The use of behavioral profiles and DPI-based command detection to protect against unauthorized changes in NCU parameters in food production

Abstract

The article examines the provision of cyber resilience of low-voltage switchgear devices (LVSD) in the food industry under conditions of increasing network connectivity driven by the concepts of Industry 4.0 and the convergence of operational and information technologies, in which LVSD cease to be an isolated physical interface and become a vulnerable point of impact on recipe and process parameters of technological lines (pasteurization, sterilization, control of pump groups and thermal units). The limitations of traditional signature-based and threshold-based monitoring tools are analyzed; such tools fail to recognize the misuse of legitimate industrial protocol commands and generate excessive false alarms during transient modes (CIP cleaning, reconfiguration, commissioning), which undermines operator trust in protection systems. An approach is proposed and verified that combines deep packet inspection (DPI) with machine-learning-based behavioral profiling, enabling the extraction of command semantics at the level of Modbus TCP registers and Profinet IO objects and the correlation of network actions with the context of the production cycle. An experimental implementation on a hybrid testbed with Siemens S7-1500 and Schneider Electric Modicon M340 PLCs and high-performance traffic capture is described; a long-term dataset of network exchanges was formed, including normal and non-standard modes, and 15 classes of attacks were synthetically reproduced, including command injections, MITM, and replay scenarios. Quantitative detection characteristics are presented: high effectiveness for direct setpoint writes and command injections with millisecond-level reaction times, while replay attacks pose the greatest challenge, requiring accumulation of historical context and demonstrating a higher miss rate and increased detection latency. The impact of the DPI gateway on latency and jitter is analyzed: with active blocking, delays increase nonlinearly with load but remain within typical Modbus TCP tolerances; at the same time, increased delay variability under peak traffic is noted as a risk factor for real-time control loops. The heterogeneity of false blocking across operating modes is considered separately: minimal values are characteristic of steady-state production, whereas modes with high command entropy (CIP, reconfiguration, commissioning) require context-dependent profile switching.