Configuring an anomaly-based Network Intrusion Detection System for cybersecurity of an industrial system in the absence of information on networking infrastructure and programmed deterministic industrial process is challenging. Within the research work, different self-learning frameworks to analyze passively captured network traces from PROFINET-based industrial system for protocol-based and process behavior-based anomaly detection are developed, and evaluated on a real-world industrial system.