System and methodology providing automation security analysis and network intrusion protection in an industrial environment

A method for mitigating detected network security issues in an automation environment, comprising:

• monitoring data traffic on an automation network during a training period;
• generating at least one learned profile encoding at least one learned data traffic pattern determined based on the monitoring;
• detecting a deviation of a current data traffic pattern from the learned data traffic pattern in excess of a threshold subsequent to the training period;
• and
• initiating a security countermeasure in response to the detecting.

A non-transitory computer-readable medium having stored thereon computer-executable instructions that, in response to execution, direct a computer system to perform operations, including:

• monitoring data traffic on an industrial network during a training period;
• creating at least one learned data traffic profile characterizing at least one learned pattern of data traffic observed during the training period;
• and
• initiating a security countermeasure on the industrial network in response to detecting a deviation of a present data traffic pattern from the at least one learned pattern of data traffic in excess of a threshold subsequent to the training period.