Method and system for performing anomaly detection on operational technology network

1 . A computer implemented method for anomaly detection on an operational technology network, the method being executed by one or more processors and comprising:

obtaining a plurality of input packets, each of the plurality of input packets representing a history of baseline packets;

training a foundation model to generate a plurality of corresponding recreated packets based on the plurality of input packets, wherein each of the plurality of corresponding recreated packets is based on a unique one of the plurality of input packets;

optimizing the foundation model by minimizing a difference between the plurality of input packets and the plurality of corresponding generated recreated packets;

receiving an incoming data packet on the operational technology network;

generating, using the trained and optimized foundation model, a recreated data packet based upon the incoming data packet;

calculating a difference between the recreated data packet and the incoming data packet;

determining if the difference is above a predetermined threshold; and

triggering, when any difference is above the predetermined threshold, a security protocol.

2 . The computer implemented method of claim 1 , wherein the incoming data packet includes hexadecimal data.

3 . The computer implemented method of claim 1 , wherein the plurality of input packets comprise unencrypted input packets or pre-decrypted input packets.

4 . The computer implemented method of claim 3 , further comprising:

generating a plurality of embedded input packets, each of the plurality of embedded input packets corresponds to one of the plurality of input packets, wherein the training the foundation model generates the plurality of corresponding recreated packets based upon the plurality of embedded input packets.

5 . The computer implemented method of claim 4 , wherein the generating a plurality of embedded input packets transforms the plurality of input packets into a vector representation.

6 . The computer implemented method of claim 1 , further comprising:

determining that the incoming data packet is unencrypted or pre-decrypted;

generating an embedded data packet corresponding to the incoming data packet; and

generating the recreated data packet based upon the embedded data packet.

7 . The computer implemented method of claim 1 , further comprising:

transmitting the incoming data packet to a designated destination.

8 . The computer implemented method of claim 1 , wherein the security protocol includes providing an alert to a security system.

9 . A system comprising:

at least one memory storing instructions; and

at least processor communicatively coupled with the at least one memory and configured to executed instructions to perform operations comprising:

obtaining a plurality of input packets, each of the plurality of input packets representing a history of baseline packets;

training a foundation model to generate a plurality of corresponding recreated packets based on the plurality of input packets, wherein each of the plurality of corresponding recreated packets is based on a unique one of the plurality of input packets;

optimizing the foundation model by minimizing a difference between the plurality of input packets and the plurality of corresponding generated recreated packets;

receiving an incoming data packet on an operational technology network;

generating, using the trained and optimized foundation model, a recreated data packet based upon the incoming data packet;

calculating a difference between the recreated data packet and the incoming data packet;

determining if the difference is above a predetermined threshold; and

triggering, when any difference is above the predetermined threshold, a security protocol.

10 . The system of claim 9 , wherein the incoming data packet includes hexadecimal data.

11 . The system of claim 9 , wherein the plurality of input packets comprise unencrypted input packets or pre-decrypted input packets.

12 . The system of claim 11 , wherein the operations further comprising:

generating a plurality of embedded input packets, each of the plurality of embedded input packets corresponds to one of the plurality of input packets, wherein the training the foundation model generates the plurality of corresponding recreated packets based upon the plurality of embedded input packets.

13 . The system of claim 12 , wherein the generating a plurality of embedded input packets transforms the plurality of input packets into a vector representation.

14 . The system of claim 9 , wherein the operations further comprising:

determining that the incoming data packet is unencrypted or pre-decrypted;

generating an embedded data packet corresponding to the incoming data packet; and

generating the recreated data packet based upon the embedded data packet.

15 . The system of claim 9 , wherein the operations further comprising:

transmitting the incoming data packet to a designated destination.

16 . The system of claim 9 , wherein the security protocol includes providing an alert to a security system.

17 . A non-transitory computer-readable storage media (CRM) comprising instructions stored thereon, which, when executed by at least one processor of at least one computing device, cause the at least one computing device to perform operations comprising:

obtaining a plurality of input packets, each of the plurality of input packets representing a history of baseline packets;

training a foundation model to generate a plurality of corresponding recreated packets based on the plurality of input packets, wherein each of the plurality of corresponding recreated packets is based on a unique one of the plurality of input packets;

optimizing the foundation model by minimizing a difference between the plurality of input packets and the plurality of corresponding generated packets;

receiving an incoming data packet on an operational technology network;

generating, using the trained and optimized foundation model, a recreated data packet based upon the incoming data packet;

calculating a difference between the recreated data packet and the incoming data packet;

determining if the difference is above a predetermined threshold; and

triggering, when any difference is above the predetermined threshold, a security protocol.

18 . The non-transitory CRM of claim 17 , wherein the plurality of input packets comprise unencrypted input packets or pre-decrypted input packets.

19 . The non-transitory CRM of claim 18 , wherein the operations further comprising:

generating a plurality of embedded input packets, each of the plurality of embedded input packets corresponds to one of the plurality of input packets, wherein the training the foundation model generates the plurality of corresponding recreated packets based upon the plurality of embedded input packets.

20 . The non-transitory CRM of claim 19 , wherein the generating a plurality of embedded input packets transforms the plurality of input packets into a vector representation.