← Back to project catalogue
GP-CY-0KJZIZJCybersecurityReady

Passive OT Asset and Protocol Anomaly Laboratory

An offline Python laboratory that builds an observed OT asset inventory and explains protocol changes against a known-normal saved PCAP baseline.

Passive OT Asset and Protocol Anomaly Laboratory project visual
GP-CY-0KJZIZJ · Cybersecurity
  • Python 3.14
  • NumPy
  • Matplotlib
  • Classic PCAP

Project definition

Problem statement

Operational technology networks need visibility without adding traffic that could affect availability or physical processes.

This project studies saved packet captures, records the assets and conversations that are actually observed, and explains clear changes from a known-normal baseline.

Project objectives

  • Read classic Ethernet PCAP files without changing the source capture.
  • Identify Modbus TCP, DNP3, EtherNet/IP, and S7comm traffic by documented service ports.
  • Build an observed asset inventory containing addresses, peers, protocols, and packet counts.
  • Create a known-normal baseline for assets, conversations, protocols, Modbus functions, payload lengths, and packet rate.
  • Detect six isolated deviation categories and retain the packet index and reason for every finding.
  • Reproduce the controlled experiment and its metrics from one command.

Project structure

Project components

01

PCAP reader

Validates and reads classic little-endian PCAP records and supported Ethernet, IPv4, and TCP frames.

02

Protocol parser

Identifies four OT service families and validates the Modbus function field.

03

Asset inventory

Records observed endpoints, peers, protocols, and packet participation.

04

Baseline engine

Stores known assets, paths, protocols, functions, robust length limits, and maximum packet rate.

05

Anomaly engine

Produces packet-indexed findings for six explicit baseline deviations.

06

Experiment suite

Generates the synthetic captures, scores exact packet-category pairs, and retains figures and JSON evidence.

Methodology

Project workflow

  1. 01
    Prepare captures

    Use the included synthetic files or two explicitly authorized saved PCAP files.

  2. 02
    Build baseline

    The normal capture is parsed into observed assets, conversations, protocols, functions, length limits, and rate.

  3. 03
    Analyse evaluation traffic

    Each supported packet is compared with the baseline without transmitting anything.

  4. 04
    Review findings

    The JSON output links every finding to its packet index, category, severity, and explanation.

  5. 05
    Reproduce evidence

    The experiment command rebuilds the corpus, result, metrics, and eight figures.

Demonstration scenario

The included baseline contains three known assets using Modbus TCP. The evaluation adds one isolated case for each of six categories. The analyser recovers all six packet-category pairs with no extra finding on the controlled corpus.

Engineering

Tools and method

Core package
Typed Python modules for PCAP handling, protocol metadata, inventory, baselining, findings, metrics, synthesis, and commands.
Dependency-light parsing
Ethernet, IPv4, TCP, and classic PCAP handling use the Python standard library.
Controlled evidence
A deterministic 240-packet baseline and 137-packet evaluation capture contain six isolated labelled deviations.
Quality controls
40 tests, 99 percent statement coverage, Ruff checks, dependency audit, repository validation, and document accessibility audits.

Testing

Evaluation

Evaluation measures

  • Exact packet-category precision, recall, and F1
  • Finding count for each of the six controlled categories
  • Baseline and evaluation packet counts
  • Observed asset inventory change
  • Automated test count and statement coverage
  • Retained JSON, PCAP, figures, tables, and ground-truth evidence

Project boundaries

  • The package reads saved files only. It does not capture live traffic, scan a network, transmit a packet, or issue a control command.
  • Only synthetic captures or captures the operator is authorized to inspect should be used.
  • Port-based protocol identification does not reproduce every vendor implementation or protocol semantic.
  • The controlled result is not evidence of unrestricted OT threat detection.
  • No information is collected.

Included

  1. 01Complete Python source code
  2. 02Synthetic baseline and evaluation PCAP files with ground truth
  3. 03Passive asset inventory and six packet-indexed anomaly categories
  4. 04Retained JSON result and eight generated figures
  5. 0592-page project documentation in PDF and editable Word formats
  6. 0614-page setup and usage guide in PDF and editable Word formats
  7. 0740 automated tests, 99 percent statement coverage, and 42 annotated references

Project record

No information is collected on this page.

Permanent project ID
GP-CY-0KJZIZJ
Catalogued
21 Aug 2026
Completed
24 Aug 2026
Verified
24 Aug 2026
Demonstration
Included in repository

Handover

After purchase

  1. 01
    Payment is confirmed

    The project is marked unavailable and cannot be purchased again.

  2. 02
    Repository access is granted

    The buyer's submitted GitHub account receives access to the private repository.

  3. 03
    The purchase record is delivered

    The certification sheet is prepared from the reviewed buyer details and sent privately by email.