What is anomaly detection?
Anomaly detection is a detection method that first establishes what normal behaviour looks like for a network, system or process and then flags any significant deviation from that baseline as potentially suspicious, rather than only searching for known attack patterns. It works particularly well in OT environments because industrial networks are predictable: the same PLCs talk to the same HMIs and SCADA servers for years, using fixed protocols at fixed intervals. A new device, an unknown command or an unexpected zero-day attack therefore stands out far more clearly than it would on an office network.
🧠 How does anomaly detection work?
Anomaly detection follows four steps:
- Baselining - the system learns what is normal:
- Real-time comparison - live data is continuously compared against the baseline.
- Flagging deviations - for example an unknown device, a new or unusual command, increased traffic or activity at unexpected times.
- Assessment and follow-up - alerts go to an analyst, a SIEM or SOAR playbooks for triage and incident response by the security team.
Modern OT monitoring platforms track the learning phase per device or network segment and then switch to a protection mode in which deviations raise alerts.
📊 Which methods does anomaly detection use?
| Method | How it works | Strong at | Limitation |
|---|---|---|---|
| Rule-based baseline (allowlist) | Learns which devices, connections and commands occur; anything else is a deviation | Predictable OT networks, explainable alerts | Every legitimate change triggers an alert |
| Statistical | Thresholds such as 3-sigma, moving averages or EWMA, comparable to SPC control charts | Traffic volumes, polling intervals, measured values | Misses complex or slow-moving deviations |
| Machine Learning | Models such as isolation forest, clustering or autoencoders learn normal behaviour from many features | Subtle combinations of deviations | Harder to explain, needs clean training data |
| Deep learning on time series | For example LSTM networks that predict the next measured value | Dynamic processes with many sensors | Compute-intensive, sensitive to process changes |
| Physics model / Digital Twin | Compares measurements with what the physics of the process allows | Manipulated or replayed sensor values | Expensive to build and maintain |
In practice, OT security platforms combine these methods. The simple allowlist approach often delivers most of the value in OT, because legitimate behaviour is so limited.
🌐 What is the difference between network and process anomaly detection?
Network anomaly detection looks at traffic. Sensors listen in via a SPAN port or a TAP without sending any packets themselves. Using deep packet inspection, they decode industrial protocols such as Modbus TCP, S7comm and OPC UA down to function codes and registers. This is the core of NDR and passive OT monitoring, familiar from tools such as Claroty, Nozomi, Tenable OT and Dragos.
Process anomaly detection looks at the physical values themselves: pressure, temperature, speed or flow from the historian or directly from network traffic. This lets you spot an attack that looks legitimate at network level, such as a valid write command carrying a dangerous setpoint. A physics model or digital twin helps here: Stuxnet replayed recorded normal readings to operators, but those values did not match the actual physics of the process.
The same techniques are also used outside security, for condition monitoring and predictive maintenance.
🔄 How does anomaly detection differ from signature-based detection?
| Aspect | Anomaly detection | Signature-based detection |
|---|---|---|
| Basis | Deviation from learned normal behaviour | Known patterns and indicators (IOCs) |
| Unknown threats and zero-days | Yes, if the behaviour deviates | No, only what has already been described |
| Preparation | Learning phase, typically a few weeks | Up-to-date signatures and threat intelligence |
| False positives | Higher at first and after changes | Lower, but with narrower coverage |
| Context in an alert | ”This is new” - cause still unknown | ”This is attack X” - immediately interpretable |
| Use in OT | Well suited thanks to stable network behaviour | Limited without OT-specific signatures |
A classic IDS relies mainly on signatures. Modern OT platforms combine both approaches with behavioural analytics based on known attack techniques. That matters against attackers who live off the land, such as Volt Typhoon: they use valid accounts and built-in tools, so there is no malicious code to write a signature for.
🏭 Which deviations does anomaly detection catch in OT?
- New connections to a PLC, especially outside working hours or from an unknown workstation
- Program or configuration changes, such as a PLC logic download or a change of operating mode
- Unusual protocol traffic, for example OPC UA outside the default port 4840 or Modbus write commands from a new address
- Activity on an Engineering Station outside the normal shift
- Reconnaissance, such as a host suddenly scanning many devices
- Changed polling frequency between SCADA and field devices
- Misconfigurations such as duplicate IP addresses or a misconfigured switch port
- Process deviations such as setpoints outside their usual range
A recent example is FrostyGoop: in January 2024, attackers sent commands via Modbus TCP on port 502 to heating controllers in Lviv, leaving around 600 apartment buildings without heating for almost two days. Write commands from an unknown source are exactly the kind of behaviour a baseline makes visible.
