Data-Driven Threat Intelligence for Energy and Critical Asset Management

Abstract

Advanced cyber and physical threats are increasingly becoming a target of energy systems and critical infrastructure assets, which are threatening the continuity of its operations, safety and economic stability. Threat intelligence based on data (DTI) has become an essential method of detecting, threatening and preventing these threats on the spot. DTI will allow detecting the anomalies beforehand, assessing risks in advance, and making decisions by combining various sources of data, including industrial control systems (ICS) and SCADA networks with IoT sensors and external threat feeds. Machine learning and artificial intelligence are used as advanced analytics to identify vulnerabilities in time and provide automated response tactics. Despite the data quality, system interoperability, and privacy issues, the DTI implementation can improve the situational awareness, resilience, and protection of key assets within the energy environment, despite the challenges. This paper underscores the need to be systematic in terms of the data-driven approach to threat intelligence and the need to constantly adapt to changing threats.