(4) Advanced Threat Detection and Analysis using Multi-Dimensional Machine Learning for Industrial Control Systems

Cybersecurity risk assessments practiced today are mostly qualitative in nature and inadequate to address the real-time cyber threat, especially advanced persistent threat (APT) in the enterprise. Cybersecurity operations rely heavily on various security tools running in silos and generating large volumes of security data that are difficult to comprehend and provide little value for actionable decision support. To help maximize the cyber defense agility and responsiveness of Navy platform systems, we propose an innovative software tool called Cynalytics™ that provides enhanced threat identification and risk analysis functions using a multi-dimensional machine learning (ML) model. Based on unsupervised learning techniques, Cynalytics will integrate various IT/OT and platform sensor data for APT detection, and derive quantitative threat severity scores based on anomaly pattern recognition and probability-driven algorithms. Cynalytics will be a web-based, cloud-enabled application capable of ingesting real-time data at different levels and providing actionable, risk-informed decision support, augmenting the Risk Management Framework based CYBERSAFE functions. Our Phase I effort will focus on the ML model design with a quantitative threat evaluation metrics for industrial control systems (ICS), and the development of a prototype with use cases to demonstrate feasibility of the proposed solution with extensibility to Naval/DOD control and weapon systems.