A SIEM-Based Framework for Multi-Layer Data Collection and Anomaly Detection in OT-Networks

The increasing convergence of Information Technology and Operational Technology networks in Industrial Control Systems has introduced new cybersecurity challenges, necessitating robust anomaly detection mechanisms. Despite progress, a significant gap exists in the literature regarding benchmark datasets that comprehensively incorporate data from both OT and IT networks. Existing datasets often focus on isolated network segments and fail to capture the full spectrum of network, host, and protocol activities, thereby lacking the holistic visibility required to detect sophisticated, multi-stage cyberattacks. To address this gap, this paper proposes a SIEM-based framework for generating a comprehensive dataset by integrating data from two fundamental levels of an ICS architecture: the OT field network and the IT monitoring system. By leveraging a SIEM solution as the core of the framework, data from heterogeneous industrial devices are captured using NetFlow, Auditd, and Zeek integrations to extract network, host, and protocol features, respectively. The collected data, including sensor telemetry, host logs, and protocol events, are systematically aggregated and correlated to provide a global view of normal and anomalous behaviors. This dataset not only facilitates the development and evaluation of a hybrid anomaly detection framework, combining rule-based SIEM alerts with autoencoder-based machine learning at the edge, but also lays the foundation for more effective, SIEM-driven defenses. Federated learning is discussed as a future prospect to further enhance privacy and scalability.