Asset-Aware Network Monitoring

Asset-Aware Network Monitoring, a SANS Institute research paper accepted in January 2026, demonstrates how passive network security monitoring can detect unauthorized devices and communications in Industrial Control System (ICS) environments where active scanning and endpoint security controls are often infeasible. The research uses a custom Zeek script to compare live network traffic against a documented asset inventory, testing detection across six scenarios on a simulated ICS network.

Key findings:

• A custom Zeek script, rogue-asset.zeek, detects four categories of asset deviation: undefined IP addresses, undefined ports, boundary ingress/egress violations, and undefined software
• A ping scan (nmap -sn) of the entire test subnet generated zero detections, while a follow-up TCP SYN scan on a single host triggered undocumented-port alerts for every port probed
• An SSH connection from an authorized workstation to an undocumented IP address was successfully flagged as an "Undocumented Port" event, despite using the authorized port 22/tcp
• Zeek recorded identical, indistinguishable client version strings for Microsoft Edge and Google Chrome, meaning only the Firefox connection among three unauthorized browser sessions was captured as a distinct software deviation
• An Ncat relay used to pivot through an authorized workstation was still detected, because the client string in the software log did not match the expected asset software baseline, even though the source IP appeared legitimate
• Of six asset inventory fields tested, IP address, ports, and MAC address were found to be reliably detectable through network traffic alone
• Operating system and software identification were only partially detectable, since accuracy depends on unparsed, clear-text version banners that do not always parse reliably
• Multicast traffic was intentionally excluded from detection during testing to reduce nuisance alerts, a tuning decision the paper notes could also mask techniques like MITRE ATT&CK's Remote System Discovery (T0846) over multicast ranges
• The detection approach relies on the new_connection Zeek event rather than connection_established, because the latter ignores UDP traffic and triggers too late to catch service details reliably
• Asset attributes such as Asset Role/Type and Asset Criticality were found to be untestable by network intrusion detection and must remain part of separate documentation

The findings show that a lightweight, script-based comparison of live traffic against a static asset inventory can reliably catch unauthorized IP addresses and ports, even when the underlying compromise technique (such as a pivot or relay) is designed to obscure its true source. Software and OS fingerprinting proved far less dependable, since detection quality hinges on whether a given client leaks a unique, parseable version string. Together, this points to passive network monitoring as a practical compensating control specifically for the fields NIDS can observe well, rather than a full substitute for endpoint-level asset management. The test environment used a Raspberry Pi 4 running Debian 13 and Zeek 8.0.4, passively monitoring a mirrored switch port on an internal 192.168.75.0/24 ICS network across six scenarios: baseline SSH logging, authorized versus unauthorized SSH connections, authorized versus unauthorized browser software, network scans, SSH client software fingerprinting, and an Ncat relay/pivot scenario.