Externally securing unmanaged devices using artificial intelligence operations (AIOPS) for network operations

A non-transitory computer-readable medium in a network security device, on a data communication network, storing code that when executed, performing a method for externally securing unmanaged devices on an enterprise network using Artificial Intelligence Operations (AIOPs), the method comprising:

• detecting an unknown operational technology (OT) or Internet of Things (IoT) device, on the enterprise network comprising a plurality of known OT and IoT devices, by capturing network transactions related to downstream network devices and identifying the unknown OT or IoT device from non-OT or non-IoT network devices on the enterprise network, wherein the unknown OT or IoT device and the plurality of known OT and IoT devices are unable to internally execute non-native apps;
• determining a device type of the unknown OT or IoT device using an AIOP detection model, wherein the AIOP detection model is trained from unsupervised cluster learning from a history of externally captured network transactions of the plurality of known OT and IoT devices;
• assessing vulnerabilities of the unknown OT or IoT device by predicting services from correlating the device type to the externally captured network transactions;
• monitoring the unknown OT or IoT device to detect anomalous activity related to an assessed vulnerability of the unknown OT or IoT device, using an AIOP intrusion model generated from the history of known OT and IoT devices;
• and
• responsive to detecting anomalous activity, taking a security action based on relevant security rules.

A network security device, on a data communication network, for externally securing unmanaged devices on an enterprise network using Artificial Intelligence Operations (AIOPs), the network security device comprising:

• a processor;
• a network interface communicatively coupled to the processor and to a data communication network;
• and
• a memory, communicatively coupled to the processor and storing:
• a device detection module to detect an unknown operational technology (OT) and/or Internet of Things (IoT) device, on the enterprise network comprising a plurality of known OT and IoT devices, by capturing network transactions related to downstream network devices and identifying the unknown OT or IoT device from non-OT or non-IoT network devices on the enterprise network, wherein the unknown OT or IoT device and the plurality of known OT and IoT devices are unable to internally execute non-native apps;
• a device type module to determine a device type of the unknown OT or IoT device using an AIOP detection model, wherein the AIOP detection model is trained from unsupervised cluster learning from a history of externally captured network transactions of the plurality of known OT and IoT devices;
• a device assessment module to assess vulnerabilities of the unknown OT or IoT device by predicting services from correlating the device type to the externally captured network transactions;
• an intrusion monitoring module to monitor the unknown OT or IoT device to detect anomalous activity related to an assessed vulnerability of the unknown OT or IoT device, using an AIOP intrusion model generated from the history of known OT and IoT devices;
• and
• a security action module to, responsive to detecting anomalous activity, take a security action based on relevant security rules.