← Back
Home › Systems › Security and identity

ot-security

ICS/OT asset discovery and threat detection: industrial protocol DPI, PLC fingerprinting, safe active queries, zoning, vendor remote access

Claroty, Nozomi, Dragos

SystemTechniques · 23Primitives · 81 ot-security Deterministic simulation testingdistributed · medium: Run the whole system in one thread under a seeded scheduler with simulated network, disk and clock, so every failure replays from its seed.›Primary-backup replicationdistributed · medium: One node orders all writes and ships them to standbys; the acknowledgement rule (none, one, all) sets what a crash loses, and an external arbiter decides who takes over.›Industrial network segmentationembedded · medium: Zones and conduits (IEC 62443/Purdue) with firewalls and protocol allow-lists for OTProtocol dissector frameworknetworking · medium: Registry of decoders chained by port and heuristics that emits a field tree per packet, with conversation trackingAttack path graphsecurity · medium: Graph of assets, vulnerabilities and trust links searched for reachable paths from entry points to critical targetsCoverage-guided fuzzingsecurity · medium: Mutate inputs, run an instrumented target, and keep any input that reaches a new code edge; feedback turns blind guessing into incremental search.›Device fingerprintingsecurity · medium: Collect stable and volatile device signals, hash the stable core for exact lookup, fuzzy-match the rest with drift tolerance, and feed the result into a risk score.›Software bill of materialssecurity · low: SBOM generation (SPDX/CycloneDX) and component matchingExponential smoothing (ETS, Holt-Wi…statistics · low: Forecast by keeping a few running states (level, trend, seasonal) updated by a fraction of each forecast error; O(1) memory per series and a strong baseline.›Hdr histogramdata-structures · low: Log-linear bucketed histograms with bounded relative error for latency percentilesDnp3 protocolembedded · low: DNP3 outstation/master protocol: event buffers, unsolicited reporting, time-stamped dataModbus protocolembedded · low: Modbus RTU/TCP registers and function codes with polling and CRCOpc uaembedded · low: OPC UA industrial protocol: address space, subscriptions and monitored items, security modesProcess supervisionhardware-os · low: A parent process starts services, reaps their exits and restarts them under a delay and burst-limit policy, then stops them with SIGTERM before SIGKILL.›Network discoverynetworking · low: LLDP, SNMP and ARP/ND scans to discover devices and topologyPacket capture pcapnetworking · low: Lossless packet capture with hardware timestamps, pcap/pcapng format, replayTcp stream reassemblynetworking · low: Rebuild TCP byte streams from out-of-order, overlapping and retransmitted segments with a per-flow buffer and an overlap policyMutual TLSsecurity · low: TLS where the client also proves a certificate key, so every connection carries a verified, rotatable machine identity.›Network service fingerprintingsecurity · low: Identifying services and versions on open ports by banners and probe responsesGraceful drainingsystems · low: On a termination signal, stop taking new work, finish in-flight work until a deadline, tell clients to reconnect elsewhere, then exit; clients resume from a token.›Token bucketsystems · low: A bucket of up to b tokens refilled at rate r; requests spend tokens, enforcing an average rate while allowing bursts of b.›Cooperative schedulingconcurrency · low: Green threads/coroutines yielding at await points on a user-space schedulerRecord replaydistributed · low: Record every nondeterministic input (time, randomness, I/O, model and tool outputs, per-tick player input) and re-execute deterministically for debugging, replays and state rebuild+ 16 more techniques+ 65 more primitives

Similar systems

Share the most building blocks with this one.

vuln-scanner 29 %building-automation 29 %industrial-iot-platform 26 %reverse-etl 26 %alerting 26 %