Methodology

Control Systems Security publishes OT/ICS threat intelligence derived from a fully automated pipeline. All research is passive — we never connect to, scan directly, or interact with industrial systems. All data comes from public sources with all identifying information removed.

1. Threat Intelligence Pipeline

Sources

We monitor 21 curated sources for OT/ICS cybersecurity news and advisories:

CISA ICS Advisories
SecurityWeek, BleepingComputer, The Hacker News, Krebs on Security
Industrial Cyber, Dark Reading, CSO Online, CyberScoop
Unit 42 (Palo Alto Networks), CrowdStrike Blog, SentinelOne Blog, Tenable Blog
Microsoft Security, ZDNet Security, Help Net Security, Theregister Security
SANS ISC, Schneier on Security, Threatpost, Bellingcat

Additional sources are added and removed based on signal-to-noise analysis. Each source is scored for OT relevance before inclusion.

Scraping Pipeline

The pipeline runs every 12 hours (cron: 0 */12 * * *) and executes the following steps:

Step	Script	Output	Gate
1. Scrape	`scraper.py`	intel.db (raw items)	Noise filter (cloud, non-OT)
2. Analyze	`analyze.py`	Advisory .md (surge detection)	Z-score vs 30-day baseline
3. Transform	`transform.py`	Defanged JSON	Staging → approval required
4. Metrics	`metrics.py`	metrics.json	Automated
5. Deploy	`deploy_frontend.sh`	nginx reload + verify	HTTP 200 check
6. Approve	`approve.py`	Staging → live + archive	Human approval gate
7. Notify	`notify.py`	Webhook alerts	On error/info only

Database

2,940+ items across 21 sources (~249 OT-tagged). Updated bi-weekly.

2. Z-Score Anomaly Detection

Surge Detection Logic

Each OT security topic is scored against a 30-day baseline using Z-score (σ) statistics:

Critical (Z ≥ 4.0): Significant deviation from baseline — RECONNAISSANCE_SPIKE
Alert (Z ≥ 2.0): Elevated activity warranting monitoring
Normal (Z < 2.0): Within expected baseline variance

Deduplication (KFC Effect)

After publishing a threat advisory, follow-up media coverage often generates additional articles about the same CVE or advisory. These are not new threats — they are the KFC Effect (Knowledge → Fix → Create cycle). Our surge detector deduplicates by:

CVE/Advisory ID matching — same vulnerability = one event
Source deduplication — same story across multiple outlets counts once
Time decay — repeated coverage of known CVEs is weight-decayed
72-hour advisory cooldown — no duplicate advisories on the same topic

Full analysis: The KFC Effect: How One Advisory Creates Five More

3. Shodan OT Scans

All Shodan data is collected through the Shodan Developer API tier only. We never connect to, probe, or interact with industrial systems directly.

Tier: Developer (Basic) — 10,000 queries/month limit
Method: Pure passive API queries against Shodan's database
No live scanning — we do not port scan, banner grab, or probe any host
Protocols scanned: Modbus (502), DNP3 (20000), Siemens S7 (102), IEC-104 (2404), BACnet (47808), EtherNet/IP (44818), OPC UA (4840)

Cloud Noise Filtering

Approximately 53% of reported ICS exposure is cloud/VM noise (AWS, Azure, Alibaba Cloud). We filter these from OT-relevant counts. Only devices on production-grade ASN blocks are counted as genuine OT exposure.

Full analysis: 447K Write-Capable ICS Devices

Anomaly Scoring

Shodan findings are scored on weirdness (1-10) based on:

Protocol mismatch with expected product/firmware
Geographic anomaly vs known deployment patterns
Organizational mismatch (e.g., non-industrial org on industrial port)
Header/banner inconsistencies

Full methodology and raw anomaly data available on request. Contact: contact@controlsystemssecurity.com

4. Defanged Data Policy

No Target Attribution

We never attribute vulnerabilities to specific facilities, companies, or victims. All published data includes:

Protocol and sector-level information only
Country/city data without organizational attribution
Defanged IP addresses (no host-level identifiers)
Anonymized ASN and ISP data

What We Do NOT Publish

Specific organization names or hostnames
Direct IP addresses (defanged in all outputs)
Facility names or addresses
Vulnerability exploitation paths
Any information that could enable malicious targeting

5. Data Sources & Datasets

Public Endpoints

All non-sensitive outputs are served as public JSON under https://controlsystemssecurity.com/assets/:

Intel Feed — 2,940+ items, 21 sources
Metrics — Protocol/vendor/severity trends
Archive Index — Historical advisories
Pipeline Status — Health + green dot

Raw Datasets

Full raw dataset exports (defanged, anonymized) are available upon request for research collaboration. Contact: contact@controlsystemssecurity.com

6. Quality Assurance

Pipeline Verification

Each run is logged and exit-tested (exit code 0 = clean)
Weekly database backups with integrity verification (PRAGMA integrity_check)
Human approval gate before public staging release
HTTP 200 verification after each deploy

External Review

Our methodology and findings undergo quarterly external review by OT security practitioners. If you have expertise in industrial control systems and would like to review our methodology, please contact us.

7. About This Research

Author

Jeff Gray — Founder, Cyborama LLC

Air Force veteran with 16 years experience in control systems security, critical infrastructure protection, and industrial incident response. Background in designing advanced protective controls for energy and water sectors, and developing next-generation detection capabilities for operational technology.

Full bio and credentials →

Contact

Email: contact@controlsystemssecurity.com
LLC: Cyborama LLC (Alabama, EIN: 41-4427011)

Research Methodology

Overview