Critical Infrastructure Funded Projects
The Commonwealth Cyber Initiative funded 19 projects for a total of $1.9 million to support critical infrastructure cybersecurity in such crucial industries as transportation, power grids, water, supply chain, manufacturing, Internet of Things (IoT), healthcare, communications networks, and more.
Each project includes researchers from two or more Virginia universities. Funded universities include Christopher Newport University, George Mason University, Old Dominion University, University of Virginia, Virginia Commonwealth University, Virginia Military Institute, and William & Mary.
Transportation Systems Security (Traffic Signals, V2I)
Abstract
Emergency Vehicle Preemption (EVP) systems allow ambulances, fire trucks, and police vehicles to override normal traffic signals, reducing response times and saving lives. However, these systems are increasingly vulnerable to spoofing, denial-of-service (DoS), and other cyberattacks that can block legitimate requests, destabilize traffic networks, and endanger public safety. To address this challenge, Z-TRACS integrates Zero-Trust Architecture (ZTA) with Reinforcement Learning (RL). Zero-trust principles ensure no request is assumed trustworthy; instead, a dynamic RL agent continuously evaluates traffic and signal patterns to detect malicious activity. A high-fidelity digital twin of a multi-intersection Virginia corridor will serve as the testbed, enabling rigorous evaluation of baseline, attack, and ZTA-enabled defense scenarios across both current and connected automated vehicle (CAV) environments.
The project will deliver:
- Open-source RL-ZTA algorithms
- Calibrated simulation datasets
- Digital twin models
- Peer-reviewed publications
- A technical report
- A commercialization white paper for Virginia transportation agencies
These outcomes support VDOT's cyber-resiliency priorities and create pathways for statewide deployment. Z-TRACS also positions the team for larger federal opportunities (NSF SaTC, DHS S&T, DoD MURI, DOE CESER) while strengthening Virginia's leadership in cybersecurity and intelligent transportation.
Project Investigators
- Monty M. Abbas – Virginia Tech, Civil & Environmental Engineering – abbas@vt.edu
- C.T. Lu – Virginia Tech, Computer Science – clu@vt.edu
- Azim Eskandarian – VCU, Engineering (Dean) – eskandariana@vcu.edu
Abstract
Modern transportation increasingly relies on vehicle-to-infrastructure (V2I) connectivity for safety-critical decisions, yet current deployments lack end-to-end security guarantees. Recent incidents reveal a clear escalation path: uplink poisoning distorts infrastructure logic, downlink manipulation induces unsafe maneuvers, and compromises propagate across fleets and infrastructure, triggering cross-network disruption.
This proposal addresses that critical risk by treating V2I security as a verifiable, AI-assisted closed-loop flow and delivering three advances:
- A cyber-physical trust layer that ensures truthful uplinks and safe downlinks.
- AI-informed operations that combine model-health signals with multimodal reasoning to detect semantic attacks on infrastructure.
- Corridor-scale threat containment that limits the blast radius while preserving safety and throughput.
If successful, we will release OpenCIVI, an open cyber-infrastructure with reproducible benchmarks for end-to-end evaluation of attacks and defenses across synchronized simulation and physical testbeds. The outcome will also include a practical, portable defense stack and a shared evaluation backbone for infrastructure providers, co-developed and tested on testbeds at William & Mary (Coastal Virginia) and the University of Virginia (Central Virginia), strengthening V2I cybersecurity and accelerating technology transfer across the Commonwealth with support from the Virginia Transportation Research Council and the Virginia Tech Transportation Institute, and nationally with support from the Transportation Research Board.
Project Investigators
- Sidi Lu – William & Mary – sidi@wm.edu
- Yanfu Zhang – William & Mary – yzhang105@wm.edu
- Madhur Behl – University of Virginia – madhur.behl@virginia.edu
Energy Grid & SCADA Cyber Resilience
Abstract
This one-year project develops an AI-driven malware-detection framework for embedded-Linux SCADA environments that strengthens the cyber-resilience of energy systems. The approach combines a lightweight sandbox for time-controlled experimentation with large-language-model (LLM) reasoning, enabling proactive discovery of stealthy, time-triggered threats.
