# Industrial OT Traffic Monitor

**Time:** 45–90 minutes | **Level:** Intermediate

## What you will build
A local Streamlit dashboard that loads numeric security telemetry, trains or runs an educational anomaly model, shows interactive visualizations, and exports the sample data.

## Safety boundary
Simulated OT metadata only. No PLC/DCS communication, scanning, packet injection or live monitoring.
Use only included synthetic data or publicly licensed / explicitly authorized, sanitized features. Never test against live systems.

## Setup
```bash
cd cybersecurity_lab/05_industrial_ot
python -m venv .venv
# Windows: .venv\Scripts\activate
# macOS/Linux: source .venv/bin/activate
pip install -r requirements.txt
streamlit run app.py
```

## Guided exercise
1. Launch the app and inspect `sample_data.csv`. The `SYN-` prefix indicates generated records.
2. Observe the feature columns: `messages_per_min, write_command_count, new_peer_count, off_hours_flag, protocol_errors, latency_ms, read_write_ratio`.
3. Review precision, recall, F1 and the held-out confusion matrix. Notice false positives and false negatives.
4. Change a copy of the CSV (not the original), reload and compare results.
5. Explain why performance on artificial data cannot establish real-world attack detection.
6. Propose a safer validation plan using public benchmarks, temporal splits and independent site data where permitted.

## Learning challenge
Compare the baseline with a logistic regression or gradient boosting model and report precision/recall.

## Dataset and deployment limitations
- Synthetic records were generated by simplified rules; easy patterns may cause artificially high metrics.
- This tutorial is not a security product, IDS, malware scanner or industrial control system monitor.
- Only numeric features are accepted; raw packet capture, executable files and device connections are not supported.
- Do not publish confidential plant information.

## Share your work
Contribute a reproducible, safe enhancement via AIMPACT's public contribution process after reviewing `DATA_POLICY.md`.