ResilMesh: Situation Aware enabled Cyber Resilience for Dispersed, Heterogenous Cyber Systems

ResilMesh将开发基于网络态势感知的安全管理和分析平台架构（SOAPA）工具集，通过实现以下目标来提高数字基础设施的弹性：1：提高分散数字基础设施中的端到端数据聚合和安全控制互操作性2：让CSIRT更好地了解其网络的服务和资产依赖性3：帮助CSIRT建立网络弹性能力4：开发基于人工智能的算法和工具，用于早期和持续的攻击检测和预测5：开发态势评估系统，以查看和预测网络级别的风险这些目标通过10个工作包项目计划实现。ResilMesh将通过将联盟参与者的现有安全控制和其他工具与现成的开源元素相结合来构建SOAPA平台。它将在项目中开发算法和软件工具，并将这些与平台集成，形成一个完整的SOAPA系统。它将通过三个不同基础设施类别（即可再生能源SCADA;智能制造机器人和区域民用基础设施）的用例和五个开放调用用例来验证ResilMesh系统的运行。这8个试点项目将确保该平台在广泛的关键基础设施中得到评估。ReilMesh开发基于AI的算法，以改善端点和网络流量的攻击检测和预测;它通过提供工具帮助CSIRT处理数字基础设施的复杂性和异构性，使他们更好地了解环境依赖性，威胁和风险，同时保护隐私。它提高了共享威胁情报的可靠性和粒度，以改善威胁搜索和网络取证事件响应的环境，从而实现更稳健的决策。最后，它提供了一套最佳实践，以建立网络能力，提高弹性准备。

ResilMesh will develop a cybersituational awareness based Security Orchestration and Analytics Platform Architecture (SOAPA) toolset to improve digital infrastructure resilience through fulfilling these objectives: 1: Improving end-to-end data aggregation and security control interoperability in dispersed digital infrastructures 2: Giving CSIRTs better awareness of the service and asset dependencies of their network 3: Helping CSIRTs to build cyber resilience capacity 4:Developing AI based algorithms and tools for early and ongoing attack detection and prediction 5:Developing a situation assessment system to view and forecast network level risk These objectives are achieved through a 10 work package project plan. ResilMesh will build a SOAPA platform by combining existing security controls and other tools from consortium participant with readily available open source elements. It will develop algorithms and software tools in the project and will integrate these with the platform to form a complete SOAPA system. It will validate the operation of the ResilMesh system through use cases in three different infrastructure categories (i.e. renewable energy SCADA; smart manufacturing robotics and regional civil infrastructure) and five open call use cases. These 8 pilots will ensure that the platform is evaluated across a wide range of critical infrastructures. ReilMesh develops AI based algorithms to improve attack detection and prediction for endpoint and network traffic; it help CSIRTs deal digital infrastructure complexity and heterogeneity by providing tools to give them better awareness of environment dependencies, threats and risk while preserving privacy. It increases the reliability and granularity of shared threat intelligence to improve context for threat hunting and cyber forensics incident response leading to more robust decision making. Finally it provides a suite of best practices to build cyber capacity to improve resilience preparation.