MLEP in KICS for Networks 5.0: how machine learning helps track network behavior of OT devices

What happened?

In an industrial network, malicious activity can be hard to tell apart from normal data exchange between devices. Malicious actors routinely rely on legitimate tools and the Living-off-the-Land technique, so a single network connection may show no known signs of an attack: the device uses a familiar protocol and transmits ordinary data. An anomaly can hide in subtle details: the data source, the time of access, or the volume of transferred data may be atypical for a particular device.

Key details

• MLEP uses machine learning to refine device categories and detect anomalous network behavior in OT environments.
• Network sessions are represented as 15-second aggregated events containing endpoint details, protocol, direction, and packet counts.
• MLEP extends known asset categories to uncategorized devices by matching recurring network behavior patterns.

Summarised by SecOraLens from Securelist (Kaspersky). Always read the original source before acting. How SecOraLens verifies advisories.