Anomaly detection in industrial control networks

A system for detection of anomaly in an Industrial Control System (ICS), the system comprising:

• a memory;
• one or more processors;
• a network interface configured to receive network signals from the ICS, the network signals comprising data packets, the memory comprising program code executable by the one or more processors to:
• process the received network signals by an Information Technology (IT) domain anomaly detection module to identify one or more anomalies in network traffic observed from the data packets;
• process the received network signals by an Operational Technology (OT) domain anomaly detection module to identify one or more anomalies in individual ones of said data packets;
• transmit data of the identified one or more anomalies in the IT domain or OT domain to an intrusion monitoring terminal.