DarkVortex OT: A Hybrid Behavioral–Contextual Sensor for Predictive Detection of Advanced Cyberattacks in Industrial OT Networks

Industrial Operational Technology (OT) environments present unique and critical cybersecurity challenges due to their strict availability requirements, deterministic operational patterns, legacy protocols designed without security considerations, and limited tolerance for intrusive security controls. Traditional Intrusion Detection Systems (IDS) deployed in OT networks rely primarily on signature-based or static rule-based approaches, which demonstrate significant limitations: they frequently fail to detect early-stage reconnaissance and lateral movement activities, produce excessive false positives when exposed to atypical but legitimate industrial traffic patterns, and lack the predictive capabilities necessary to prevent sophisticated multi-stage attacks before they reach critical impact phases. This paper presents DarkVortex OT, a novel hybrid behavioral–contextual sensor specifically designed for real-time detection, prediction, and classification of advanced cyberattacks in industrial control system networks. The proposed system integrates five key technological components: (1) passive network traffic capture with zero operational interference, (2) window-based behavioral feature aggregation extracting 47 distinct temporal and statistical characteristics, (3) a four-stage machine learning pipeline combining histogram-based gradient boosting, random forests, and support vector machines for progressive threat refinement, (4) adaptive evidence gating mechanisms that substantially reduce false positive rates compared to traditional approaches, and (5) comprehensive contextual interpretation aligned with the MITRE ATT&CK for ICS framework, providing SOC operators with actionable threat intelligence mapped to specific adversary tactics and techniques. The sensor operates entirely in memory without persistent storage requirements during active operation, requires no active interaction with industrial devices, supports protocol-agnostic analysis across heterogeneous OT environments (Modbus, DNP3, IEC 104, OPC UA, BACnet, and proprietary protocols), and integrates seamlessly with existing Security Operations Center (SOC) workflows through standard interfaces including Syslog, SNMP, REST APIs, and SIEM connectors. Comprehensive experimental evaluation demonstrates consistently strong performance across multiple dimensions. Validation using the X-IIoTID benchmark dataset (1,847,623 labeled samples spanning 18 attack categories and 14 days of continuous operation) achieved a Receiver Operating Characteristic Area Under Curve (ROC-AUC) of 0.985, indicating highly discriminative capability between normal operational behavior and malicious activity. The system maintains 97.3% overall detection accuracy with a precision of 95.8% and recall of 96.5%, while sustaining a false positive rate of 2.1% - representing a statistically significant 92.3% reduction (p < 0.001, Wilcoxon signed-rank test) compared to signature-based baseline systems. Live traffic validation in a 30-day industrial testbed deployment demonstrated robust detection of all tested attack scenarios including network reconnaissance, exploitation attempts, and lateral movement patterns, with detection latency under 5 minutes and an operational unconfirmed alert rate of 0.067 per day. Performance benchmarks conducted using tcpreplay to replay captured industrial traffic at controlled rates demonstrated sustained processing capability of 1 Gbps synthetic traffic with average per-window latency of 4.2ms (±1.1ms std) using commodity hardware (Intel Xeon E-2288G, 8 cores, 32GB RAM), enabling cost-effective deployment in resource-constrained industrial environments. The primary contributions of this research include: (1) a novel multi-stage predictive architecture that separates anomaly detection from threat interpretation, reducing alert fatigue while maintaining sensitivity to emerging threats, (2) comprehensive validation demonstrating superior performance compared to existing commercial and open-source OT security solutions, (3) operational deployment guidelines based on real-world industrial testbed experience, and (4) an open discussion of limitations and future research directions for adaptive adversarial robustness and encrypted traffic analysis. This publication describes a proprietary system. The implementation, source code, trained models, datasets, and deployment configurations of DarkVortex OT are not publicly released and remain the intellectual property of the authors. This work is published for scientific dissemination purposes only.