Method and system for performing anomaly detection on operational technology network

A system comprising:

• at least one memory storing instructions;
• and
• at least processor communicatively coupled with the at least one memory and configured to executed instructions to perform operations comprising:
• obtaining a plurality of input packets, each of the plurality of input packets representing a history of baseline packets;
• training a foundation model to generate a plurality of corresponding recreated packets based on the plurality of input packets, wherein each of the plurality of corresponding recreated packets is based on a unique one of the plurality of input packets;
• optimizing the foundation model by minimizing a difference between the plurality of input packets and the plurality of corresponding generated recreated packets;
• receiving an incoming data packet on an operational technology network;
• generating, using the trained and optimized foundation model, a recreated data packet based upon the incoming data packet;
• calculating a difference between the recreated data packet and the incoming data packet;
• determining if the difference is above a predetermined threshold;
• and
• triggering, when any difference is above the predetermined threshold, a security protocol.

A non-transitory computer-readable storage media (CRM) comprising instructions stored thereon, which, when executed by at least one processor of at least one computing device, cause the at least one computing device to perform operations comprising:

• obtaining a plurality of input packets, each of the plurality of input packets representing a history of baseline packets;
• training a foundation model to generate a plurality of corresponding recreated packets based on the plurality of input packets, wherein each of the plurality of corresponding recreated packets is based on a unique one of the plurality of input packets;
• optimizing the foundation model by minimizing a difference between the plurality of input packets and the plurality of corresponding generated packets;
• receiving an incoming data packet on an operational technology network;
• generating, using the trained and optimized foundation model, a recreated data packet based upon the incoming data packet;
• calculating a difference between the recreated data packet and the incoming data packet;
• determining if the difference is above a predetermined threshold;
• and
• triggering, when any difference is above the predetermined threshold, a security protocol.