Digital Twin for Cybersecurity of Operational Technology (OT) Systems

OUSD (R&E) CRITICAL TECHNOLOGY AREA(S): Integrated Sensing and Cyber The technology within this topic is restricted under the International Traffic in Arms Regulation (ITAR), 22 CFR Parts 120-130, which controls the export and import of defense-related material and services, including export of sensitive technical data, or the Export Administration Regulation (EAR), 15 CFR Parts 730-774, which controls dual use items. Offerors must disclose any proposed use of foreign nationals (FNs), their country(ies) of origin, the type of visa or work permit possessed, and the statement of work (SOW) tasks intended for accomplishment by the FN(s) in accordance with the Announcement. Offerors are advised foreign nationals proposed to perform on this topic may be restricted due to the technical data under US Export Control Laws. OBJECTIVE: The Defense Logistics Agency (DLA) is seeking a SBIR Phase I Proof of Concept regarding building a Digital Twin (DT) of a small manufacturing system (OT). By using large sets of synthetic data on potential cyberattack vectors allowing DLA to identify cyberattacks in the intrusion detection layer before the attack enters the OT system. The proof of concept should identify the risks and opportunities to counter these attacks. The objective is to define, develop, and create a digital twin that would differentiate the digital signature and anomalies of various cyber-attacks. DESCRIPTION: As part of DLA's strategic strategy one primary is the focus efforts to ensure the agency's network, systems, and data are protected from emerging and complex cyber threats. 2A significant shift in how operational technologies (OT) are viewed, evaluated, and secured is needed to prevent malicious cyber actors (MCA) from executing successful, and potentially damaging, cyber effects. DLA is working to lead the charge in protecting OT systems from harmful and destructive cyber infiltrations. DLA's goal is to create a cyber digital twin for OT systems that will increase awareness, and protect against known and unknown vulnerabilities. PHASE I: The successful proposal should include best-practices, as well as innovative, and novel technologies to depict the physical and digital systems within a specific OT environment. This Phase of the project should be: 1. Manage continual input from the physical system to the Digital Twin (DT). Ideally to look for a low cost and automated data flow using AWS/GCP cloud infrastructure. 2. The protection of digital signatures and inferences imbedded in the algorithms from cyberattacks. 3. Scale the algorithm for other OT systems. 4. Verify the performance of the digital twin through correlation between its predictions and the physical system events for given initial and progressing conditions. If a combination of synthetic and real data is used, what are the controllable parameters to calibrate the digital twin models and the corresponding machine learning models to use their predictions and drive actions on real-world system? PHASE II: Develop a prototype for the process(es) proven in Phase I that can be transferred to a DLA production environment. 1. Refine the Transition Plan. 2. At the completion of this Phase II project, the Technology Readiness Level (TRL) should be TRL 3-6. PHASE III DUAL USE APPLICATIONS: At this point, no specific funding is associated with Phase III. Progress made in PHASE I and PHASE II should result in a functional product that could transition into other areas. COMMERCIALIZATION: The partners identified in the Phase II transition plan should be aware of as well as involved in the project and have a plan to incorporate the project into their program of record, or commercial portfolio. REFERENCES: 1. Source: extension://efaidnbmnnnibpcajpcglclefindmkaj/https://www.dla.mil/Portals/104/Documents/Headquarters/StrategicPlan/DLAStrategicPlan2021-2026.pdf 2. Source: extension://efaidnbmnnnibpcajpcglclefindmkaj/https://media.defense.gov/2021/Apr/29/2002630479/-1/-1/1/CSA_STOP-MCA-AGAINST-OT_UOO13672321.PDF KEYWORDS: Digital twin, operational technology, cybersecurity, cyberattack, synthetic data.