Operation technology networks, i.e. hard- and software used for monitoring and controlling physical/industrial processes, have been considered immune to cyber attacks for a long time. A recent increase of attacks in these networks proves this assumption wrong. Several technical constraints lead to approaches to detect attacks on industrial processes using available sensor data. This setting differs fundamentally from anomaly detection in IT-network traffic and requires new visualization approaches adapted to the common periodical behavior in OT-network data. We present a tailored visualization system that utilizes inherent features of measurements from industrial processes to full capacity to provide insight into the data and support triage analysis by laymen and experts. The novel combination of spiral plots with results from anomaly detection was implemented in an interactive system. The capabilities of our system are demonstrated using sensor and actuator data from a real-world water treatment process with introduced attacks. Exemplary analysis strategies are presented. Finally, we evaluate effectiveness and usability of our system and perform an expert evaluation.

中文翻译：

---

过程安全：工业过程数据中可视化支持的分类分析


操作技术网络，即用于监视和控制物理/工业过程的硬件和软件，长期以来一直被认为不受网络攻击。最近这些网络中攻击的增加证明了这种假设是错误的。一些技术限制导致了使用可用传感器数据检测对工业过程的攻击的方法。此设置与 IT 网络流量中的异常检测有根本不同，需要适应 OT 网络数据中常见周期性行为的新可视化方法。我们提出了一个量身定制的可视化系统，该系统充分利用工业过程测量的固有特征，提供对数据的洞察并支持外行和专家的分类分析。螺旋图与异常检测结果的新颖组合在交互式系统中实现。我们的系统的功能通过来自真实水处理过程的传感器和执行器数据以及引入的攻击进行了演示。提出了示例性的分析策略。最后，我们评估系统的有效性和可用性，并进行专家评估。