Lightweight OT/ICS Protocol Anomaly Detection Engine

A Python-based passive network traffic analysis engine designed for Industrial Control Systems (ICS) and Operational Technology (OT) environments. It parses PCAP captures to identify unauthorized control commands, unwhitelisted IP interactions, and high-risk function codes across Modbus TCP and Siemens S7comm (ISO-on-TCP) protocols.

---

Architecture & Data Flow

+-----------------------+      +----------------------------------+      +-------------------------------+
| Raw OT Network TAP /  | ---> |  Detection Engine                | ---> | Incident Alert & Response     |
| SPAN PCAP Capture     |      |  (Python 3 / Scapy / Struct)     |      | (Purdue L2 Isolation / MITRE) |
+-----------------------+      +----------------------------------+      +-------------------------------+
                                               |
                                               v
                               +----------------------------------+
                               | Rule Policy & Whitelist Database |
                               +----------------------------------+