PROTECT - AI-based firewall for attack detection in the energy sector

Cyberattacks on energy suppliers jeopardise security of supply. As the consortium leader in the PROTECT project, Fraunhofer IOSB-AST is developing an AI-based firewall solution that automatically detects and defends against anomalies in network traffic – in both business IT and process IT.

As operators of critical infrastructure, energy supply companies are increasingly becoming the target of complex cyber-attacks. Whilst traditional firewall systems operate on a rule-based basis and filter out known attack patterns, they reach their limits when faced with novel or deliberately disguised attacks.

Process IT (OT) presents a particular challenge in this regard: the networks used for operational management and control systems are subject to specific protocols and communication patterns that cannot be adequately monitored using conventional IT security solutions.

The PROTECT collaborative project aims to develop AI-based methods for anomaly detection in network traffic at energy suppliers, thereby taking existing firewall solutions to a new level of attack detection. Essentially, the project aims to achieve three improvements over the current state of the art:

• Automated attack detection – Artificial intelligence is used to reliably identify the majority of attacks on business IT and process IT in real time.
• Automated defence – Detected threats trigger dynamic adjustments to the firewall rules, ensuring that defensive measures are implemented without the need for manual intervention.
• Reducing false alarms – The AI-supported processes are designed to significantly reduce the number of false-positive alerts, thereby enhancing the security teams’ ability to respond.

As the consortium leader, Fraunhofer IOSB-AST is responsible for overall scientific coordination and key research activities. Building on the institute’s long-standing expertise at the interface between cyber security and energy systems, IOSB-AST’s contribution focuses in particular on:

• the development and testing of AI-based detection models that are suitable for both IT and OT network traffic,
• the integration of anomaly detection into existing firewall architectures, including automated rule adaptation, as well as
• the validation of the solution under realistic conditions, in close collaboration with our industry partner EAM Netz GmbH. 

This project is funded by the Federal Ministry for Economic Affairs and Energy (funding reference: 03EI6054).

• EAM Netz GmbH (Kassel)
• eoda GmbH
• Hochschule Zittau/Görlitz