Abstract: Described herein are various technologies for monitoring the backplane of a control system and detecting modifications of the control system (e.g., removal of modules, firmware updates, etc.). A monitoring device includes a field programmable gate array (FPGA), and is connected to the backplane of the control system. The monitoring device receives signals, by way of the backplane, that are communicated among modules connected to the backplane. The monitoring device detects a modification to the control system based upon the received signals.

Abstract: The various technologies presented herein relate to the determination of unexpected and/or malicious activity occurring between components communicatively coupled across a backplane. Control data, etc., can be intercepted at a backplane where the backplane facilitates communication between a controller and at least one device in an automation process. During interception of the control data, etc., a copy of the control data can be made, e.g., the original control data can be replicated to generate a copy of the original control data. The original control data can continue on to its destination, while the control data copy can be forwarded to an analyzer system to determine whether the control data contains a data anomaly. The content of the copy of the control data can be compared with a previously captured baseline data content, where the baseline data can be captured for a same operational state as the subsequently captured control data.