An Operational Hybrid SIEM Framework for OT Anomaly Detection

Area of Science:

• Cybersecurity
• Industrial Control Systems
• Machine Learning

Background:

• Industrial Internet of Things (IIoT) security monitoring requires integrating data from both Information Technology (IT) and Operational Technology (OT) networks.
• Existing public datasets often lack comprehensive IT/OT telemetry, hindering effective security analysis.

Purpose of the Study:

• To propose and validate a design pattern for hybrid Security Information and Event Management (SIEM) systems tailored for OT environments.
• To demonstrate a platform-independent architecture combining rule-based detection and edge-deployed machine learning for anomaly detection.

Main Methods:

• Developed a hybrid SIEM pattern integrating rule-based detection (Kibana Query Language) with edge machine learning (CNN-BiLSTM autoencoder) on a Modbus/Jetson/Elastic instance.
• Mapped 27 rules to MITRE Adversarial Tactics, Techniques, and Common Knowledge for comprehensive threat coverage.
• Validated the machine learning model on a Jetson Orin Nano, achieving high true positive rates on a held-out attack dataset.

Main Results:

• The hybrid SIEM pattern demonstrated effective security monitoring across IT and OT layers.
• The edge machine learning component achieved a true positive rate of 1.000 at the 98th-percentile and 0.997 at the 99.5th-percentile.
• Runtime behavior analysis characterized system performance under various conditions, including adversarial bursts and latency.

Conclusions:

• The proposed hybrid SIEM design pattern is effective and platform-independent for securing OT environments.
• Integrating rule-based and machine learning anomaly detection provides robust security monitoring for IIoT.
• A calibration step enables effective fusion of evidence from different detection methods.