# US 12,003,594 B2 · Systems and methods for network discovery in a multi-layer operational technology network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,594 B2 - Document ID: US12003594B2 - Status: Granted - Kind: B2 - Application number: 17/867,931 - Filed: 2022-07-19 - Published: 2024-01-25 - Granted: 2024-06-04 - Earliest claimed: 2022-07-19 - Assignees: Rockwell Automation Technologies, Inc. - Applicants: Rockwell Automation Technologies, Inc. - Inventors: Timothy C. Mirth; Taryl J. Jasper; Terence S. Tenorio; Thaddeus A. Palus - Web page: https://patentgrep.com/patent/US12003594B2 ## CPC - H04L 41/12: Discovery or management of network topologies - H04L 67/51: Discovery or management thereof, e.g. service location protocol [SLP] or web services - H04L 43/12: Network monitoring probes - H04L 67/1061: using node-based peer discovery mechanisms (static access to replicated servers H04L67/1006; service discovery H04L67/51) - H04W 48/16: Discovering, processing access restriction or access information - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Performing multi-layer network discovery of an operational technology (OT) network includes receiving a plurality of discovery data sets, each identifying a respective subset of a plurality of nodes within an OT network having a plurality of network layers, wherein the respective subset of the plurality of nodes for a first discovery data set are disposed within at least two network layers of the plurality of network layers, identifying a set of nodes within the OT network that appear in two or more of the plurality of discovery data sets, generating a holistic discovery data set for the OT network based on the plurality of discovery data sets and the identified set of nodes within the OT network that appear in the two or more of the plurality of discovery data sets, and generating a visualization of the plurality of nodes within the OT network based on the holistic discovery data set. ## Claims ### Claim 1 A system, comprising: a processor; and a memory, accessible by the processor, and storing instructions that, when executed by the processor, cause the processor to perform operations comprising: transmitting a plurality of discovery probes from a plurality of respective entry points into an operational technology (OT) network, wherein the OT network comprises a plurality of industrial automation components configured to perform an industrial automation operation, and wherein the OT network comprises a plurality of network layers; receiving a plurality of discovery data sets in response to the plurality of discovery probes, wherein each of the plurality of discovery data sets comprises data identifying a respective subset of a plurality of nodes within the OT network, wherein the respective subset of the plurality of nodes for a first discovery data set are disposed within at least two network layers of the plurality of network layers; identifying a set of nodes within the OT network that appear in two or more of the plurality of discovery data sets; generating a holistic discovery data set for the OT network based on the plurality of discovery data sets and the identified set of nodes within the OT network that appear in the two or more of the plurality of discovery data sets; and generating a visualization of the plurality of nodes within the OT network based on the holistic discovery data set. ### Claim 2 (depends on 1) The system of claim 1, wherein the plurality of network layers comprise one or more physical layers, one or more link layers, one or more network layers, one or more application layers, or any combination thereof. ### Claim 3 (depends on 1) The system of claim 1, wherein the operations comprise: in response to determining that the set of nodes within the OT network that appear in the two or more of the plurality of discovery data sets does not meet a specified condition, transmitting an additional plurality of discovery probes from an additional plurality of respective entry points into the OT network; receiving an additional plurality of discovery data sets in response to the additional plurality of discovery probes, wherein each of the additional plurality of discovery data sets comprises data identifying an additional respective subset of the plurality of nodes within the OT network; and identifying an additional set of nodes within the OT network that appear in two or more of the plurality of discovery data sets and the additional plurality of discovery data sets; wherein generating the holistic discovery data set for the OT network is in response to determining that the set of nodes and the additional set of nodes meet the specified condition, and wherein the holistic discovery data set for the OT network is generated based on the plurality of discovery data sets, the additional plurality of discovery data sets, and the identified additional set of nodes within the OT network that appear in the two or more of the plurality of discovery data sets and the additional plurality of discovery data sets. ### Claim 4 (depends on 3) The system of claim 3, wherein the specified condition comprises a threshold number of nodes in (1) the set of nodes, or (2) the set of nodes and the additional set of nodes. ### Claim 5 (depends on 1) The system of claim 1, wherein the data identifying the respective subset of the plurality of nodes within the OT network comprise a manufacturer name, a product name, a model name, a model number, a serial number, a firmware version, a software version, a port status, or any combination thereof. ### Claim 6 (depends on 1) The system of claim 1, wherein the system comprises an edge device. ### Claim 7 (depends on 1) The system of claim 1, wherein the operations comprise transmitting the holistic discovery data set, the visualization, or both, to another node of the plurality of nodes within the OT network. ### Claim 8 (depends on 1) The system of claim 1, wherein the operations comprise transmitting the holistic discovery data set, the visualization, or