System-call and network telemetry are fused into joint behavioral profiles, allowing the system to:
- Learn and predict normal operation patterns
- Detect causal deviations
- Adapt to new attack variants through few-shot learning
The expected outcomes include validated tools, benchmark datasets, and reproducible workflows, positioning the team for transition to larger-scale operational and research efforts.
Project Investigators
- Onyeka Emebo – Virginia Tech – onyeka@vt.edu
- Denis Gracanin – Virginia Tech – gracanin@vt.edu
- Geoff Kerr – Virginia Tech, National Security Institute – geoffreykerr@vt.edu
- Mohamed Azab – Virginia Military Institute – azabmm@vmi.edu
- Raveendra B. Ponnuru – Virginia Military Institute – ponnururb@vmi.edu
Abstract
Modern power systems are increasingly digital and interconnected, expanding the cyber attack surface across SCADA/EMS, PMUs, relays/IEDs, DERs, and IT interfaces. False-data injection and multi-stage intrusions threaten stability, situational awareness, and privacy, yet realistic training scenarios for utilities remain scarce and costly to author.
This project develops an AI-driven simulation platform for the distributed energy sector that:
- Uses LLMs to generate diverse, executable cyber exercise scenarios.
- Develops intelligent reinforcement learning–based decision-making agents for adaptive cyber defense.
We enhance grid security by converting scenario scarcity into a renewable, version-controlled resource through generative AI; integrating physics-informed distributed detection with privacy-preserving correlation to reduce false alarms; and advancing intelligent cyber defense via reinforcement learning. Deliverables include an integrated layered simulation platform, high-fidelity cyber infrastructure datasets, and an extensible prototype positioned for follow-on federal funding and commercialization in Virginia.
Project Investigators
- Javad Rafiei Asl – Cybersecurity School, Old Dominion University – jrafieia@odu.edu
- Haibo Zeng – Electrical and Computer Engineering, Virginia Tech – hbzeng@vt.edu
- Yanhai Xiong – Data Science, College of William & Mary – yxiong05@wm.edu
Abstract
Critical infrastructure underpins U.S. national security, economic vitality, and everyday life. The energy sector, particularly microgrids, faces growing cyber threats from nation-state actors and criminal groups. Yet these enterprises rarely have the capacity to staff a security operation center (SOC) 24×7, evaluate their cybersecurity posture, or continuously assess new cybersecurity products. This leaves them vulnerable to sophisticated intrusions that exploit legacy systems, long equipment lifecycles, and intermittent connectivity.
An automated SOC powered by agentic AI can provide these smaller operators with continuous monitoring, anomaly detection, and safety-aware recommendations that approximate the capabilities of large, well-funded fusion centers—helping to protect local communities in Virginia while bolstering the resilience of the U.S. energy sector against adversarial threats.
The goal of this proposal is to design, implement, and evaluate an agentic AI-enabled automated SOC for small and mid-sized critical infrastructure providers, with a specific focus on microgrids. The objectives include:
- Develop an LLM-based SOC by fine-tuning Cisco’s Foundation-Sec model on curated microgrid cyber-physical datasets for domain-specific incident detection and response.
- Design agentic SOC architecture by developing a team of LLM agents for specialized roles such as sensor anomaly detection, OT network monitoring, alerts management, and response.
- Ensure agent security and robustness by evaluating resilience against prompt injection, backdoor triggers, data poisoning, and other LLM-specific attacks.
- Evaluate SOC performance through simulated environments, measuring detection accuracy, false alarm rates, operator trust in AI explanations, and compliance with safety policies.
This proposal addresses the urgent need for scalable, AI-driven defense mechanisms tailored to resource-constrained infrastructure operators.
