During my recent internship, I focused on one big challenge in cybersecurity: capturing and enriching ICS network traffic for anomaly detection. The result? A scalable pipeline that transforms raw industrial traffic into labeled, structured, and ML-ready datasets.

⚙️ Why It Matters

Industrial Control Systems (ICS) are at the core of critical infrastructure—factories, water plants, power grids. But they're becoming increasingly vulnerable to cyberattacks.

Security researchers need good data to build robust anomaly detection systems. The problem? Most datasets are outdated, incomplete, or lack protocol semantics.

So, I built a system to:

Capture both normal and attack traffic
Parse and enrich it with context
Store it in a searchable and visual format

🧪 How the Pipeline Works

1. Traffic Capture

Using a Stormshield Sni40 firewall in an ICS testbed, I built a Bash script that:

Captures full PCAPs from multiple interfaces
Excludes SSH/noise traffic
Saves them in a timestamped format per scenario

➡️ Each scenario (e.g., Modbus DoS or normal OPC UA operation) produces clean, isolated PCAP files.

2. Protocol & Flow Analysis

Once PCAPs are captured, they’re analyzed using:

Zeek – generates protocol-specific logs for:
- Modbus/TCP
- Siemens S7comm
- OPC UA
- OPC DA (DCOM/RPC)
- Schneider’s UMAS
nProbe – extracts flow-based features like bytes transferred, duration, and packet count.

This gives us a dual view:

Packet-level detail (Zeek)
Flow-level overview (nProbe)

3. Enrichment & Labeling

Then comes the smart part:

Filebeat watches Zeek/nProbe logs and tags them based on scenario (normal vs. attack)
Logstash processes:
- Timestamp parsing
- NTLM authentication details
- OPC DA enrichment: Converts UUIDs and opnums to readable interface/operation names using lookup tables

4. Storage & Visualization

Enriched logs are pushed into Elasticsearch with index names like:
ics-zeek-conn-attack-20250710

Built interactive Kibana dashboards:
- Filter by protocol, attack type, or flow anomalies
- Visualize spikes, errors, or unexpected writes

🧠 Why This Pipeline Is Useful

✅ Repeatable and structured traffic capture
✅ Combines packet + flow data
✅ Semantically enriched logs (especially for DCOM-based OPC DA)
✅ Immediate visual insights
✅ Ready for anomaly detection models

🚀 What’s Next?

Expand OPC DA enrichment with more UUIDs
Add support for PROFINET Layer-2 (via UDP encapsulation)
Script advanced OPC DA relay attacks for richer attack datasets

If you're into ICS security, ML-based detection, or love working with Zeek/Elasticsearch stacks — let’s connect! This is just the start of many data-driven defenses in critical infrastructure. 🛠️🔐