ICS/SCADA Drift Detection
Real-time integrity monitoring for industrial control systems with deterministic resource bounds. Designed for environments where predictable timing and bounded memory are critical.
Target System.
Industrial Control Systems (ICS), SCADA networks, Distributed Control Systems (DCS), and Operational Technology (OT) environments including power grids, water treatment facilities, manufacturing plants, and transportation systems.
Threat Model.
- Firmware modification during maintenance windows
- Configuration drift from baseline state
- Unauthorized PLC logic changes
- Replay attacks on control commands
- Supply chain compromise of control software
Integration Points.
Telemetry Ingestion
Push-based sensor data with signed requests
Drift Detection
RANGE/THRESHOLD rules with configurable tolerances
Sealed Decisions
Signed ALERT / ISOLATE / SAFE_STATE decisions the control system acts on
O(1) Processing
Bounded queues, deterministic resource usage
Resource Bounds.
O(1) Per-Event Processing
Constant-time operations regardless of history depth
Bounded Memory Queues
Configurable limits with backpressure (HTTP 429)
Outcomes.
Sample bundle
SCADA telemetry drift-detection variant