Project Investigators
- Mohammad Ghasemigol – Old Dominion University – mghasemi@odu.edu
- Yao Wang – Old Dominion University – y9wang@odu.edu
- Daniel Takabi – Old Dominion University – takabi@odu.edu
- Rui Ning – Old Dominion University – rning@cs.odu.edu
- Farideh Doost Mohammadi – Christopher Newport University – farideh.d.mohammadi@cnu.edu
Abstract
The energy sector’s increasing reliance on open-source software exposes critical infrastructure to escalating supply-chain risks. Vulnerabilities in upstream dependencies—widely embedded in LF Energy projects that power grid operations, EV charging, and digital substations—can propagate to downstream energy-critical infrastructure and disrupt essential services. Yet, energy organizations often have limited visibility into upstream software dependencies, with only a small fraction (16%) able to trace or verify the provenance of their components. A recent report found that 45% of cybersecurity incidents in the energy sector originate from third-party vendors, revealing systemic blind spots in the energy software supply chain.
Our proposal, SecureLFE, addresses this challenge by strengthening the security and resilience of the Linux Foundation Energy (LF Energy) open-source ecosystem, widely adopted by global utilities and grid operators. This project will:
- Develop accurate, lifecycle-aware Software Bill of Materials (SBOM) tools aligned with emerging SPDX 3.0 and CISA standards to improve transparency across the energy software supply chain.
- Design a proactive, event-driven multi-agent framework to detect, verify, and remediate vulnerabilities in real time.
By modernizing SBOM toolchains, establishing a federated SBOM registry, and automating vulnerability management through AI-driven agents, SecureLFE will deliver a secure, transparent, and compliant foundation for critical energy infrastructure. The collaboration between William & Mary and Virginia Tech, in partnership with LF Energy, will advance the Commonwealth’s leadership in cybersecurity research and position our team to pursue additional funding opportunities such as NSF Safe-OSE and SaTC.
Project Investigators
- Yue Xiao – William & Mary, Computer Science – yxiao05@wm.edu
- Danfeng (Daphne) Yao – Virginia Tech, Computer Science – danfeng@vt.edu
Water Infrastructure & Smart Utilities Security
Abstract
Critical failures in drinking-water networks can cascade rapidly, as demonstrated by Richmond, Virginia’s six-day water outage in January 2025, when a power failure at the water treatment plant during a winter storm left 230,000 residents under a boil-water advisory. Traditional single-variable monitoring systems fail to capture the subtle, distributed signatures that precede infrastructure failures.
This proposal develops Semi-quantum Restricted Boltzmann Machines (sqRBMs) to address two critical detection challenges:
- Hydraulic fault recognition for burst and leak detection
- Actuator sabotage diagnosis for cyber-physical security
Our approach leverages quantum annealing to overcome the computational bottleneck of classical RBM training, which requires millions of Gibbs samples and prohibitive GPU time for real-time applications. We will integrate one year of Richmond SCADA data with high-fidelity EPANET simulations, training models on quantum annealers and benchmarking against GPU-based RBMs and LSTM autoencoders. Performance metrics include detection delay, false-alert rate, and energy efficiency.
The research promises the first practical quantum advantage demonstration for critical infrastructure security, delivering:
- An open dataset
- A reproducible hybrid software stack
- A validated quantum machine learning framework
Project Investigators
- Thang Dinh – Virginia Commonwealth University (VCU) – tndinh@vcu.edu
- Jayasimha Atulasimha – Virginia Commonwealth University (VCU) – jatulasimha@vcu.edu
- Laura Poe – Longwood University – poelf@longwood.edu
Abstract
The resilience of critical infrastructure—particularly water and wastewater systems—is essential for national security, public health, and economic stability. Yet, existing monitoring approaches rely heavily on centralized processing using relatively high-power communication strategies, introducing latency, increasing energy consumption, and exposing data to cyber risks. This project advances a secure, edge-native Internet of Things (IoT) framework that integrates Neuromorphic Computing, NextG massive connectivity, and adversarial-aware cybersecurity to enable autonomous, ultra-low-power, and resilient infrastructure management.
At the core of our approach is neuromorphic edge intelligence, implemented on Intel’s Loihi-2 platform, which exploits event-driven spiking neural networks to achieve order-of-magnitude energy savings while supporting on-node adaptation through Spike-Timing–Dependent Plasticity. These capabilities allow distributed water-quality sensors to detect contaminants in real time, reducing reliance on costly and vulnerable centralized sampling. Complementing this intelligence, we leverage NextG distributed MIMO networking with federated learning to ensure privacy-preserving, scalable connectivity across hundreds of nodes, even under intermittent or adversarial conditions.
