cyberattacks. Cyberattacks focusing on business logic are especially problematic in that these attacks are specific and unique to each application. Arguably, the best place to detect these attacks is within applications. For example, cyberattacks often probe applications repeatedly using correct, well-formed messages to uncover vulnerabilities.

Most likely, this behavior will go undetected at the upper layers of the security model since the messages are, in fact, correct. In this case, the application is best able to recognize that the activity associated with this message is suspicious and symptomatic of a potential in-water UUV cyberattack.

 

The National Institute of Standards and Technology (NIST) framework identifies a core set of functions (i.e., identify, protect, detect, respond, and recover) that aid in the management of cybersecurity risk to systems, assets, data, and capabilities. This topic focuses on the management of cybersecurity risk with respect to this framework and further focuses on cybersecurity approaches/solutions that do not require modification of the design or code of existing applications but provide real-time detection, prevention, and recovery from cyberattacks on standard operating systems (Windows/Linux) and Real Time Operating Systems (RTOS). The proposed approach should provide tailored solutions that are based on industry standards and security best practices; be operating system agnostic; minimally impact hardware and software system resource utilization during UUV operations; be easy to integrate into existing environments and infrastructure; and be reliable and not require changes to existing application software residing on the unmanned system. The approach should have the ability to support long duration unattended operations over 180 days. The approach should be able to operate on existing hardware such as Commercial-Off the Shelf (COTS) embedded controllers.

 

Furthermore, the proposed approach should use open source solutions to the greatest extent possible. Ideally, the approach should be demonstrated on UUVs to show the ability to detect attacks that exploit previous unknown weaknesses or vulnerabilities such as zero-day exploits.

 

The approach should provide an initial concept design and model key elements of a cyberattack defense concept for UUVs that can autonomously detect, thwart, and recover from a cyber-quarantine attack. Applications need to be active participants in multilayered security architecture to protect critical systems resources, namely data. The approach should provide an Automated Protocol Translator tool capable of auto generating code required for enforcing cybersecurity rules on UUV sensors. Additionally, the proposed solutions should be able to demonstrate enhanced system resiliency by ensuring applications are cyber-aware and have the ability to identify, protect, detect, respond to vectors independent of access to external communication channels, perform modeling, and recover from cyberattacks, thereby mitigating their impact on the system infrastructure.

 

The Phase II effort will likely require secure access, and NAVSEA will process the DD254 to support the contractor for personnel and facility certification for secure access. The Phase I effort will not require access to classified information. If need be, data of the same level of complexity as secured data will be provided to support Phase I work.

 

Work produced in Phase II may become classified. Note: The prospective contractor(s) must be U.S. Owned and Operated with no Foreign Influence as defined by DoD 5220.22-M, National Industrial Security Program Operating Manual, unless acceptable mitigating procedures can and have been be implemented and approved by the Defense Security Service (DSS). The selected contractor and/or subcontractor must be able to acquire and maintain a secret level facility and Personnel Security Clearances, in order to perform on advanced phases of this contract as set forth by DSS and NAVSEA in order to gain access to classified information pertaining to the national defense of the United States and its allies; this will be an inherent requirement. The selected company will be required to safeguard classified material IAW DoD 5220.22-M during the advance phases of this contract.

 

PHASE I: Develop a concept to support cyber-aware applications for use in Navy UUV systems that require the ability to support unattended operations over 180 days and meet the requirements described in the Description. Demonstrate the feasibility of the concept by generating and documenting the top-level design of software components associated with the proposed solution. Describe the test approach to be used to demonstrate that the proposed solution identifies a zero-day cyber-attack and develops metrics to be collected during these tests that quantify the efficacy of the proposed approach. Develop a Phase II plan. The Phase I Option, if exercised, will include the detailed design to support the development and test of the prototype solution in Phase II.