(4) Advanced Threat Detection and Analysis Using Multi-Dimensional ML for Industrial Control Systems (ICS)

The goal of this SBIR is to develop an innovative software product called Cynalytics™ that uses ML for real-time cyber threat detection in industrial control systems (ICS), including Supervisory Control and Data Acquisition (SCADA) and Distributed Control Systems (DCS).  During Phase I, we developed a multi-dimensional ML model for threat detection with test data generated from a real ICS lab and achieved excellent detection results.  In addition, we established a set of quantitative threat evaluation metrics and related indicators for cyber risk and resilience assessment.  Based on Phase I prototyping results, our Phase II R&D will focus on optimizing the ML detection performance with enhanced metrics, conducting extensive tests (simulated and on-stage adversarial attacks) in a physical ICS testbed, and developing Cynalytics into a full-fledged, web-based product with real-time data ingestion and anomaly detection capabilities.  We plan to conduct extensive product tests in both simulated and real physical ICS environment to ensure product robustness and transition readiness. This SBIR will help fill an important technology gap in applying machine learning (ML) to Industrial Control Systems (ICS) cybersecurity since naval systems (e.g. navigation, control, electrical/hydraulic power, etc.) and Defense/Weapon Systems (e.g. missiles, sensors, and power) are special types of ICS that require extreme security protections from malicious cyber actors.  A successful delivery of Cynalytics will help enhance the DON CYBESAFE programs for ICS, and ensure a potential program adoption and field test in Phase III for the accelerated transition of this SBIR technology to the DON/DOD operational environment.