Detecting anomalous network behavior in operational technology protocols
AssigneePalo Alto Networks, Inc.
InventorsKe Tian, Aveek Kumar Das, Derick Liang, Rahul Rajewar, Gong Cheng, Mei Wang
Life of this patent
Estimating the term…
Abstract
Techniques for detecting anomalous network behavior in operational technology (OT) protocols are disclosed. A system, process, and/or computer program product for detecting anomalous network behavior in OT protocols include monitoring network traffic to perform automated OT malware detection analysis of OT related network traffic, extracting one or more features from the OT related network traffic, inputting the one or more extracted features into a model for malware detection analysis, and performing an action based on a result of the model.
Claims20
A system, comprising:
- a processor configured to:
- monitor network traffic to perform automated operational technology (OT) malware detection analysis of OT related network traffic;
- extract one or more features from the OT related network traffic;
- input the one or more extracted features into a model for malware detection analysis;
- and
- perform an action based on a result of the model;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method, comprising:
- monitoring network traffic to perform automated operational technology (OT) malware detection analysis of OT related network traffic;
- extracting one or more features from the OT related network traffic;
- inputting the one or more extracted features into a model for malware detection analysis;
- and
- performing an action based on a result of the model.
A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
- monitoring network traffic to perform automated operational technology (OT) malware detection analysis of OT related network traffic;
- extracting one or more features from the OT related network traffic;
- inputting the one or more extracted features into a model for malware detection analysis;
- and
- performing an action based on a result of the model.
Dependencies are inferred from the claim text.