Enhancing Intrusion Detection in Industrial Control Systems: An Adaptive Protocol-Agnostic Approach

This paper enhances an existing anomaly-based Intrusion Detection System (IDS) for Operational Technology (OT) networks. In particular, techniques are proposed to improve detection performance in diverse network environments with-out domain-specific knowledge. Traditional anomaly-based IDS implementations in critical infrastructure settings often require specialized knowledge to achieve accuracy, limiting scalability and adaptability. This study enhances a protocol-agnostic approach by incorporating field masks and conditional filtering to reduce false positives and improve overall detection efficacy. Leveraging byte histograms to identify anomalous byte values in network traffic, we integrate field masks and conditional filtering as key mechanisms for optimizing anomaly detection by focusing on relevant packet fields and conditional rule application. The IDS is evaluated in an unsupervised environment, demonstrating its robustness across varying network conditions. The burden on security analysis is minimized through a multi-stage evaluation that generates a detailed and explainable output with each test on incoming traffic. Experimental results reveal the proposed technique effectively maintains high detection rates with reduced false positives, underscoring the practical value of these enhancements in OT network security.