Method and system for monitoring traffic in an industrial computer network

A network monitoring system comprising:

• a data interface for receiving network traffic packets from at least one network probe;
• a data pre-processor for pre-processing network traffic packets to generate pre-processed network traffic data in a form of a time series containing statistics for the network traffic packets, each network traffic data item of the time series being representative of network traffic packets from a selected time window;
• a configurator comprising a plurality of machine learning models configured to predict network traffic data for upcoming traffic based on the pre-processed network traffic data of traffic received so far, wherein each machine learning model is dedicated to a distinct statistical value for a distinct parameter, and a controller configured to:
• train the machine learning models with the pre-processed network traffic data;
• derive an evaluation score for each machine learning model;
• and
• based on the evaluation score, select at least one machine learning model of the trained machine learning models for monitoring of upcoming network traffic;
• and
• an anomalies detector configured to:
• monitor the upcoming network traffic to detect anomalous events by comparing the actual network state with a network state simulation generated using the selected at least one machine learning model;
• and
• generate a warning if the actual network state does not match the generated network state simulation, wherein the network state is represented by a statistical value for a parameter specific to the selected model.