Skip to main content
Back to challenges
Challenge

Legacy OT Modbus Telemetry Security Auditor using LlamaIndex

Legacy Modbus TCP protocols lack built-in authentication, exposing OT infrastructure to rogue command injection. Build an OT cybersecurity auditing agent using LlamaIndex that parses Modbus packet PCAP logs and matches dynamic transaction patterns against known attack signatures. Identify 98% of unauthorized write operations with zero false positive alerts on routine polling traffic.

EngineeringHosted by Vera
Sign in free to start
Challenge brief

What you are building

The core problem, expected build, and operating context for this challenge.

Develop a Modbus network security auditor using LlamaIndex structured indices and vector search over protocol security specifications.

Delivery guide

How work is evaluated

Evaluation

Evaluates Modbus intrusion detection precision and false positive rate on PCAP network logs.

Datasets

Challenge datasets

Public datasets, plus the private datasets you have access to.

Evaluation rubric

How submissions are scored

These dimensions define what the evaluator checks and which criteria separate a passable run from a strong one.

Dimensions
2 scoring checks
Binary
2 pass or fail dimensions
Ordinal
0 scaled dimensions
Dimension 1

attack_detection_check

Ensure rogue write operation is flagged

Binary check

This dimension contributes its full weight only when the submission satisfies the requirement. Partial credit is not awarded.

Dimension 2

detection_precision

Ratio of accurately identified rogue Modbus transactions • target: 0.98 • range: 0-1

Binary check

This dimension contributes its full weight only when the submission satisfies the requirement. Partial credit is not awarded.

Learning goals

What you should walk away with

  • Index Modbus TCP protocol specs and attack vector signatures using LlamaIndex

  • Parse PCAP transaction logs into structured register read/write event representations

  • Detect unauthorized coil and holding register write commands with sub-5% false positive rates

Resources and assets

Reference links and supporting material

Dataset notes

PCAP logs containing legitimate SCADA polling and injected unauthorized Modbus write requests.

Challenge setup

Evaluates Modbus intrusion detection precision and false positive rate on PCAP network logs.

Challenge input

JSON array of Modbus transaction frames

LlamaIndex

Provides structured document parsing and fast log querying features.

Evaluated output

JSON anomaly report specifying unauthorized function codes and registers

Evaluation checks
  • Ensure rogue write operation is flagged
  • Ratio of accurately identified rogue Modbus transactions • target: 0.98 • range: 0-1
Configured evaluation evidence
  • Benchmark: OT Network Security Audit Suite (OT-SEC-2025)
  • Detection Precision target: 0.98
  • 1 public reference case
Configured runtime
  • Python execution harness
  • Python sandbox (unavailable on Versalist)

Summary shows the first task, up to three tools, and up to three evidence items. Open the technical recipe to view all configured items.

View technical recipe

Configured tools

Action Space
  • Llama Index · Required
  • LlamaIndex · Optional
  • Llama 3.2 · Optional

Evaluation contract

  • attack_detection_check · Weight 1
  • detection_precision · Weight 1

Metrics

  • detection_precision · Target 0.98

Benchmarks

  • OT Network Security Audit Suite (OT-SEC-2025)
  • security

Reference cases

  • 1 public reference case

Workflow tasks

  1. Task 1

    Input: JSON array of Modbus transaction frames

    Output: JSON anomaly report specifying unauthorized function codes and registers

    Execution harness: Python

Evaluation tools

  • LlamaIndex · Data Indexing Engine

Recipe freeze marker

No recipe freeze time is recorded.

Frequently Asked Questions about Legacy OT Modbus Telemetry Security Auditor using LlamaIndex