Normal traffic, and what is not
Every circle is a group of device-to-device conversations that behave alike. Routine polling forms the large groups. The red circles are small, tight groups that turn out to be a single kind of attack. Select one to see what gives it away.
Cluster Hierarchy
Thinned for PreviewFrom raw records to groups you can explain
Read the protocol, not just the packets
DataExplorer reads the packet captures directly and follows every Modbus/TCP conversation between a client and a server, including the function codes, addresses and transaction IDs inside each frame.
83 capture files, about 6 GB, from network-wide and device-level capture points.
One record per conversation per minute
Traffic is summarised into fixed windows so that a slow poll and a flood are measured on the same footing. The same conversation seen from two capture points is counted once.
94,376 conversation-minutes across benign and attack scenarios.
Describe behaviour with comparable features
Volumes are log-scaled. Function-code mix and protocol anomalies are expressed as shares: the share of writes, of exceptions, of unanswered requests, of repeated transaction IDs, of malformed lengths.
23 behavioural features per record; 17 used for clustering.
Let the traffic sort itself
HDBSCAN groups records by behaviour alone. Attack labels from the dataset's logs are never shown to the clustering; they are attached afterwards to check the result.
217 clusters; 109 at the finest level.
Explain every group
Each cluster reports which devices are talking, in which scenario, and which features are furthest from normal, measured in standard deviations.
A brute-force cluster stands out at 98% writes and 98% repeated transaction IDs.
Triage in the browser
Compare a suspect cluster with normal polling side by side, colour the hierarchy by any feature, and drill into the individual minutes.
All of it runs in the browser against the live service.
Attacks found without being told
11 of the 109 finest clusters are dominated by one logged attack type. The table lists the largest cluster for each type and how much of it is that attack. Select a row to open the cluster.
| Attack type | Records | Share of cluster |
|---|---|---|
| Loading… | ||
Behaviour, per conversation, per minute
No signatures and no payload inspection beyond the Modbus header. Each record describes how two devices talked, not what they said.
Volume
Requests, responses, payload bytes, TCP connections opened, connection resets.
Function-code mix
Share of reads, writes and other function codes; number of distinct addresses touched; largest quantity requested.
Timing
Response latency, spacing between requests, and how regular that spacing is.
Protocol anomalies
Malformed length fields, several frames stacked in one segment, repeated transaction IDs, unanswered requests, exception responses.
The demonstration dataset
The CIC Modbus Dataset 2023 from the Canadian Institute for Cybersecurity at the University of New Brunswick. It records a simulated substation network: SCADA HMIs polling intelligent electronic devices over Modbus/TCP, in normal operation and under attack from an external host, a compromised HMI and a compromised device.
Dataset Profile
See it on your network
DataExplorer reads packet captures and logs from your environment. Talk to our team about an evaluation.
Request a Briefing →