Aspect Modeling for Process Variable Anomaly Detection

Ryan demonstrates how to achieve a method of "Agentless OT EDR" for IACS process endpoints with cyber-physical "Aspect Models".

By leveraging Machine-to-Machine APIs and protocols, such as OPC-UA, using existing intermediary and process endpoint systems, he shows how extending collection and analysis across cyber-physical process variables supports the creation of "aspect models" for autonomous threat detection, root-cause analysis and incident response.

In contrast to complex digital twin systems, Ryan explains the concept of aspect models as detectors of discrete cyber-physical system behaviour, at the endpoint or process level, based on one or more process variables, which automatically form intuitive chains of process endpoint activity for automated root cause analysis (e.g., cybersecurity threat, system fault, or equipment failure).