Distributed learn mode for configuring a firewall, security authority, intrusion detection/prevention devices, and the like

Abstract

Techniques for system wide analysis of industrial protocol traffic are provided to determine an optimal location of a security device and/or to dynamically and automatically create rules for security devices, communication modules, and/or proxy devices, including replacement devices. Intrusion detection and/or prevention can be provided for an system utilizing mechanisms for an industrial protocol space. Automated configurable security rule combining can maintain a rule set that is simple and manageable. Configuration and maintenance of industrial protocol devices, communication devices, security-enabled devices, security proxies, and intrusion detection and/or prevention can be simplified within unique industrial environment architectures.