ICS/SCADA Drift Detection
Designed to monitor the integrity of industrial control systems. Real-time operation and deterministic resource bounds are design targets, for environments where predictable timing and bounded memory are critical.
A design blueprint, not a shipped product: nothing on this page is implemented in the published packages. Design record dated 2026-01-05 (renamed 2026-07-06). Its O(1), real-time, deterministic-resource and machine-speed statements are design targets, not properties of any shipped component.
Target System
Industrial Control Systems (ICS), SCADA networks, Distributed Control Systems (DCS), and Operational Technology (OT) environments including power grids, water treatment facilities, manufacturing plants, and transportation systems.
Threat Model
- Firmware modification during maintenance windows
- Configuration drift from baseline state
- Unauthorized PLC logic changes
- Replay attacks on control commands
- Supply chain compromise of control software
Integration Points
- Telemetry Ingestion
- Designed to take push-based sensor data over signed requests
- Drift Detection
- Designed for RANGE/THRESHOLD rules with configurable tolerances
- Sealed Decisions
- Designed to sign ALERT / ISOLATE / SAFE_STATE decisions for the control system to act on
- O(1) Processing Target
- Design target, not a property: bounded queues and deterministic resource usage
Resource Bound Targets
O(1) Per-Event Processing Target
Design target, not a property: constant-time operations regardless of history depth
Bounded Memory Queues
Design target, not a property: configurable limits with backpressure (HTTP 429)
Outcomes
- Designed to produce tamper-evident audit trails for regulatory compliance
- Designed for drift detection with bounded per-event processing; real-time operation is a design target
- Deterministic resource usage for real-time environments, as a design target, not a property
- Designed to produce a signed decision for the control system to act on; machine speed is a design target
Sample bundle
The same representative sample bundle offered site-wide: four Ed25519-signed receipts, Merkle proofs, a signed checkpoint, and an offline verifier. There is no SCADA-specific variant.