ResilMesh
Situation Aware Enabled Cyber Resilience for Dispersed, Heterogeneous Cyber Systems
AI-Based Cyber Situational Awareness for Resilient Digital Infrastructures
ResilMesh will develop a cyber situational awareness based Security Orchestration and Analytics Platform Architecture (SOAPA) toolset to improve digital infrastructure resilience through fulfilling these objectives:
- Improving end-to-end data aggregation and security control interoperability in dispersed digital infrastructures.
- Giving CSIRTs better awareness of the service and asset dependencies of their network.
- Helping CSIRTs to build cyber resilience capacity.
- Developing AI-based algorithms and tools for early and ongoing attack detection and prediction.
- Developing a situation assessment system to view and forecast network level risk.
These objectives are achieved through a 10 work package project plan. ResilMesh will build a SOAPA platform by combining existing security controls and other tools from consortium participant with readily available open source elements. It will develop algorithms and software tools in the project and will integrate these with the platform to form a complete SOAPA system. It will validate the operation of the ResilMesh system through use cases in three different infrastructure categories (i.e. renewable energy SCADA; smart manufacturing robotics and regional civil infrastructure) and five open call use cases. These 8 pilots will ensure that the platform is evaluated across a wide range of critical infrastructures. ResilMesh develops AI-based algorithms to improve attack detection and prediction for endpoint and network traffic; it helps CSIRTs deal with digital infrastructure complexity and heterogeneity by providing tools to give them better awareness of environment dependencies, threats and risk while preserving privacy. It increases the reliability and granularity of shared threat intelligence to improve context for threat hunting and cyber forensics incident response leading to more robust decision making. Finally it provides a suite of best practices to build cyber capacity to improve resilience preparation.