🧭 How do you set up anomaly detection in an OT environment?
- Choose the monitoring points - place sensors at the key transitions in the Purdue Model, such as between levels 1–2 and level 3, and at the industrial firewall towards the DMZ.
- Connect passively - use a SPAN port or TAP and avoid active scans of fragile controllers.
- Learn the baseline over a representative period - allow two to four weeks, and longer for batch processes or monthly and seasonal cycles. Make sure known faults or maintenance work are not learned as “normal”.
- Enrich your asset inventory - passively discovered devices often form the first complete inventory.
- Tune the alerts - explicitly accept legitimate behaviour and link planned work to change management, so a scheduled PLC download does not become an incident.
- Connect to the SOC - forward alerts to a SIEM or an OT SOC, with clear agreements on who calls the process owner when an alert fires.
- Map to MITRE ATT&CK for ICS - the framework has twelve tactics, including the OT-specific Inhibit Response Function and Impair Process Control, and techniques such as Program Download (T0843) and Modify Parameter (T0836).
- Review periodically - use threat hunting to check what detection misses, and relearn the baseline after major modifications.
🔐 What role does anomaly detection play in compliance and defence in depth?
Anomaly detection is a detection layer within defence in depth. A firewall and segmentation restrict what is possible, but they cannot see what happens inside a permitted connection. Anomaly detection fills that gap, alongside EDR on workstations and servers where that is technically feasible.
For compliance, it is a concrete way to meet existing cybersecurity requirements:
- IEC 62443 - part 3-3 requires in SR 6.2 Continuous monitoring the capability to detect, characterise and report security breaches in a timely manner, from Security Level 2 upwards. Passive sensors meet this without placing any load on the control system.
- NIST SP 800-82 - revision 3 from September 2023 describes behavioural anomaly detection and recommends passive monitoring.
- NIS2 - Article 21 requires incident handling measures. In the Netherlands, this is implemented in the Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026. Without detection, you also cannot meet the incident reporting deadlines.
In OT, “normal” varies widely from one installation to another. Local calibration and process knowledge therefore matter more than the algorithm.
❓ Frequently asked questions
How long does the anomaly detection learning phase take?
The anomaly detection learning phase in an OT network usually takes two to four weeks. Batch processes, maintenance cycles or seasonal effects require a longer period, otherwise detection will later raise false alarms on legitimate but rare behaviour.
Is anomaly detection safe for OT networks?
Anomaly detection is safe for OT networks when sensors listen passively via a SPAN port or TAP. They then send no traffic to controllers at all. Some platforms also offer active querying, which you should only use on devices known to tolerate it.
How do you reduce false positives in anomaly detection?
You reduce false positives in anomaly detection with a representative learning period, explicit acceptance of legitimate behaviour and a link to change management. Also combine behavioural detection with threat intelligence, so alerts carry context and an analyst can judge faster whether something is really wrong.
Can anomaly detection stop an attack?
Anomaly detection does not stop an attack by itself; it flags it. In OT, automatic blocking is deliberately rare because an unjustified block can halt production. Follow-up runs through the SOC, incident response and, where needed, a controlled intervention by the process owner.
Is anomaly detection the same as an IDS?
Anomaly detection is a detection method, whereas an IDS is a system that can use signatures, anomaly detection or both. Classic IDS solutions rely mainly on signatures, while OT-specific monitoring platforms put the emphasis on baselining network and process behaviour.
What is the difference between anomaly detection and NDR?
NDR (Network Detection and Response) is a product category that analyses network traffic and responds to it. Anomaly detection is one of the main techniques within NDR, alongside signatures and behavioural rules based on known attack techniques.
📌 In summary
Anomaly detection establishes what is normal in an OT network or process and flags every significant deviation, exposing unknown attacks, misuse of valid accounts and misconfigurations that signatures miss. With passive sensors, a careful learning phase, tuning, SOC integration and mapping to MITRE ATT&CK for ICS, anomaly detection forms an essential detection layer that also helps you meet IEC 62443, NIS2 and the Dutch Cybersecurity Act.