Cyber-agents for Live Onboard Aviation Network Security (CLOANS) (CLOANS)

ATC-NY will develop the Cyber-agents for Live, Onboard Aviation Network Security (CLOANS) software, a distributed cybersecurity monitoring, reporting, and response system. CLOANS employs portable agents that collect and analyze network activities onboard flight systems in near-real-time, reporting Cyber Threat Intelligence to system operators as well as to the centralized CLOANS Service. The CLOANS Service can be deployed on cloud or on-premises computing infrastructure, where it automatically discovers, manages, and processes reports from CLOANS cyber-agents. The CLOANS Service maintains a Common Operating Picture of aviation networks’ cybersecurity posture and enables personnel at Cyber Security Operations Centers and flight data centers to coordinate threat mitigation strategies and respond in time to thwart attacks. Using CLOANS, aviation staff, security engineers, and operators can improve safety and security through heightened situational awareness. Early alerts and detailed reports reduce the risk and impact from cyberattacks, particularly manipulation and abuse of multicast protocols. ATC-NY will develop the Cyber-agents for Live, Onboard Aviation Network Security (CLOANS) software, a distributed cybersecurity monitoring, reporting, and response system. CLOANS employs portable agents that collect and analyze network activities onboard flight systems in near-real-time, reporting Cyber Threat Intelligence to system operators as well as to the centralized CLOANS Service. The CLOANS Service can be deployed on cloud or on-premises computing infrastructure, where it automatically discovers, manages, and processes reports from CLOANS cyber-agents. The CLOANS Service maintains a Common Operating Picture of aviation networks’ cybersecurity posture and enables personnel at Cyber Security Operations Centers and flight data centers to coordinate threat mitigation strategies and respond in time to thwart attacks. Using CLOANS, aviation staff, security engineers, and operators can improve safety and security through heightened situational awareness. Early alerts and detailed reports enable interrupting cyberattacks, particularly abuse of multicast protocols.

The CLOANS software, as a distributed and extensible in-time network defense system, addresses critical cybersecurity gaps in flight system operations as aircraft, drones, and advanced air mobility vehicles become directly connected to the world. CLOANS cyber-agents operate onboard transportation systems, analyzing live data-plane and control-plane network activities and formally reporting vulnerabilities and threat precursors to flight operators and data centers. CLOANS provides essential cybersecurity and in-time attack interruption capability for legacy aviation network standards, while adding a holistic view of security posture and another factor of safety to future communication systems that meet emerging FAA cybersecurity requirements. CLOANS has application to other classes of vehicles and security assets beyond NAS infrastructure. We envision CLOANS as applicable to networked ground vehicles, SCADA systems, and any security-relevant assets that broadcast or multicast sensitive information, especially those that depend on legacy protocols. Integrity and availability of network services is important to all industries that leverage live information feeds to conduct safe operations, or simply to enhance their operational abilities, such as transportation, logistics, and order-fulfillment industries.

This is a mature technology (TRL 7+) — the realistic path in is usually NASA's Technology Transfer Program: licensing an existing NASA patent, or a Space Act Agreement to use NASA facilities/expertise directly. NASA also runs a startup licensing program with no upfront fee for companies formed to commercialize a specific NASA technology.

None of these are guaranteed paths for this specific project — TechPort itself doesn't have an "apply" button. Reaching out to the contact(s) above with a specific question is usually the fastest way to find out what's actually open.