Physical Optics Corporation — Department of Energy SBIR Phase I: 17a

Description

Power generation plants are increasingly vulnerable to malicious attacks from both from insider threats and cybercriminals. To prevent and mitigate cyber threats, plant operators should be able to recognize whether data from plant sensors, critical components, etc. are compromised. While there have been advancements in automated situational awareness tools for power distribution, no existing security solutions can protect fossil power generation assets. Advanced tools are needed to constantly scan a multitude of sensor data to assess the health of the power plant as well as to recognize malicious behavior and automatically trigger countermeasures to mitigate it. A novel automated situational awareness tool is required to enhance reliability of the fossil power fleet and protect energy systems. This need will be addressed through the proposed novel Data Ingestion, Analysis, and Situational Awareness Tool. Unlike network intrusion detection systems that identify attacks by analyzing network traffic, and unlike existing blockchain-based plant security solutions that are focused on protecting data but not detecting intrusions, the proposed tool innovatively integrates applications of machine learning to recognize malicious behavior by constant analysis of data from sensors with the secure blockchain protocol to transfer data within the network. The tool will use the machine learning algorithms to calculate each sensor’s probability of attack, and artificial intelligence to trigger automatic countermeasures as well as alert plant personnel. A prototype will be implemented to establish a proof-of-concept, demonstrate fetching and analysis of sensor data, and integrate a blockchain-based approach as a security solution. The prototype will implement periodic transfer of sample data into secure, centralized storage. It will also implement an adaptive immune system module that applies machine learning techniques to analyze the data for unusual activities and display the analysis results on a simplified user interface in order to monitor the system state in real time, show alerts, and send manual commands to mitigate detected intrusions.