Plant Reality and Systemic Constraints
The system landscapes under consideration are typical of water management, energy supply, and the process industry. Multiple geographically distributed facilities are managed via a central control system. Pumping stations, treatment stages, and auxiliary facilities operate automatically and are connected via their own networks. Process data is archived, and maintenance access often exists over long periods of time. Different levels of automation and life cycles shape the overall picture.
From an operational perspective, availability is the top priority. Interventions in ongoing processes are to be avoided; changes are planned and occur infrequently. From an IT security perspective, the focus is on access, connections, and logs. Both perspectives are technically sound but fall short when considered in isolation. Network alarms occur without any reference to the process. Process disruptions are treated as purely technical issues. The result is a high analytical workload coupled with limited significance.
This tension is clearly evident in practice. A pumping station starts up outside of normal operating hours at increased capacity. There is no hydraulic demand, and no standard fault alarm is triggered. Technical protective mechanisms prevent damage. Only in hindsight does it become apparent that external access had previously occurred via an old maintenance access point. Each observation on its own can be explained. Viewed as a whole, however, a safety-relevant context emerges that would not be recognizable without linking the information.
Correlation of Process and Security
An effective approach to evaluating such situations does not rely on additional individual alarms, but rather on their contextual analysis. Security is understood as the result of multiple interacting information sources. The control system provides the current operating status. Historical data describes the plant’s normal behavior. Passive network monitoring captures communication patterns and access attempts without affecting operations. Intrusion detection systems identify known technical anomalies. The key lies in integrating this data both temporally and in terms of content.
A consistent time base is a fundamental requirement. Process values, control commands, state changes, network connections, and authentication events must all be aligned on a common timeline. Without this synchronization, causal relationships remain unclear. Only when cause and effect are precisely aligned in time can a reliable assessment be made.
Static thresholds are not sufficient for this purpose. Industrial processes are state-dependent. Operating modes change, load cases vary cyclically, and maintenance states differ significantly from normal operation. Safety-related interventions are increasingly guided by these legitimate processes. An assessment must therefore be made relative to the current state.
This is where algorithmic methods come into play. Normal operation is modeled based on historical process data and analyzed separately by operating state. Special cases are deliberately excluded. Current events are continuously evaluated against this reference. Temporal anomalies become apparent when activities occur outside of usual patterns. Process responses are analyzed by comparing expected responses to control commands with actual behavior. Long-term changes can be identified using moving time windows.
Individual deviations are rarely meaningful on their own. It is only the correlation of several weak signals that creates relevance. An evaluation value is derived from this combination, which allows for a transparent escalation process. No action is taken below defined thresholds. In the transition zone, monitoring takes place. Only when a clear deviation occurs is an alarm triggered, which is always accompanied by process context and remains technically explainable in terms of plant operation.
Decentralized Implementation and Multifunctional Use
For algorithmic evaluations to be effectively utilized in plant operation, they must not be embedded in either the control systems or the HMI itself. A decentralized implementation on an external system within the OT environment—such as on an industrial PC or server with read-only access—has proven effective. Plant operations remain unaffected, responsibilities remain clearly separated, and changes can be implemented independently of the process.
Node-RED is a suitable runtime environment because data flows and evaluation logic can be mapped in a modular fashion. Process values, states, and messages are imported from the control system or the historian via defined interfaces. At the same time, network and security events are fed in from passive monitoring systems or log sources. Evaluation takes place only after the data has been standardized and temporally aligned. Results are forwarded as correlated messages to a central alarm system, a ticketing system, or external evaluation centers.
The algorithms themselves are organized into separate functional blocks. First, the current plant status is determined. Based on this, a comparison is made with reference data from normal operation. Temporal anomalies, implausible process reactions, and long-term changes in behavior are evaluated separately and then consolidated. It is the combination of multiple indicators—not the individual event—that leads to a relevant assessment. The approach is deliberately designed to be multifunctional. As soon as different systems have suitable interfaces, the same architecture can be reused. Different control systems, historians, or network sensors can be connected without changing the underlying logic. Node-RED serves as the integration layer. New data sources are added, while the evaluation logic remains stable.
This results in a flexible building block that can be expanded step by step without altering existing automation. The only prerequisite is reliable access to robust data. If this data is available, the algorithmic evaluation can be performed decentrally and reliably integrated into day-to-day plant operations.
Context and Limitations
In practice, it has been shown that safety-related events can be detected earlier when their impact on the process is taken into account. Unusual access attempts become visible because they are reflected in the plant’s behavior. At the same time, misconfigurations or unclear automation effects become more apparent. The number of unnecessary alarms decreases, while the quality of the evaluation increases.
However, these approaches are not a sure thing. The quality of the results depends directly on the quality of the data. In older plants, process values are often low-resolution or incomplete. Historical data is not always consistent. Initial modeling requires expertise and effort. Models must be maintained and adapted to changing operating conditions.
Technology alone is not enough. Responsibilities between IT and OT must be clearly defined. Incidents must be assessed jointly. Operations personnel must be able to understand the results; otherwise, there will be a lack of acceptance. Correlation does not replace network segmentation or traditional intrusion detection. It complements these by providing an impact perspective focused on operations.
Security in industrial automation arises where process understanding and security assessment are combined. Those familiar with normal operations can recognize deviations. Process data is a relevant security indicator. It is not the pump itself that signals a security issue, but rather its behavior that provides the clue. Correctly interpreting these clues determines whether a technical anomaly becomes a manageable event or results in actual damage.
