No neural networks. No labeled data. No warm-up.
Both detection algorithms are tree-based ensemble methods, chosen specifically because they need no GPU, no offline training phase, and no labeled attack data, hard requirements for OT edge deployment.
SILDA learns what "normal" looks like for each individual machine on your network, and flags anything that doesn't match, without needing a security team to feed it examples of attacks first. Every decision it makes is written down in a way that can't be quietly edited later, so when something gets blocked, you have proof of exactly what happened and why. The technical detail below is for the engineers who'll verify that; skip to Federated Learning or the Trust & Compliance page if that's not you.
river.HalfSpaceTrees
An ensemble of random trees partitions an 11-dimensional feature space into half-spaces. Points in dense regions, normal traffic, need more splits to isolate, so they score low. Points in sparse regions isolate fast, so they score high.
- •Updates on every single event, no batch processing, no retraining
- •O(1) memory, regardless of traffic volume
- •Adapts automatically as device behaviour drifts over time
sklearn.IsolationForest
Activates only when river is unavailable. 50 random isolation trees, contamination=0.1, shorter average path length means a higher anomaly score.
- •Same 11-dimensional feature vector, same 0.65 default threshold
- •Batch model, needs full retraining to incorporate new events
Per-asset warm-up. Scores suppressed while the baseline forms.
Behavioural baseline establishment for that specific device.
Production-reliable scores. Known attack patterns score above 0.85 after 100 normal events.
Eleven features, read straight off the wire.
| Feature | Source | What it captures |
|---|---|---|
| duration_ms | Proxy log | Transaction round-trip time |
| request_size / url_len | Proxy log | Payload size and URL entropy, a scanning/fuzzing indicator |
| status_code | Proxy log | HTTP response code |
| modbus_write / modbus_illegal | Request body | Modbus write coil/register or diagnostic function code |
| s7_detected / s7_dangerous | Request body | Siemens S7comm magic byte; CPU STOP or block download |
| dnp3_detected / dnp3_command | Request body | DNP3 start bytes; Direct Operate command |
| opcua_anomaly | Request body | OPC-UA error message or port mismatch |
Every detection carries a technique ID, not just a score.
| Detection rule | Technique | Tactic |
|---|---|---|
| Honeypot path hit | T0862 | Initial Access |
| Modbus write coil / register | T0855 | Impair Process Control |
| S7comm CPU STOP command | T0858 | Impair Process Control |
| DNP3 Direct Operate command | T0855 | Impair Process Control |
| Behavioural drift >3σ | T0882 | Collection |
| OPC-UA session error | T0859 | Lateral Movement |
Full mapping covers 12 tactics and 20+ techniques, refreshed live in the Detection Authority module.
Sites collaborate. Raw data never leaves the building.
Each SILDA node runs detection independently. Periodically, the FL subsystem extracts aggregate statistics, rolling means, variances, asset counts, applies differential-privacy noise, and shares only those privatised scalars with an FL Hub.
SITE A · FL CLIENT → SITE B · FL HUB
- 1Local anomaly detection runs uninterrupted at each site
- 2Extract model stats → apply Gaussian DP noise (ε = 1.5)
- 3Hub aggregates via FedAvg with Byzantine filtering
- 4Global model staged as Shadow, never applied directly
- 5Operator promotes, or the site rolls back to a prior version
Two independent poisoning defences run before any update joins FedAvg: an L2 norm z-score filter (rejects >4σ deviation) and cosine divergence filtering (rejects >90° divergence from centroid). Sites that keep failing are quarantined, trust score decays 0.15 per rejection.
The global model captures aggregate behavioural statistics, not a full neural network, it guides threshold adaptation rather than replacing each site's local model. Minimum sites for meaningful aggregation is 2+; connection stability varies with network conditions. This is a beta subsystem, and we say so in the product.
Perceive → plan → execute → observe → replan → synthesise → report.
This is a genuine adaptive loop, not a fixed pipeline. The agent adds and removes tools dynamically based on what each one reveals, and it runs entirely on-premises.
Seven investigation tools
- •asset_lookup , known device, firmware, CVE
- •mitre_context , technique, tactic, remediation
- •cve_check , cross-reference against CISA KEV
- •anomaly_history , prior events, this asset, 24h
- •network_neighbours , at-risk devices on the subnet
- •threat_correlate , same technique, other events
- •fl_model_check , cross-site pattern via federation
Sample report
No incident data, IP addresses, or anomaly details are transmitted to any external API or LLM. Investigations are deterministic, same evidence, same verdict, every time.