Detecting anomalous network behavior in operational technology protocols

1 . A system, comprising:

a processor of a firewall configured to:

monitor network traffic to perform automated operational technology (OT) malware detection analysis of OT related network traffic;

extract one or more features from the OT related network traffic to obtain an aggregated feature vector, comprising to:

convert the extracted one or more features into one or more scalar values;

normalize the one or more scalar values into one or more specific categories to obtain one or more feature vectors; and

concatenate the one or more features vectors to form the aggregated feature vector;

input the aggregated feature vector into a model for malware detection analysis, wherein the model includes a machine learning model, wherein the machine learning model is implemented using an isolation forest for anomaly detection, wherein the firewall is configured to train the model using labeled training data, compare a value of the model with a threshold value, determine that the value is greater than or equal to the threshold value, and in response to a determination that the value is equal to or greater than the threshold value, adjust the threshold value, and wherein the inputting of the one or more extracted features comprises to:

receive an output from the model;

compare the output with an output threshold; and

in response to a determination that the output is equal to or exceeds the output threshold, determine that a sample associated with the network traffic is malware; and

perform an action based on a result of the model, wherein the performing of the action comprises to:

perform one or more of the following:

block the network traffic; and/or

generate a new signature relating to one or more OT related network events relating to a detected malware sample; and

a memory coupled to the processor and configured to provide the processor with instructions.

2 . The system of claim 1 , wherein the monitoring of the network traffic comprises to:

filter TCP related traffic and/or UDP related traffic from the network traffic to obtain the OT related network traffic.

3 . The system of claim 1 , wherein the performing of the action further comprises to:

send an alert to an administrator.

4 . The system of claim 1 , wherein the one or more extracted features comprise one or more of the following: static behaviors, static protocols, dynamic behaviors, and/or dynamic protocols.

5 . The system of claim 1 , wherein the model is updated using labeled training data.

6 . A method, comprising:

monitoring, using a firewall, network traffic to perform automated operational technology (OT) malware detection analysis of OT related network traffic;

extracting, using the firewall, one or more features from the OT related network traffic to obtain an aggregated feature vector, comprising:

converting the extracted one or more features into one or more scalar values;

normalizing the one or more scalar values into one or more specific categories to obtain one or more feature vectors; and

concatenating the one or more features vectors to form the aggregated feature vector;

inputting, using the firewall, the aggregated feature vector into a model for malware detection analysis, wherein the model includes a machine learning model, wherein the machine learning model is implemented using an isolation forest for anomaly detection, wherein the firewall is configured to train the model using labeled training data, compare a value of the model with a threshold value, determine that the value is greater than or equal to the threshold value, and in response to a determination that the value is equal to or greater than the threshold value, adjust the threshold value, and wherein the inputting of the one or more extracted features comprises:

receiving an output from the model;

comparing the output with an output threshold; and

in response to a determination that the output is equal to or exceeds the output threshold, determining that a sample associated with the network traffic is malware; and

performing an action based on a result of the model, wherein the performing of the action comprises:

performing one or more of the following:

blocking the network traffic; and/or

generating a new signature relating to one or more OT related network events relating to a detected malware sample.

7 . The method of claim 6 , wherein the monitoring of the network traffic comprises:

filtering TCP related traffic and/or UDP related traffic from the network traffic to obtain the OT related network traffic.

8 . The method of claim 6 , wherein the performing of the action further comprises:

sending an alert to an administrator.

9 . The method of claim 6 , wherein the one or more extracted features comprise one or more of the following: static behaviors, static protocols, dynamic behaviors, and/or dynamic protocols.

10 . The method of claim 6 , wherein the model is updated using labeled training data.

11 . A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:

monitoring, using a firewall, network traffic to perform automated operational technology (OT) malware detection analysis of OT related network traffic;

extracting, using the firewall, one or more features from the OT related network traffic to obtain an aggregated feature vector, comprising:

converting the extracted one or more features into one or more scalar values;

normalizing the one or more scalar values into one or more specific categories to obtain one or more feature vectors; and

concatenating the one or more features vectors to form the aggregated feature vector;

inputting, using the firewall, the aggregated feature vector into a model for malware detection analysis, wherein the model includes a machine learning model, wherein the machine learning model is implemented using an isolation forest for anomaly detection, wherein the firewall is configured to train the model using labeled training data, compare a value of the model with a threshold value, determine that the value is greater than or equal to the threshold value, and in response to a determination that the value is equal to or greater than the threshold value, adjust the threshold value, and wherein the inputting of the one or more extracted features comprises:

receiving an output from the model;

comparing the output with an output threshold; and

in response to a determination that the output is equal to or exceeds the output threshold, determining that a sample associated with the network traffic is malware; and

performing an action based on a result of the model, wherein the performing of the action comprises:

performing one or more of the following:

blocking the network traffic; and/or

generating a new signature relating to one or more OT related network events relating to a detected malware sample.

12 . The computer program product of claim 11 , wherein the monitoring of the network traffic comprises:

filtering TCP related traffic and/or UDP related traffic from the network traffic to obtain the OT related network traffic.

13 . The computer program product of claim 11 , wherein the performing of the action further comprises:

sending an alert to an administrator.

14 . The computer program product of claim 11 , wherein the one or more extracted features comprise one or more of the following: static behaviors, static protocols, dynamic behaviors, and/or dynamic protocols.