Cyber security appliance for an operational technology network
A cyber security appliance has one or more modules to interact with entities in an operational technology network and potentially in an informational technology network. The operational technology module can reference various machine-learning models trained on a normal pattern of life of users, devices, and/or controllers of the operational technology network. A comparator module cooperates with the operational technology module to compare the received data on the operational technology network to the normal pattern of life of any of the users, devices, and controllers to detect anomalies in the normal pattern of life for these entities in order to detect a cyber threat. An autonomous response module can be programmed to respond to counter the detected cyber threat.
1. A non-transitory computer readable medium comprising computer readable code operable, when executed by one or more processing apparatuses in a computing device, to cause the computing device to perform operations as follows, comprising:
providing a cyber security appliance to defend an operational technology network;
receiving data on the operational technology network from i) a set of probes, ii) by passive traffic ingestion through a location within the network, and iii) any combination of both:
referencing at least two or more of
i) one or more machine-learning models, that are trained on a normal pattern of life of users of the operational technology network,
ii) one or More machine-learning models that are trained on a normal pattern of life of devices in the operational technology network, and
iii) one or more machine-learning models that are trained on a normal pattern of life of controllers in the operational technology network;
comparing the received data on the operational technology network to the normal pattern of life of any of the users, devices, and controllers to detect anomalies in the normal pattern of life for these entities in order to detect a cyber threat; and
taking a response to counter the cyber threat based on the comparison with an autonomous response module.
2. The non-transitory computer readable medium storing computer readable code operable of claim 1 , when executed by the one or more processing apparatuses in the computing device, to cause the computing device to perform further operations as follows, comprising:
programming the autonomous response module i) to merely make a suggested response to take to counter the cyber threat that will be presented for explicit authorization when the cyber threat is detected or ii) to autonomously take a response to counter the cyber threat without a need for a human to approve the response when the cyber threat is detected.
3. The non-transitory computer readable medium storing computer readable code operable of claim 1 , when executed by the one or more processing apparatuses in the computing device, to cause the computing device to perform further operations as follows, comprising:
programming in different subsets or zones within the operational technology network, where in these different subsets and zones, permissions for the autonomous response module to autonomously take the response to counter the cyber threat without a need for a human to approve the response when the cyber threat is detected can differ.
4. The non-transitory computer readable medium storing computer readable code operable of claim 1 , when executed by the one or more processing apparatuses in the computing device, to cause the computing device to perform further operations as follows, comprising:
monitoring data from an informational technology network in order to analyze and integrate both activities occurring in the operational technology network as well as activities occurring in the informational technology network at a same time when analyzing the detected anomalies in the normal pattern of life in order to detect the cyber threat.
5. The non-transitory computer readable medium storing computer readable code operable of claim 1 , when executed by the one or more processing apparatuses in the computing device, to cause the computing device to perform further operations as follows, comprising:
displaying metrics, alerts, and events of both the operational technology network in light of activities occurring in information technology network on a common display screen to allow a viewer
i) to visually contextualize the metrics, alerts, and/or events occurring in the operational technology network in light of the activities occurring in the information technology network on the common display screen,
and then ii) to confirm the detected cyber threat.
6. The non-transitory computer readable medium storing computer readable code operable of claim 1 , when executed by the one or more processing apparatuses in the computing device, to cause the computing device to perform further operations as follows, comprising:
examining various fields and other header information in communications to determine whether that communication is headed to a specific operational technology component that exists beyond an endpoint gateway to operational technology components beyond that Internet Protocol address of the endpoint gateway, where the operational technology components do not have an IP address, and then display both components of an information technology network with IP addresses and identifiable operational technology network without IP addresses on a common display screen to allow a viewer to see both the components of the information technology network and components of the operational technology network on the common display screen.
7. The non-transitory computer readable medium storing computer readable code operable of claim 1 , when executed by the one or more processing apparatuses in the computing device, to cause the computing device to perform further operations as follows, comprising:
using a graphical user interface to show, in real time, i) components of the operational technology network and components of an information technology network and ii) detailed data flows and commands that those network components are receiving when an abnormal behavior is detected.
8. The non-transitory computer readable medium storing computer readable code operable of claim 1 , when executed by the one or more processing apparatuses in the computing device, to cause the computing device to perform further operations as follows, comprising:
comparing a chain of one or more of the detected anomalies by referencing one or more machine-learning models trained on, at least, the cyber threat.
