The FACETS project intends to enhance the monitoring and defense of both legacy and modern power systems through interoperable solutions. It will deliver comprehensive cyber-physical situational awareness (CPSA) across interconnected systems, allowing for a flexible capability that can adapt to emerging needs. FACETS will support grid planning, operation, and response decision-making, thereby improving resilience and security through a defense-in-depth approach. The primary outcome of FACETS is a tool-agnostic and plug-and-play cyber-physical security, operation, automation, and response (SOAR) capability. This system will integrate distributed cyber-physical data, facilitate adaptive detection and response using federated learning, and provide aggregate alerting and visualization for enhanced situational awareness.
The main output of FACETS will be a comprehensive ecosystem that defines necessary capabilities, integration requirements, and secure implementation strategies, along with a cyber-physical integrated security operation center (CP-ISOC) for unified data collection, alerting, and response. The project will leverage various RES-MC capabilities, including:
- griDNA: For distributed data collection and CPSA fusion analysis.
- OT-GRITY: For detecting cyber host execution integrity compromises.
- Hallucinating Canaries (HC): For detecting cyber field device compromises.
- HARMONIE-SPS: For adaptive cyber-physical remedial action schemes.
- STAHRS: For wide-area measurement-based remedial action schemes.
- DRE: For rigorous cyber-physical emulation experimentation.
Figure Vision: Integrated Security Operation Center (SOC)
The FACETS project will focus on five main objectives:
- Architecture: Develop a tool-agnostic architecture using software wrappers and containers for flexible integration and user-friendly interfaces, allowing for seamless deployment across various platforms.
- Federated Learning (FL) Approach: Implement FL to enhance data privacy and enable multi-modal analysis across decentralized devices, integrating results from various detection tools while ensuring transparency through Explainable AI.
- CPSA-focused Correlation and Fusion Analysis: Address challenges in aggregating and fusing diverse data types and time domains from multiple tools to enhance situational awareness.
- Secure Implementation Strategy: Establish a secure data-sharing framework that protects both open and private channels, leveraging technologies like distributed ledger systems and cryptographic services to ensure resilience and confidentiality.
- Testing Approach: Validate the integrated ecosystem against cyber-physical attack scenarios using existing emulation environments and frameworks like MITRE ATT&CK, assessing performance and robustness through uncertainty quantification (UQ) metrics.
This project will result in customizable software that can integrate with any other commercial and/or government off-the-shelf tools, as well as novel CPSA capabilities. Ultimately, FACETS will serve as a foundational capability for a next-generation CP-ISOC, allowing for flexible addition and removal of detection and mitigation tools while enhancing operational and security decision-making across cyber-physical systems.