ResilMesh: Situation Aware enabled Cyber Resilience for Dispersed, Heterogenous Cyber Systems

ResilMesh：态势感知为分散的异构网络系统提供网络弹性

• 批准号: 10079399
• 金额: $ 31.57万
• 依托单位: ROYAL HOLLOWAY UNIV OF LONDON
• 依托单位国家: 英国
• 项目类别: EU-Funded
• 财政年份: 2023
• 资助国家: 英国
• 起止时间: 2023 至 无数据
• 项目状态: 未结题
• 来源: https://gtr.ukri.org/projects?ref=10079399
• 关键词: ResilMesh; Situation; Aware; enabled; Cyber

ResilMesh will develop a cybersituational awareness based Security Orchestration and Analytics Platform Architecture (SOAPA) toolset to improve digital infrastructure resilience through fulfilling these objectives: 1: Improving end-to-end data aggregation and security control interoperability in dispersed digital infrastructures 2: Giving CSIRTs better awareness of the service and asset dependencies of their network 3: Helping CSIRTs to build cyber resilience capacity 4:Developing AI based algorithms and tools for early and ongoing attack detection and prediction 5:Developing a situation assessment system to view and forecast network level risk These objectives are achieved through a 10 work package project plan. ResilMesh will build a SOAPA platform by combining existing security controls and other tools from consortium participant with readily available open source elements. It will develop algorithms and software tools in the project and will integrate these with the platform to form a complete SOAPA system. It will validate the operation of the ResilMesh system through use cases in three different infrastructure categories (i.e. renewable energy SCADA; smart manufacturing robotics and regional civil infrastructure) and five open call use cases. These 8 pilots will ensure that the platform is evaluated across a wide range of critical infrastructures. ReilMesh develops AI based algorithms to improve attack detection and prediction for endpoint and network traffic; it help CSIRTs deal digital infrastructure complexity and heterogeneity by providing tools to give them better awareness of environment dependencies, threats and risk while preserving privacy. It increases the reliability and granularity of shared threat intelligence to improve context for threat hunting and cyber forensics incident response leading to more robust decision making. Finally it provides a suite of best practices to build cyber capacity to improve resilience preparation.

ResilMesh 将开发基于网络态势感知的安全编排和分析平台架构 (SOAPA) 工具集，通过实现以下目标来提高数字基础设施的弹性： 1：改善分散数字基础设施中的端到端数据聚合和安全控制互操作性 2：为 CSIRT 提供更好的服务了解网络的服务和资产依赖性 3：帮助 CSIRT 建立网络弹性能力 4：开发基于人工智能的算法和工具，以进行早期和持续的攻击检测和预测5：开发态势评估系统来查看和预测网络级风险 这些目标是通过 10 个工作包项目计划来实现的。 ResilMesh 将通过将联盟参与者的现有安全控制和其他工具与现成的开源元素相结合来构建 SOAPA 平台。项目中将开发算法和软件工具，并将其与平台集成，形成完整的SOAPA系统。它将通过三个不同基础设施类别（即可再生能源 SCADA、智能制造机器人和区域民用基础设施）的用例和五个公开征集用例来验证 ResilMesh 系统的运行。这 8 个试点将确保该平台在广泛的关键基础设施上得到评估。 ReilMesh 开发基于人工智能的算法，以改进端点和网络流量的攻击检测和预测；它通过提供工具帮助 CSIRT 处理数字基础设施的复杂性和异构性，让他们更好地了解环境依赖性、威胁和风险，同时保护隐私。它提高了共享威胁情报的可靠性和粒度，以改善威胁搜寻和网络取证事件响应的环境，从而做出更稳健的决策。最后，它提供了一套构建网络能力以提高弹性准备的最佳实践。