Improved Security Information Management for SCADA Intrusion Detection Systems

Having achieved success for NASA equipment health monitoring applications, Expert Microsystems will develop new SCADA security solutions derived from its pattern recognition and decision support software. Using our patent pending ¿predict, detect, decide¿ techniques, we will develop an innovative decision support tool providing automated intrusion detection system (IDS) information management. We will train our software models using SCADA IDS data from the DOE¿s Western Area Power Administration (WAPA), which has electrical power transmission and distribution logs for fifteen U.S. states. We will conduct comprehensive analyses to characterize normal (no cyber intrusion) and abnormal (high risk of security breach) SCADA system behavior. Our approach will reduce the high number of ¿false positive¿ indications and will provide an effective method of filtering the vast amounts of data that limit the effectiveness of IDS solutions today. We will solicit design input from SCADA users in diverse operating environments and will review our prototype solution with DHS officials and WAPA to assure our Phase II/III approach is relevant to a broad base of critical infrastructure. Our commercial and government transition vision is to integrate our improved solution with market leading IDS software and provide comprehensive services supporting these infrastructure applications.