both, to an enterprise device disposed outside of the OT network. ### Claim 9 A method, comprising: receiving a plurality of discovery data sets, wherein each of the plurality of discovery data sets comprises data identifying a respective subset of a plurality of nodes within an operational technology (OT) network, wherein the OT network comprises a plurality of network layers, wherein the respective subset of the plurality of nodes for a first discovery data set are disposed within at least two network layers of the plurality of network layers; identifying a set of nodes within the OT network that appear in two or more of the plurality of discovery data sets; generating a holistic discovery data set for the OT network based on the plurality of discovery data sets and the identified set of nodes within the OT network that appear in the two or more of the plurality of discovery data sets; and generating a visualization of the plurality of nodes within the OT network based on the holistic discovery data set. ### Claim 10 (depends on 9) The method of claim 9, wherein one or more of the plurality of discovery data sets are received from one or more edge devices. ### Claim 11 (depends on 9) The method of claim 9, wherein one or more of the plurality of discovery data sets are received from one or more end devices. ### Claim 12 (depends on 9) The method of claim 9, wherein the plurality of network layers comprise one or more physical layers, one or more link layers, one or more network layers, one or more application layers, or any combination thereof. ### Claim 13 (depends on 9) The method of claim 9, comprising: analyzing the holistic discovery data set to identify a particular industrial automation device disposed within the OT network as counterfeit; and generating a notification indicating that the identified particular industrial automation device is counterfeit. ### Claim 14 (depends on 9) The method of claim 9, comprising: analyzing the holistic discovery data set to identify a particular industrial automation device disposed within the OT network as running an outdated version of firmware; and generating a notification indicating that the identified particular industrial automation device is running the outdated version of the firmware. ### Claim 15 A non-transitory computer readable medium storing instructions that, when executed by a processor, cause the processor to perform operations comprising: transmitting a first plurality of discovery probes from a first plurality of respective entry points into an operational technology (OT) network, wherein the OT network comprises a plurality of industrial automation components configured to perform an industrial automation operation, and wherein the OT network comprises a plurality of network layers; receiving a first plurality of discovery data sets in response to the first plurality of discovery probes, wherein each of the first plurality of discovery data sets comprises data identifying a first respective subset of a plurality of nodes within the OT network, wherein the first respective subset of the plurality of nodes for a first discovery data set are disposed within at least two network layers of the plurality of network layers; identifying a first set of nodes within the OT network that appear in two or more of the first plurality of discovery data sets; in response to determining that the first set of nodes does not meet a specified condition, transmitting a second plurality of discovery probes from a second plurality of respective entry points into the OT network; receiving a second plurality of discovery data sets in response to the second plurality of discovery probes, wherein each of the second plurality of discovery data sets comprises data identifying a second respective subset of the plurality of nodes within the OT network; identifying a second set of nodes within the OT network that appear in two or more of the first and second plurality of discovery data sets; and in response to determining that the first set of nodes and the second set of nodes meet the specified condition, generating a holistic discovery data set for the OT network based on the first plurality of discovery data sets, the second plurality of discovery data sets, and the identified second set of nodes within the OT network that appear in the two or more of the first and second plurality of discovery data sets. ### Claim 16 (depends on 15) The non-transitory computer readable medium of claim 15, wherein the operations comprise transmitting the holistic discovery data set to another node of the plurality of nodes within the OT network. ### Claim 17 (depends on 15) The non-transitory computer readable medium of claim 15, wherein the operations comprise transmitting the holistic discovery data set to an enterprise device disposed outside of the OT network. ### Claim 18 (depends on 15) The non-transitory computer readable medium of claim 15, wherein the operations comprise generating a visualization of the plurality of nodes within the OT network based on the holistic discovery data set. ### Claim 19 (depends on 15) The non-transitory computer readable medium of claim 15, wherein the plurality of industrial automation components comprise a programmable logic controller (PLC), an actuator, a robot, a motor, a pump, a valve, a machine, a heater, a mixer, a conveyor, a variable frequency drive (VFD), an input/output (I/O) device, a power supply, an engineered system, or other industrial automation device, or any combination thereof. ### Claim 20 (depends on 15) The non-transitory computer readable medium of claim 15, wherein the data identifying the respective subset of the plurality of nodes within the OT network comprise a manufacturer name, a product name, a model name, a model number, a serial number, a firmware version, a software version, a port status, captured network traffic, link layer discovery protocol (LLDP) data, Open Platform Communications Unified Architecture (OPC-UA) data, or any combination thereof.