Risk Alleviation via Detection of Information Anomalies in Network Cybersecurity Events (RADIANCE)

Cybersecurity of a transit agency’s interconnected information network is critical to the agency’s operation and maintenance. The FTA is concerned about the emergence of new vulnerable points in transit information network systems, such as battery electric bus charging infrastructure, agency webpage/login pages, database management, information technology systems, etc., caused by the increasing agility, overwhelming number, and capability of cyber threat actors. Safeguarding these vulnerable network points against an ever-evolving spectrum of cyber threats is necessary. Numerous Machine Learning (ML) solutions exist for cybersecurity risk assessment in the open literature. Most of these solutions perform poorly with disparate and limited data, which is the case under consideration due to data collected in various formats from real-time operations, customer interface, and information technology of a transit agency and stored for a limited duration. The existing solutions either raise false alarms or fail to detect novel cyber intrusion events. By leveraging a recently concluded research, PEC proposes to develop a novel ML solution called RADIANCE that can effectively tackle disparate data and efficiently detect cyber intrusions from limited information. The proposed solution is data-type agnostic, which will allow it to work with other intrusion detection system groups and jointly form a complete system.