Enhancing OT Security with the Asset Administration Shell: A Semi-Automated Modeling Framework for Threat Hunting

The manufacturing industry is facing an escalating threat landscape, as cybercriminals develop increasingly sophisticated attack vectors that exploit the convergence of IT and Operational Technology (OT) through the proliferation of Internet of Things devices. Effective security management demands up-to-date and comprehensive knowledge of systems under protection. This paper presents a novel approach to modeling OT networks, significantly enhancing threat hunting capabilities and leveraging the power of the Asset Administration Shell. We detail a methodology for accurately modeling network aspects, alongside a robust framework for securing collected data, enabling its utilization as a trusted and centralized knowledge base for security-critical applications. Built upon established Industry 4.0 standards, our preliminary metamodel demonstrates the potential for semi-automated modeling of complex OT environments and the associated data flows. This facilitates improved situational awareness, supports proactive threat detection, and addresses the inherent challenges of data inconsistency often found within OT environments. Furthermore, the model provides powerful visualization of relationships within OT processes, enabling the detection of yet undiscovered attack patterns.