Skip to content
ComputingAmerica

Energy & Utilities

Detecting a controller that changed, without signatures

Control-network traffic is unusually regular, which makes it unusually easy to baseline. We used similarity-preserving hashes to fingerprint the steady state across a multi-vendor PLC bench and public labelled captures, then measured what it actually caught.

Verified engagement. Every claim on this page traces to a document, a publication or a system somebody can open, and we can arrange a direct reference call for a shortlisted engagement. The work was done by the engineers who founded this firm, in most cases before the firm existed, which is why the dates below predate it. Client names and identifying details are withheld under NDA unless the client has agreed to be named.

Client
A federally funded research program, with a university SCADA testbed
Duration
12 months of research, through peer review
Team
4, with a national-laboratory review cycle
Year
2024–2025

The situation

What we walked into.

The detection tooling available for industrial environments largely inherits an assumption from enterprise security: that you know in advance what the bad thing looks like. In operational technology you frequently do not, because the attack that matters is often a legitimate protocol command issued at an illegitimate time by an unexpected party.

Endpoint agents were not an option. You cannot install software on a programmable logic controller, and the engineering workstation is frequently vendor-managed and out of scope for change.

Any active testing was off the table on the production process, which meant the research had to be conducted on a bench that faithfully represented several controller families rather than on a single convenient one.

There was also an honest scientific risk that the whole approach would not work. Similarity hashing is a technique from malware research, and the assumption that it would transfer usefully to process traffic was an assumption, not a result. It very nearly did not: industrial protocol frames are far smaller than the inputs these hash functions are designed for, and the first three approaches we tried failed outright.

Approach

How it was sequenced.

Each step had to be independently valuable. That constraint is what let the client stop at any point without being stranded.

  1. Step 01

    Build a bench that resembles a plant

    Controllers from four vendors, real ladder logic, and a process simulation that generated the traffic patterns a running line generates. Everything measured afterwards depends on this being representative, so it got a disproportionate share of the effort.

  2. Step 02

    Characterize normal, in detail

    Passive capture over extended periods to establish what steady state actually looks like per device and per protocol, including the variation introduced by ordinary process changes, shift patterns and maintenance activity.

  3. Step 03

    Fingerprint with similarity hashes

    Similarity-preserving hashes over windows of clustered process traffic, so a small change produces a small distance rather than a completely different value. Clustering is what made it work at all: a single frame is too short for these functions to behave, and the cluster is the smallest unit that carries a stable signature. The output is a continuous deviation measure rather than a match or no-match verdict.

  4. Step 04

    Attack it deliberately, then measure

    Denial of service, man in the middle, packet injection and command manipulation, executed against the bench, plus evaluation against public capture sets carrying labelled attack windows. Results were presented for review at two national laboratories and written up for publication, which is a considerably harsher review than an internal report gets.

What was built

The parts that mattered.

  • Multi-vendor bench: Allen-Bradley, Siemens, Beckhoff and Click controllers with real ladder logic
  • Entirely passive detection: no agent on a controller, no scanning of the process network
  • Continuous deviation scoring rather than binary signature matching
  • Sliding window baseline that follows normal operational drift, so a maintenance window does not poison it
  • Attack classes validated by execution on the bench, not by literature review
  • Findings peer-reviewed and presented at national laboratories

Results

Measured, with the method stated.

Every figure below has a defined measurement window and a comparable baseline. Numbers without those are just adjectives.

Controller families on the bench
4 vendorsController families on the benchRather than a result demonstrated on one convenient platform
Installed on control equipment
0 agentsInstalled on control equipmentDetection is passive, off a span port
Network flows analyzed
100k+Network flows analyzedAcross bench capture and public labelled datasets
Method and results
PublishedMethod and resultsPeer-reviewed, with the approaches that failed reported too

Built with

  • Python
  • Wireshark
  • TLSH
  • Modbus/TCP
  • Packet clustering
  • Elastic
  • Ladder logic

Services involved

More work

Related engagements.

Next step

Tell us what’s breaking.

Forty-five minutes, no charge, no deck. We’ll tell you what we’d do, what it would likely cost, and whether you should be building this at all.

Talk to an engineerSee how we work