To address emerging threats, we focus on defending against stealthy out-of-distribution–triggered backdoor attacks, which pose unique risks to neuromorphic systems. Building on our recent advances in adversarial AI defense, we will transform the sensitivity of spiking networks into a cybersecurity advantage, enabling proactive detection and mitigation of anomalous behaviors.
Through real-world testbeds deployed in Virginia water systems, our convergent research will establish the foundation for “self-driving” infrastructure: systems that sense, learn, and adapt in real time. Outcomes will advance neuromorphic circuit-algorithm co-design, secure federated learning in massive IoT networks, and resilient cyber-physical architectures, with broad applications across water, energy, transportation, and healthcare domains.
Project Investigators
- Cindy Yang Yi – Virginia Tech – cindy_yangyi@vt.edu (Professor, Electrical and Computer Engineering; Institute for Advanced Computing; MICS Co-Director)
- Peter Vikesland – Virginia Tech – vikesland@vt.edu (Civil and Environmental Engineering; Associate Department Head for Research and Faculty Development)
- Lingjia Liu – Virginia Tech – ljliu@vt.edu (Electrical and Computer Engineering; Co-director of Wireless@VT)
- Lei Yang – George Mason University – lyang29@gmu.edu (Information Sciences and Technology; Center for Secure Information Systems)
ICS/OT Intrusion Detection & Investigation
Abstract
Industrial Control Systems (ICS) underpin essential sectors such as energy, water, and manufacturing but face escalating risks from Advanced Persistent Threats (APTs). Unlike conventional IT attacks, ICS-APTs exploit multi-iteration control loops, traverse IT and OT domains, and hide within trusted channels, making them stealthy and highly disruptive. Current defenses lack the semantic context needed to bridge long-range dependencies and cross-domain causality, causing them to miss critical attack steps.
This project proposes semantics-aware, provenance-based defenses that leverage the reasoning and knowledge capabilities of large language models (LLMs). We will:
- Construct unified provenance graphs linking control-loop traces with key IT/OT events
- Design a scalable, lifelong intrusion detection system combining LLM-enhanced contextual embeddings with graph neural networks
- Develop an LLM-powered investigation agent that collaborates with analysts, executes investigations, and generates concise attack summaries
The outcomes will strengthen the resilience of critical infrastructures against evolving threats, enabling more trustworthy, intelligent, and practical defense of essential national services.
Project Investigators
- PI: Peng Gao – Virginia Tech – penggao@vt.edu
- Co-PI: Yixin Sun – University of Virginia – ys3kz@virginia.edu
Manufacturing & Supply Chain Cybersecurity (SMEs)
Abstract
The Commonwealth of Virginia is home to nearly 5,000 small- and medium-sized critical manufacturing entities, which collectively serve as the backbone of supply chains supporting national defense, transportation, and healthcare. These entities face increasing exposure to cyber-physical threats, including data poisoning, counterfeit components, and system disruptions, that can propagate through supply chains and severely impact production and distribution. Despite their critical role, most lack the resources to implement scalable, state-of-the-art cybersecurity solutions.
To address this national security concern, we propose a scalable AI-driven solution for cyber-physical manufacturing, combining data-driven learning from operational data with knowledge-driven modeling through neurosymbolic methods. Merging these streams unifies statistical inference and symbolic reasoning, enabling agentic AI that uses online prediction, network dynamics, and multi-stage probabilistic reasoning for proactive detection and adaptive mitigation.
Project Investigators
- Shima Mohebbi – George Mason University – smohebbi@gmu.edu
- Milos Manic – Virginia Commonwealth University – mmanic@vcu.edu
- Babak Aslani – George Mason University – baslani@gmu.edu
IoT Device & Firmware Assurance
Abstract
Critical infrastructure increasingly relies on IoT devices for monitoring, control, and automation across sectors, including energy, water, transportation, and manufacturing. These devices often run custom firmware that is difficult to validate, creating significant cybersecurity vulnerabilities. Current firmware verification approaches are labor-intensive and require specialized expertise, making them impractical for the thousands of IoT devices deployed in critical infrastructure.
