Real-time Situational Awareness for Critical Infrastructure Protection

Industrial Control Systems (ICS) must provide mission assurance for critical infrastructures by providing real-time situational awareness of cyber attacks directed against energy systems. Operators need to understand the progress, extent and severity of a cyber intrusion as it unfolds. Only if utility operators are provided with a way to understand how their systems are being attacked and what is being affected can they have the ability to react quickly, correctly and in real-time. Our proposed approach addresses these goals through cyber sensors and policy agents that interpret low-level cyber events and translates them into higher-level and semantically richer ones through policies. The events and modeling can ultimately provide both an explanation of the attack and suggestions for remediation.