Open Call 1 (Closed)

The Resilmesh project aims to extend the capabilities of the Resilmesh platform by selecting systems actors/innovators (mid-caps, SMEs start-ups, and researchers) that are developing technologies that can extend the capabilities of Resilmesh in the following domains:

1. Extension to new domains and systems, to extend i) the detection capabilities of Resilmesh to new OT domains and/or ii) the interoperability of  Resilmesh third party security controls and tools. Examples include:

• Novel OT/IT Datasets
• Extension of the Asset Management functions through Integration of new device types to ISIM + new applications based on ISIM/CASM.

2. New Analytic Algorithms and Architectures

User and Entity Behaviour Analytics (UEBA) shifts the focus of detection from Indicator of Compromise (IoC) approaches to focus on higher level Indicators of Behaviour (IoB). UEBA can apply to both endpoint and network traffic behaviours. One approach here could be to extend the Resilmesh NDR functional component with network behaviour analytics such as those identified in the Network Traffic Analysis category in the Mitre D3FEND taxonomy (https://d3fend.mitre.org/). UEBA analytics for IIoT/OT infrastructure in particular are of interest.

Novel edge AI AD architectures: The deployment of edge-based AI opens many possibilities for experimenting with different algorithms and architectures, taking into consideration the needs of the domain and the data. Some possible approaches might be:

• User Ensemble methods
• Distributed deep learning
• Incremental learning
• Edge-to-Edge Collaborative Anomaly Detection

3. Stream Processing of Security Events

Data processing pipelines based on platforms such as SPARK, KAFKA Streams, Esper can be used to for many purposes including the processing of security data ‘on the fly’ in real time.

Complex Event Processing (CEP) is a generalisation of traditional stream processing for aggregating, processing, and analysing data streams in order to gain real-time insights from events as they occur.

Stream processing may be facilitated by the use of Integration of a data lakehouse:  A data lakehouse is a centralised storage repository capable of accommodating structured and unstructured data at virtually any scale.

4. Security Operations

This category addresses potential expansion to Resilmesh functional components on the Security Control Plane. The goal is to demonstrate the use of Resilmesh mitigation orchestration and enforcement capabilities in OT domains. Some possibilities include:

• Novel mitigation playbooks for handling response for new attack types. This may require the development accompanying dataset for attack detection.
• Development of novel software actuators tailored for enforcing actions in OT networks and systems, such as for instance,  enablers for controlling SCADA systems
• Enhancement of Resilmesh XDR capabilities through integration with existing EDR (Endpoint Detection and Response) systems to improve the range of attack mitigation and response controls.