Device discovery and identification in industrial networks

Abstract

Abstract The Act on Federal Office for Information Security (BSI Act) explicitly mandates the use of attack detection systems. The BSI works together with operators of process plants as well as discrete manufacturing facilities in order to test sensors, which may be part of such systems, in their networks. This gives the BSI the opportunity to record a collection of network traffic from those plants. One goal is to improve the detection and characterization of devices in industrial networks by implementing new or enhanced features for the open source network monitoring tool suite Malcolm. In this context, the recording of the network traffic represents the starting point for further investigations. This paper highlights what needs to be considered in these recordings to serve as a basis for device identification and characterization.