SBIR Phase I: A Game-Theoretic Technology for Protecting ICS against Cyber-Attacks

这个小企业创新研究（SBIR）第一阶段项目的更广泛影响将是推进工业控制系统（ICS）的网络防御状态，这些系统广泛部署在制造业、医疗保健和公用事业等各个部门。该项目将开发安全云服务，提供网络攻击和异常行为的早期检测。确保ICS的安全将有助于保证其正常运行，从而保护人类生命和设备，节约资源和材料。这直接有利于社会，并通过开发值得信赖和有弹性的控制系统确保美国的经济竞争力。这项小企业创新研究（SBIR）第一阶段项目将开发一种技术解决方案，提供旨在接管工业控制系统（ICS）的网络攻击的早期检测。使用人工智能和机器学习（AI/ML）技术的网络攻击的兴起对这些系统构成了重大威胁。该解决方案由(1)一个可扩展和全面的检查块库组成，该库使用机器学习、统计学、控制理论和时间序列分析等最先进的方法在运行时检查信号；(2)基于ai的防御代理，在运行时动态地对各种信号应用精心选择的检查子集；(3)实现防御代理的云服务。预期结果包括博弈论模型、近似方法和强化学习算法，这些算法集成在云服务中，从而产生有效的网络防御策略。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

The broader impact of this Small Business Innovation Research (SBIR) Phase I project will be to advance the state of cyber defense in Industrial Control Systems (ICS) that are widely deployed in various sectors such as manufacturing, healthcare, and utilities. This project will develop security cloud services that provide early detection of cyber-attacks and anomalous behaviors. Securing ICS will help guarantee their proper operation and consequently protect human life and equipment as well as conserve resources and materials. This directly benefits society and ensures economic competitiveness of the US through the development of trustworthy and resilient control systems. This Small Business Innovation Research (SBIR) Phase I project will develop a technology solution that provides early detection of cyber-attacks that aim to take over Industrial Control Systems (ICS). The rise of cyber-attacks that use Artificial Intelligence and Machine Learning (AI/ML) techniques poses significant threats to such systems. The solution is composed of (1) an extensible and comprehensive library of check blocks that inspect signals at run-time using state-of-the-art methods from machine learning, statistics, control theory, and time-series analysis; (2) an AI-based defense agent that dynamically applies well-chosen subsets of checks to various signals at run-time; and (3) a cloud service that implements the defense agent. The expected results include game-theoretic models, approximation methods, and reinforcement learning algorithms incorporated in a cloud service that results in effective cyber defense strategies.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.