CyBDAT

The Technical Problem

CyBDAT is a tool that allows tactical commanders to compare cyber and kinetic attacks during mission planning. The comparison is based upon multiple criteria. This research includes building a testbed to measure effects of cyber attacks on virtualized cyber-physical systems.

The VCS Solution

In order to gather the data required to have realistic numbers feeding the algorithms for the comparison tool, the VCS team determined the first step in this research, after system design, would be to create a cyber physical system focused range, that is capable of rapidly standing up medium fidelity targets, on which we can rapidly test various offensive and defensive tools and tactics. This range is a product in itself, as we are able to simulate non-x86 processors using native communication protocols (CAN, J1939, etc.) due to our customized solution based on the QEMU hypervisor. A CPS focused range enables simulation of consumer vehicles, with relevant ECUs, that might be controlling the engine, or the brakes, and that are also communicating with the CAN protocol, rather than just standard IP protocol messaging, which most automobiles currently do not do (yet), enabling us to have a much higher level of fidelity on our targets, and to verify by using the exact same attacks on test vehicles in the real world, and on the virtualized targets on the range.

The data being collected on the range for a wide variety of tools, tactics, procedures, will then be fed into our multi-criteria decision algorithms (MCDAs) which will populate a comparison tool which will allow decision makers to compare the probabilities associated with many different things such as confidentiality, attribution, detection, destruction, and over 20 more. It is important that mission planners can compare these things, becasue if all they care about is destruction, they will always choose the kinetic option, but cyber weapons allow for a much wider range of intended effects that one may wish to consider.