OT/ICS Security with DKTrace — Purdue Model Monitoring Without Disruption
How DKTrace monitors Modbus, DNP3, and IEC 61850 industrial protocols without sending a single packet to a PLC — with hardcoded safety rules that prevent automated isolation of life-critical assets.
DKTrace Research Team
Security Engineering · Threat Research
OT Security Is Different
A misconfigured firewall rule in IT means a service outage. A misconfigured isolation command in OT can mean a gas explosion, power blackout, or a failed surgical system mid-procedure. DKTrace treats OT security with extreme caution.
Critical Safety Rule (Hardcoded — Cannot Be Overridden)
Any asset tagged with:
life_critical = truesafety_system = trueot_device_type IN (PLC, RTU, SIS, ESD, SCADA_HMI)Will NEVER be subject to automated isolation, shutdown, or configuration change.
The maximum action any AUTO-tier playbook can perform on these assets is alert. MANAGER tier can add enhanced monitoring. Any actual action requires:
This rule is hardcoded in the response-orchestrator and cannot be disabled via configuration.
Passive Monitoring — Zero Impact
DKTrace's ot-monitor (port 8112) uses:
Purdue Zone Enforcement
| Purdue Level | Zone | DKTrace Monitoring | Automated Actions |
|---|---|---|---|
| 0–1 | Field / Control | Alert on ANY unexpected cross-zone traffic | Alert only |
| 2 | Supervisory (SCADA) | Alert on IT→OT connections | Alert only |
| 3 | Site Operations | Full monitoring | MANAGER approval required |
| 3.5 | DMZ | Standard monitoring | Full SOAR capabilities |
| 4–5 | IT Network | Standard IT monitoring | Full SOAR capabilities |
OT-Specific Anomaly Detection
Modbus Function Code Abuse
DNP3 Anomalies
IEC 61850 GOOSE Message Anomalies
Rogue Engineering Workstation
See It Live
Watch DKTrace detect this threat in your environment
Our engineers will run a live detection simulation against a sample of your log telemetry — no agents, no commitment.
Request a Live Demo