PROJECT_01 / Industrial cybersecurity
Protocol-aware security monitoring for industrial networks.
STACKZeek · C++ · OPC UA · Wireshark · UAExpert · PLCs
Industrial communication carries context that a generic packet view cannot explain. This work extended Zeek-based monitoring with an OPC UA analyzer, connecting low-level traffic to security-relevant behavior inside SINEC Security Monitor.
My contribution
I researched OPC UA traffic, developed the C++ Zeek plugin, mapped protocol behavior to events, and defined test scenarios for monitoring and detection validation.
Capturing traffic was only the starting point. Useful monitoring needed to identify the service being used, the target of an operation, its response, and the conditions that made it relevant to security. The analyzer also had to interpret communication from real PLCs rather than assume every message matched a simplified example.
I used Wireshark, UAExpert, and generated PLC traffic to study message boundaries, secure-channel setup, service identifiers, request handles, node targets, and response status codes.
Transport framing and service fields establish what a message represents.
Handles and status conditions link an observed action to its result.
Certificate handling, access levels, and write responses shape the monitoring questions.
The C++ plugin parses OPC UA traffic within Zeek, maintains the context needed to associate protocol activity, and emits events that monitoring logic can turn into useful logs.
Technical decisions
A Zeek plugin places protocol understanding inside the existing SINEC workflow rather than creating a separate packet-review tool.
Event-specific output answers monitoring questions about services, targets, access, and response conditions.
The R&D environment combined real PLC communication with an engineering workstation, UAExpert, Wireshark, Zeek, and SINEC Security Monitor. I defined attack procedures and generated test data to compare protocol behavior with the events and logs produced by the plugin.
The resulting plugin interprets OPC UA activity and produces structured telemetry for SINEC Security Monitor. It connects packet-level protocol analysis with higher-level OT security visibility.