MetaPhortress: A Situational Awareness Platform

Fossil fuel power generation plants risk interruptions of service caused by malicious attacks from insider threats and cybercriminals. Although cyber warfare threatens all sectors of the United States’ critical infrastructure, the energy sector’s reliance on networked industrial control systems renders it particularly vulnerable to cyberattacks; therefore, comprehensive situational awareness of power plant health, operation, and cybersecurity has become critical to keeping the power on. The proposal team will create an automated situational awareness tool that adapts their proven, patented cyber feature-extraction and behavior analysis platform to provide comprehensive, simultaneous coverage of fossil power plant industrial control systems, information technology networks, and physics access control systems. The tool will perform data fusion upon networked sensor outputs to characterize nominal operational modes, and then use data analytics to detect deviations from those modes, in order to determine which anomalous conditions correspond to malicious behavior, and to alert system operators to emerging cyber incidents. The enabling platform employs a temporal aggregation methodology that models dynamic, emergent threat behaviors and models the behaviors of known threats. The methodology is threat-centric: it categorizes the behavior of network entities, instead of being a standard alert- or alarm-centric approach that classifies individual network incidents without associating them to entities. Aggregated behavior analysis will make the proposed situational awareness tool uniquely adept at discovering malicious entities that attempt multiple vectors across an attack surface and attacks that unfold over varied timescales. During Phase I, the proposal team will research and characterize the sensor types available in the domain, obtain representative data sets, determine attack surfaces over the range of fossil power plant types, develop power plant health models, map power plant network architecture to threat models, determine system integration requirements, and design a prototype human-machine interface. During execution of the three Small Business Innovation Research project phases, the proposed automated tool will ultimately provide situational awareness for the full range of fossil fuel power generation infrastructure. After developing requirements and design in Phase I, the proposal team envisions developing a single-position prototype in Phase II for delivery in Phase III. The Phase III effort will add distributed capabilities to the tool that will allow fossil fuel power plant owners and operators to coordinate their detection of area-wide anomalous conditions, obtain the information they need tomitigate them, and ultimately to share their detected threat behavior information with other facilities. The successful execution of this vision will greatly contribute to the resilience, safety, and reliability of the critical power generation infrastructure of the United States.