Excellence in Research: Cyber Threats Early Warning Framework for Operational Technology Systems

The cyber community is experiencing an imminent shift in cyber-attacks from traditional Information Technology (IT) infrastructures that run business systems to the Operational Technology (OT) infrastructures that control industrial operations. A hasty reaction to this change in the cyber threat landscape has been reusing existing cyber security solutions commonly applied to the IT domain.

This is not a robust long-term solution. IT and OT systems are intrinsically different; hence, their attack surfaces and vectors can also be different. Moreover, the cyber community needs to broaden its knowledge about the malicious techniques and methods used by attackers to target OT infrastructures.

Accordingly, this project investigates a cyber threats early warning framework for operational technology environments.

The project’s outcomes will advance the science of securing operational technology systems and inspiring attack-resilient designs and deployments for such environments. It introduces intelligent-interaction decoys to mimic temporal and spatial characteristics and behavior of heterogeneous operational technology systems. The project also investigates the feasibility of a deep programmable, open, and software-defined infrastructure to facilitate fast, adaptive, and intelligent-assisted attack collection, characterization, and detection/prediction.

The proposed framework runs on off-the-shelf commodity servers on the edge of OT domains while its performance and throughput scale exponentially with increased computational power.

This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.