Systems and methods for detecting anomolies in network communication

A method, comprising:

• receiving, via a processor, data associated with network communication from a plurality of devices in an industrial automation system;
• identifying, via the processor, one or more communication patterns within the network communication based on the data;
• identifying, via the processor, one or more devices of the plurality of devices based on one or more identifiers associated with the one or more communication patterns;
• determining, via the processor, one or more communication metrics between the one or more devices using the one or more communication patterns;
• generating, via the processor, a network model based the one or more devices and the one or more communication metrics, wherein the network model is representative of one or more expected properties of the network communication of the one or more devices;
• performing, via the processor, an analysis of the network communication using one or more network metrics based on the network model with respect to time;
• detecting, via the processor, one or more anomalies in the network communication using the analysis;
• and
• sending, via the processor, a notification to a computing device in response to detecting the one or more anomalies.

A non-transitory computer-readable medium, comprising computer-executable instructions that, when executed by one or more processors, cause the one or more processors to:

• receive data associated with network communication from a plurality of devices in an industrial automation system;
• identify one or more anomalies within the data based on a comparison between the data and a network model representative of one or more expected properties of the network communication of one or more devices of the plurality of devices;
• retrieve at least one annotation associated with the one or more anomalies, wherein the at least one annotation corresponds to one or more commands configured to adjust a first operation of a first device of the one or more devices;
• and
• send the one or more commands to the first device.