SBIR Phase II: Securing Industrial Control Networks with Network Forecasting

This Small Business Innovation Research Phase II project is focused on network forecasting, a new approach to securing industrial control networks. In essence, network forecasting involves monitoring all devices on a network, and for each device using past behavior to predict near-term future behavior. Deviation from predicted behavior then signals a potential issue. The intellectual merit of the innovation lies in its departure from traditional network security paradigms. Traditional approaches, such as signature-based anti-virus and intrusion prevention systems, detect misbehaviors by recognizing repeats of past behaviors. These approaches necessarily overlook one-of-a-kind or zero-day misbehaviors. In contrast, network forecasting incorporates an understanding of correct and expected network behavior so that aberrant behavior can be identified even if it has not been seen before. The approach builds on the company's previous work in understanding the active roles that devices assume on a network. When predicted network device behavior fails to match reality on the network, network operators can respond without needing to fully understand the details of the threat that caused the disturbance. The broader impact/commercial potential of this project is substantial because critical infrastructure - such as a power generation and distribution grid - represents both a significant investment and a substantive vulnerability in modern society. While recent cyber-attacks may have heightened public awareness of the threats to critical infrastructure, such infrastructure has been the object of sustained concern from government and private-sector groups for many years. However, while the need for increased security in critical infrastructure has grown over time, the effectiveness of network security methods has not kept pace with the sophistication and impact of cyber-attacks. If successful, network forecasting has the potential to transform the security and monitoring practices in nearly all domains of critical infrastructure. Continued technological advances and economic growth presume the existence of secure, networked critical infrastructure. Substantial advances in the security of such infrastructure, such as that promised by the technology being developed in this project, can help protect the future of our society.