Automated VuLnerability Assessment and Risk Mitigation for Future Aviation Systems Safety, ALARM

The integration and digital connection of the future National Airspace System (NAS) with new entrants, such as the Unmanned Aircraft Systems (UAS) and Advanced Air Mobility (AAM), provides more pathways for hackers to attack the networked aircrafts and spacecrafts. In order to maintain cyber safety of this integration, security systems and technologies are required to enable on-board monitoring, detection, assessment, and reporting of abnormal events, suspicious behaviors, and potential threats. NASA is currently developing ground and vehicle based In-Time System-Wide Safety Assurance (ISSA) capabilities to monitor, assess and mitigate safety threats. These capabilities will be integrated into an In-Time Aviation Safety Management System (IASMS) to achieve enhanced system-level safety assessment, such as hazard identification, risk management and control, and safety performance evaluation. However, the state-of-the-art cyber technologies face several challenges when adopting into the NAS, such as limited communication bandwidth, limited onboard processing capability, limited memory, and storage capabilities, as well as lack of meaningful data for deep security analysis and modeling. To address this critical need, University Technical Services, Inc. (UTS) proposes to develop an automated vulnerability assessment and risk mitigation (ALARM) system, to provide real-time cybersecurity vulnerability monitoring, assessment, and mitigation for the future aviation systems safety. The key innovation of this work is the development of real-time aviation systems monitoring, machine learning (ML)-based cyber threat detection, proactive vulnerability assessment and risk analysis, as well as advanced aviation and space cyber threat intelligence (CTI) to support comprehensive security analysis and threat mitigation. The proposed technology, will achieve a breakthrough in the computational efficiency for aviation and space systems cybersecurity assessment and risk analysis.