9. The non-transitory computer readable medium storing computer readable code operable of claim 1 , when executed by the one or more processing apparatuses in the computing device, to cause the computing device to perform further operations as follows, comprising:
where once the normal pattern of life has been learned by the models, then the operational technology module can readily identify the anomalies in the normal pattern of life; and thus, unusual behaviors from the devices, users, or controllers of the operational technology network.
10. A cyber security appliance, comprising:
a processor and a memory, which further comprise:
an operational technology module configured to receive data on an operational technology network from i) a set of probes, iI) by passive traffic ingestion through a
location within the network, and iii) any combination of both, where the operational technology module is also configured to reference at least two of
i) one or more machine-learning models, using machine-learning and artificial intelligence (AI) algorithms, that are trained on a normal pattern of life of users of the operational technology network,
ii) one or More machine-learning models, using machine-learning and AI algorithms, that are trained on a normal pattern of life of devices in the operational technology network, and
iii) one or more machine-learning models, using machine-learning and AI algorithms, that are trained on a normal pattern of life of controllers in the operational technology network;
a comparator module configured to cooperate with the operational technology module to compare the received data on the operational technology network to the normal pattern of life of any of the users, devices, and controllers to detect anomalies in the normal pattern of life for these entities in order to detect a cyber threat; and
an autonomous response module configured to respond to counter the cyber threat, and a user interface to program the autonomous response module.
11. The cyber security appliance of claim 10 , where the autonomous response module is configured to i) to merely make a suggested response to take to counter the cyber threat that will be presented for explicit authorization when the cyber threat is detected or ii) to autonomously take a response to counter the cyber threat without a need for a human to approve the response when the cyber threat is detected.
12. The cyber security appliance of claim 10 , where the user interface is further configured to program in different configurations for subsets of, or zones, within the operational technology network, wherein these different subsets and zones, permissions for the autonomous response module to autonomously take the response to counter the cyber threat without a need for a human to approve the response i) when the cyber threat is detected, can differ in each different zone and ii) a range of allowed responses can also differ in each different zone, iii) and a set of allowed responses can also differ in each different zone, and iv) any combination of these.
13. The cyber security appliance of claim 10 , where the cyber security appliance containing the autonomous response module, the operational technology module, and the comparator module can be constructed for installation in an industrial environment with a protective housing and cooling components to allow the cyber security appliance to be installed in more hazardous locations where dust, moisture, temperature, and vibration require ruggedization.
14. The cyber security appliance of claim 10 , further comprising:
an informational technology module configured to monitor data from an informational technology network in order to analyze and integrate both activities occurring in the operational technology network as well as activities occurring in the informational technology network at a same time when analyzing the detected anomalies in the normal pattern of life in order to detect the cyber threat.
15. The cyber security appliance of claim 10 , further comprising:
where once the normal pattern of life has been learned by the models, then the operational technology module can readily identify the anomalies in the normal pattern of life; and thus, unusual behaviors from the devices, users, or controllers of the operational technology network.
16. The cyber security appliance of claim 10 , further comprising:
a graphical user interface is configured to display metrics, alerts, and events of both the operational technology network in light of activities occurring in an information technology network on a common display screen to allow a viewer
i) to visually contextualize the metrics, alerts, and/or events occurring in the operational technology network in light of the activities occurring in the information technology network on the common display screen,
and then ii) to confirm the detected cyber threat.
17. The cyber security appliance of claim 10 , further comprising:
a communications messaging detector configured to analyze and understand at least content and fields in two or more of i) a data link, ii) a network protocol, iii) a transport protocol, iv) a session protocol, and v) application layers of networking protocols used in operational technology networks as well as vi) those protocols shared by and used by information technology networks.
18. The cyber security appliance of claim 10 , further comprising:
a graphical user interface is configured to cooperate with communications messaging detector to examine various fields and other header information in the communications to determine whether that communication is headed to a specific operational technology component that exists beyond an endpoint gateway to operational technology components beyond that Internet Protocol address of the endpoint gateway, where the operational technology components do not have an IP address, and then display both components of an information technology network with IP addresses and identifiable operational technology network without IP addresses on a common display screen to allow a viewer to see both the components of the information technology network and components of the operational technology network on the common display screen.
19. The cyber security appliance of claim 10 , further comprising:
a graphical user interface configured to show i) components of the operational technology network and components of an information technology network and ii) detailed data flows and commands that those network components are receiving in real time and when an abnormal behavior is detected.
20. The cyber security appliance of claim 10 , further comprising:
a cyber threat module configured to compare a chain of one or more of the detected anomalies by referencing one or more machine-learning models trained on, at least, the cyber threat.