Systems and methods for network discovery in a multi-layer operational technology network

A method, comprising:

• receiving a plurality of discovery data sets, wherein each of the plurality of discovery data sets comprises data identifying a respective subset of a plurality of nodes within an operational technology (OT) network, wherein the OT network comprises a plurality of network layers, wherein the respective subset of the plurality of nodes for a first discovery data set are disposed within at least two network layers of the plurality of network layers;
• identifying a set of nodes within the OT network that appear in two or more of the plurality of discovery data sets;
• generating a holistic discovery data set for the OT network based on the plurality of discovery data sets and the identified set of nodes within the OT network that appear in the two or more of the plurality of discovery data sets;
• and
• generating a visualization of the plurality of nodes within the OT network based on the holistic discovery data set.

A non-transitory computer readable medium storing instructions that, when executed by a processor, cause the processor to perform operations comprising:

• transmitting a first plurality of discovery probes from a first plurality of respective entry points into an operational technology (OT) network, wherein the OT network comprises a plurality of industrial automation components configured to perform an industrial automation operation, and wherein the OT network comprises a plurality of network layers;
• receiving a first plurality of discovery data sets in response to the first plurality of discovery probes, wherein each of the first plurality of discovery data sets comprises data identifying a first respective subset of a plurality of nodes within the OT network, wherein the first respective subset of the plurality of nodes for a first discovery data set are disposed within at least two network layers of the plurality of network layers;
• identifying a first set of nodes within the OT network that appear in two or more of the first plurality of discovery data sets;
• in response to determining that the first set of nodes does not meet a specified condition, transmitting a second plurality of discovery probes from a second plurality of respective entry points into the OT network;
• receiving a second plurality of discovery data sets in response to the second plurality of discovery probes, wherein each of the second plurality of discovery data sets comprises data identifying a second respective subset of the plurality of nodes within the OT network;
• identifying a second set of nodes within the OT network that appear in two or more of the first and second plurality of discovery data sets;
• and
• in response to determining that the first set of nodes and the second set of nodes meet the specified condition, generating a holistic discovery data set for the OT network based on the first plurality of discovery data sets, the second plurality of discovery data sets, and the identified second set of nodes within the OT network that appear in the two or more of the first and second plurality of discovery data sets.