MetaPhortress: A Situational Awareness Platform

Fossil fuel power generation plants risk interruptions of service caused by malicious attacks from insider threats and cybercriminals.Although cyber warfare threatens all sectors of the United States’ critical infrastructure, the energy sector’s reliance on networked industrial control systems renders it particularly vulnerable to cyberattacks; therefore, comprehensive situational awareness of power plant health, operation, and cybersecurity has become critical to keeping the power on.The team is creating an automated situational awareness tool that adapts its proven, patented cyber featureextraction and behavior analysis platform to provide comprehensive, simultaneous coverage of fossil power plant industrial control systems, information technology networks, and physics access control systems.The tool performs data fusion upon networked sensor outputs to characterize nominal operational modes, and then uses data analytics to detect deviations from those modes to determine which anomalous conditions correspond to malicious behavior and alert system operators to emerging cyber incidents.The enabling platform employs a temporal aggregation methodology that models dynamic, emergent threat behaviors and models the behaviors of known threats.The methodology is threat-centric: it categorizes the behavior of network entities, instead of being a standard alert- or alarm-centric approach that classifies individual network incidents without associating them to entities.Aggregated behavior analysis makes the proposed situational awareness tool uniquely adept at discovering malicious entities that attempt multiple vectors across attack surfaces and attacks that unfold over varied timescales.In Phase I, the team researched and characterized the sensor types available in the domain, obtained representative data sets, determined attack surfaces over the range of fossil power plant types, developed power plant health models, mapped power plant network architecture to threat models, determined system integration requirements, and designed a prototype human-machine interface.The team met with numerous industry entities that gave us valuable insight into the sector and specific needs, allowing us to better design the system.The proposed automated tool will ultimately provide situational awareness for the full range of fossil fuel power generation infrastructure.In Phase II, the team will build upon the Phase I efforts by holding a stakeholder forum, collaborating with industry subject matter experts, and developing a single-position prototype for delivery in Phase III.The Phase III effort will add distributed capabilities to the tool that will allow fossil fuel power plant owners and operators to coordinate their detection of area-wide anomalous conditions, obtain the information they need for mitigation, and ultimately share their detected threat behavior information with other facilities.The successful execution of this vision will greatly contribute to the resilience, safety, and reliability of the critical power generation infrastructure of the United States.