Shadow ai detection system

A controller comprising:

• at least one memory configured to store computer-readable instructions;
• and
• one or more processors configured to execute the computer-readable instructions to:
• scan one or more workloads to determine a first network endpoint accessing a first AI application based on traffic and logs;
• match network traffic from a second network endpoint to a pattern indicative of AI traffic to determine that the network traffic from the second network endpoint is traffic to a second AI application;
• generate a network map of a pathway from the first network endpoint to the first AI application and a pathway from the second network endpoint to the second AI application;
• and
• monitor traffic on the pathway from the first network endpoint to the first AI application and traffic on the pathway from the second network endpoint to the second AI application based on the network map.

One or more non-transitory computer-readable storage media comprising computer-readable instructions that, when executed by one or more processors of a controller of a network, cause the controller to:

• scan one or more workloads to determine a first network endpoint accessing a first AI application based on traffic and logs;
• match network traffic from a second network endpoint to a pattern indicative of AI traffic to determine that the network traffic from the second network endpoint is traffic to a second AI application;
• generate a network map of a pathway from the first network endpoint to the first AI application and a pathway from the second network endpoint to the second AI application;
• and
• monitor traffic on the pathway from the first network endpoint to the first AI application and traffic on the pathway from the second network endpoint to the second AI application based on the network map.