Anomaly Detection
Anomaly detection is a security technique that learns the normal behaviour of a network or system and raises alerts when activity deviates from it. In OT, where communication patterns are highly repetitive and predictable, it can reveal attacks and misconfigurations that have no known signature.
How it works
A monitoring system observes traffic for a period and builds a baseline: which devices exist, which pairs communicate, over which protocols, with what commands and at what frequency. In a signaling or onboard network this baseline is remarkably stable, because the same controllers exchange the same message types on the same cycle every day.
Once the baseline is established, the system compares live traffic against it. A new device, a controller that starts talking to a peer it never contacted before, a command that has never been seen, or a change in message timing all generate alerts. Rail-aware systems go further by understanding the meaning of protocol messages, so they can flag not only new flows but operationally implausible ones, such as a route request that contradicts the current track state.
Why it matters for security
Rail OT has almost no attack signatures to match against: incidents are rare, and adversaries targeting a specific interlocking or CBTC system will use tailored methods. Anomaly detection is one of the few approaches that can catch such activity, and it does so passively, without touching certified equipment.
The same approach detects non-malicious problems that matter for availability, such as failing devices, misconfigured maintenance laptops or a contractor plugging into the wrong network. The challenge is tuning: a baseline that is too strict produces noise, and one that is too loose misses subtle changes, which is why domain knowledge of rail protocols and operations is essential.
Related solution
Building a rail security operations center
Rail-specific detection that understands what normal signaling and onboard traffic looks like.
See the solution →
