Zero-trust architecture for industrial automation

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the one or more network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process that is executable by the processor, the process when executed configured to:
• obtain parameters for entropy testing of industrial equipment that controls a physical process, wherein entropy is added to commands sent to the industrial equipment during the entropy testing;
• receive packets that were generated during the entropy testing of the industrial equipment and include sensor data regarding the physical process;
• determine whether the sensor data is inconsistent by analyzing the sensor data using a machine learning model that models the physical process;
• and
• initiate a corrective measure, when the sensor data is determined to be inconsistent.

A tangible, non-transitory, computer-readable medium storing program instructions that cause a device in a network to execute a process comprising:

• obtaining, by the device in the network, parameters for entropy testing of industrial equipment that controls a physical process, wherein entropy is added to commands sent to the industrial equipment during the entropy testing;
• receiving, at the device, packets that were generated during the entropy testing of the industrial equipment and include sensor data regarding the physical process;
• determining, by the device, whether the sensor data is inconsistent by analyzing the sensor data using a machine learning model that models the physical process;
• and
• initiating, by the device, a corrective measure, when the sensor data is determined to be inconsistent.