  Since 2010, multiple cyber incidents on industrial infrastructure, such as
Stuxnet and CrashOverride, have exposed the vulnerability of Industrial Control
Systems (ICS) to cyber threats. The industrial systems are commissioned for
longer duration amounting to decades, often resulting in non-compliance to
technological advancements in industrial cybersecurity mechanisms. The
unavailability of network infrastructure information makes designing the
security policies or configuring the cybersecurity countermeasures such as
Network Intrusion Detection Systems (NIDS) challenging. An empirical solution
is to self-learn the network infrastructure information of an industrial system
from its monitored network traffic to make the network transparent for
downstream analyses tasks such as anomaly detection. In this work, a
Python-based industrial communication paradigm-aware framework, named PROFINET
Operations Enumeration and Tracking (POET), that enumerates different
industrial operations executed in a deterministic order of a PROFINET-based
industrial system is reported. The operation-driving industrial network
protocol frames are dissected for enumeration of the operations. For the
requirements of capturing the transitions between industrial operations
triggered by the communication events, the Finite State Machines (FSM) are
modelled to enumerate the PROFINET operations of the device, connection and
system. POET extracts the network information from network traffic to
instantiate appropriate FSM models (Device, Connection or System) and track the
industrial operations. It successfully detects and reports the anomalies
triggered by a network attack in a miniaturized PROFINET-based industrial
system, executed through valid network protocol exchanges and resulting in
invalid PROFINET operation transition for the device.
