAt":"2025-07-26 18:38:10","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-7222815/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-7222815/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":95604447,"identity":"cb5fbb83-c06d-4af1-a6f2-2c24d4c10c12","added_by":"auto","created_at":"2025-11-11 06:39:14","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":3462938,"visible":true,"origin":"","legend":"","description":"","filename":"OTSecurityProtocolAttackandAnomalyDetection.pdf","url":"https://assets-eu.researchsquare.com/files/rs-7222815/v1_covered_ac9c2451-ac0a-41da-b910-e1b766cca200.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"OT Security Protocol Attack and Anomaly Detection","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":true,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"Operational Technology Security, Industrial Control Systems, Anomaly Detection, Modbus/TCP, Machine Learning, Real-Time Simulation, Cyber-Physical Systems, ICS Datasets, Network Traffic Analysis, Flask-SocketIO Dashboard","lastPublishedDoi":"10.21203/rs.3.rs-7222815/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-7222815/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"As the convergence of Information Technology (IT) infrastructures with Industrial Control Systems (ICS)progresses, ensuring the security of Operational Technology (OT) has grown vastly important, with vulnerabilitiesarising from insufficient encryption and authentication in protocols like Modbus/Transmission Control Protocol(TCP). This paper introduces a flexible real-time simulation framework designed for Operational Technology (OT)threat detection, integrating protocol-specific traffic parsing with anomaly detection driven by machine learning.Through the use of algebraic modelling, extraction of statistical features, and examination of temporal behaviourin a multistage detection pipeline, and by employing both supervised and unsupervised models like Random Forestand Autoencoders, the system is able to efficiently detect threats. By using a preprocessing layer custom-tailoredto normalize Modbus/TCP inputs, we are able to improve detection precision and scalability. By using toolslike Docker, Flask and PyShark, the framework allows for flexible traffic replay and surveillance. Using publicICS datasets like the Secure Water Treatment Dataset (SWaT) and the Battle of Attack Detection AlgorithmsDataset (BATADAL), the framework simulates both realistic attack scenarios and normal operations, boostingdetection accuracy by up to 18% compared to rule based methods and the tree-based models demon- strate superiorperformance with 99-100% F1 scores and sub-millisecond inference times, confirming their exceptional suitabilityfor real-time OT anomaly de- tection. A real-time Flask-SocketIO dashboard facilitates live system monitoring andvisualization, demonstrating the system’s robustness in dynamic ICS contexts and underscoring its readiness forOperational Technology (OT) security solution prototyping","manuscriptTitle":"OT Security Protocol Attack and Anomaly Detection","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-08-13 07:32:20","doi":"10.21203/rs.3.rs-7222815/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"cdcd2a5b-f64f-4387-88f4-189f62a7e5ae","owner":[],"postedDate":"August 13th, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[],"tags":[],"updatedAt":"2025-11-11T06:38:40+00:00","versionOfRecord":[],"versionCreatedAt":"2025-08-13 07:32:20","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-7222815","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-7222815","identity":"rs-7222815","version":["v1"]},"buildId":"8U1c8b4HqxoKbykW_rLl7","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}