Barnstorm Research Corporation — Department of Defense SBIR Phase II: N141-071

Description

Recent technology evelution has turned power grids into complex networks comprised of multiple layers with strong coupling between. Security risks now arise from fragile interactions between the cyber and physical layers. Adversarial cyber attacks can exploit this fragility to cause physical harm. Since we can't stop all intrusions before they damage the infrastructure, it is critical to respond quickly to attacks underway. To facilitate a quick response grid supervisors are to be at all times aware of the state of the grid, and receive ample warning that an event is underway. Difficulties in anomaly detection lead to false alarm rates that can trigger the cry-wolf effect on grid supervisors Instead of setting unrealistic false alarm rate goals for anomaly detectors, FRONDES focuses directly on supervisor situation awareness and on mitigating the cry-wolf effect, even with moderately high rates of false alarms. FRONDES will work in conjunction with an anomaly detector and an anomaly triage engine. For each detection class, FRONDES will develop engaging supervisor workflows devised to blend response to the detection with other on-going supervisory activities. Such workflows will promote engagement, build situational awareness and enhance the supervisor's chances of successfully dealing with true malicious events.