Inferring ICS Topology and Behavior through Network Traffic Analysis

Ensuring the proper operation of industrial control systems (ICS) is a critical issue.Previous studies have focused on observing the controllers directly; however, this research proposes that analyzing network traffic could reduce system interference.This study utilizes a cybersecurity testing platform for dam systems to investigate network traffic to infer the composition of network nodes and the communication behavior between them.By doing so, it provides an alternative perspective for monitoring ICS operations.This model aids in understanding system topology, tracking potential deviations, and ensuring operational stability.