Public Funding for Cyberowl Limited

CyberOwl proposes a project to develop a security monitoring system for cyber-physical risks to IT, IIoT and OT systems in the maritime and smart grid sectors. The innovation will provide real-time visibility and cyber-physical risk analytics to the asset operators, alongside an active intervention capability which can produce automated cyber responses based on the threat analysis of the monitoring system. This will fundamentally help shipping and smart grid operators shift from a reactive cybersecurity posture to an active one that prevents cyber attacks from completing before significant losses are sustained.

Connected and Autonomous Vehicles (CAVs) are critically dependent on a range of software components that underpin connectivity and control on the vehicular platform. As such CAVs and associated transport infrastructure are vulnerable to cyber attacks that seek to disrupt and damage operations. A number of recent attacks on CAVs demonstrate the need for a cyber-physical monitoring system that is able to detect for suspicious and potentially threatening activity on cyber and physical components on CAV and associated platforms. Health and usage monitoring systems, alongside telematics and diagnostics interfaces, provide for a rich source of operational and behavioural datasets on such platforms. CyberOwl proposes a cyber-physical early warning system for CAVs and associated infrastructure to provide real-time protective monitoring detecting potential cyber security and functional safety violations. This will have extensions in application to other modes of ground transport including rail and freight and logistics service providers, and associated infrastructure including roadside units (RSUs) (such as gantries) and telecommunication service providers.

Network security monitoring needs an early warning system. Attacks are getting slower, stealthier and more sophisticated. The average detection time of a security breach is lengthening, resulting in the wrong balance of reactive and proactive defence, and driving up the total cost of security and remediation. Existing monitoring tools will simply fail to cope with this. Broadly, the signature- or rule- based tools are very retrospective. This is quickly becoming obsolete, in a world where a specific malware is often only used a small handful of times. By contrast, anomalous behaviour monitoring overwhelms the defender with false positives and struggles to deal with pre-infected environments. There is a need to monitor networks for threat probabilities of indicators associated with early phases of attacks. This is a new approach to network security monitoring. It will shift the advantage back to the defender, by allowing them to “nip attacks in the bud”, before the organisation is exposed to significant costs of data loss. This approach also enables warning of unknown attacks and exploits; a fundamentally different approach to post-incident forensic signature-based methods.