Excellence in Research: Cyber Threats Early Warning Framework for Operational Technology Systems

网络社区正在经历一场迫在眉睫的网络攻击转变，从运行业务系统的传统信息技术（IT）基础设施转向控制工业运营的运营技术（OT）基础设施。对网络威胁格局的这种变化的仓促反应是重用通常应用于IT领域的现有网络安全解决方案。这不是一个长期的解决方案。IT和OT系统本质上是不同的;因此，它们的攻击面和向量也可能不同。此外，网络社区需要扩大其对攻击者用于攻击OT基础设施的恶意技术和方法的了解。因此，该项目研究了用于操作技术环境的网络威胁预警框架。该项目的成果将推动保护操作技术系统的科学，并激发针对此类环境的攻击弹性设计和部署。它引入智能交互诱饵来模仿异构操作技术系统的时间和空间特征和行为。该项目还研究了深度可编程、开放和软件定义基础设施的可行性，以促进快速、自适应和智能辅助的攻击收集、表征和检测/预测。建议的框架运行在OT域边缘的现成商品服务器上，而其性能和吞吐量随着计算能力的增加而呈指数级增长。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

The cyber community is experiencing an imminent shift in cyber-attacks from traditional Information Technology (IT) infrastructures that run business systems to the Operational Technology (OT) infrastructures that control industrial operations. A hasty reaction to this change in the cyber threat landscape has been reusing existing cyber security solutions commonly applied to the IT domain. This is not a robust long-term solution. IT and OT systems are intrinsically different; hence, their attack surfaces and vectors can also be different. Moreover, the cyber community needs to broaden its knowledge about the malicious techniques and methods used by attackers to target OT infrastructures. Accordingly, this project investigates a cyber threats early warning framework for operational technology environments. The project’s outcomes will advance the science of securing operational technology systems and inspiring attack-resilient designs and deployments for such environments. It introduces intelligent-interaction decoys to mimic temporal and spatial characteristics and behavior of heterogeneous operational technology systems. The project also investigates the feasibility of a deep programmable, open, and software-defined infrastructure to facilitate fast, adaptive, and intelligent-assisted attack collection, characterization, and detection/prediction. The proposed framework runs on off-the-shelf commodity servers on the edge of OT domains while its performance and throughput scale exponentially with increased computational power.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.