This project develops the first hardware-aware large language model (LLM) verification framework that ensures IoT firmware correctness, security, and hardware compliance before deployment. Our approach addresses three critical challenges:
- Functional correctness verification to ensure firmware implements intended functionality.
- Comprehensive vulnerability detection to identify security flaws.
- Hardware specification compliance to prevent device malfunctions.
To meet these challenges, the framework introduces a three-level optimization strategy:
- Input-level optimization: prompt refinement, multi-shot examples, retrieval-augmented generation with firmware-specific corpora.
- Representation-level optimization: graph- and semantics-based reasoning across firmware, vulnerabilities, and hardware specifications.
- System-level optimization: selective fine-tuning of LLMs, integration with external scanners and hardware simulators.
This layered design ensures reliability, adaptability, and efficiency across diverse IoT environments. The project will deliver a prototype verification system, open-source datasets for firmware analysis, and evaluation on real-world IoT devices. Success will enable rapid, accurate validation of firmware updates and customizations, reducing the attack surface of critical infrastructure while maintaining operational efficiency.
Project Investigators
- Mahmoud Nazzal – Old Dominion University (ODU), Computer Science – mnazzal@odu.edu
- Khaled Khasawneh – George Mason University (GMU), Electrical and Computer Engineering – kkhasawn@gmu.edu
Abstract
The Secure Hardware Infrastructure for Equipment Lifecycle Diagnostic (SHIELD) project introduces a new hardware–software paradigm for secure, batteryless, and smart equipment monitoring in critical infrastructure industries. SHIELD aligns with the national security focus on chemical and defense industrial sectors and supports the objectives of the Commonwealth Cyber Initiative (CCI).
Current industrial maintenance practices rely on preventive servicing schedules with no real-time intelligence, exposing systems to expensive and potentially dangerous failures. SHIELD proposes predictive maintenance via ultra-low-power wireless sensing using Virtualized Computational RFID (VCRFID) systems that integrate secure sensing, energy harvesting, and edge computation.
Technically, SHIELD introduces three innovations:
- Secure wireless sensor control and computation through reader-centric virtualization of CRFID functionality.
- Integration of Physically Unclonable Functions (PUFs) for authentication and encryption.
- Adiabatic circuit techniques to enable ultra-low-energy operation with intrinsic resistance to side-channel attacks.
The project leverages breakthroughs in high-sensitivity UHF RFID energy harvesting and adiabatic power-clocking directly from RF signals at UHF 915 MHz. The research plan includes VCRFID systems with Rust-based secure reader code, hardware PUF embedding, and obfuscated adiabatic logic design. Collaboration with ExxonMobil and Northrop Grumman will demonstrate predictive maintenance in chemical facilities and defense systems.
By coupling energy-efficient hardware security primitives with scalable IoT architectures, SHIELD supports CCI’s mission to secure the Commonwealth’s cyber-physical infrastructure and contributes to the national goal of trustworthy, low-power, and secure industrial IoT systems. The project will target NSF TTP and Future CoRe programs for additional funding.
Project Investigators
- Mircea R. Stan – University of Virginia (UVA), Electrical and Computer Engineering – mircea@virginia.edu
- Robert Klenke – Virginia Commonwealth University (VCU), Electrical and Computer Engineering – rhklenke@vcu.edu
MultiSensor/Imaging & Facility Safety (DOE/JLab)
Abstract
The proposed project aims to enhance the cyber-resilience and trustworthiness of AI-enabled multi-sensor radiation monitoring systems that safeguard the Continuous Electron Beam Accelerator Facility (CEBAF) at Jefferson Lab (JLab), a world-leading U.S. Department of Energy (DOE) scientific user facility. CEBAF relies on a distributed network of gamma and neutron monitors, beam-loss detectors, current and energy meters, and Hydra-based imaging diagnostics to ensure radiation safety, equipment protection, and experimental continuity.
As artificial intelligence (AI) and machine learning (ML) increasingly drive real-time monitoring and anomaly detection, the integrity of these data streams becomes a critical security concern. Compromised sensor inputs or tampered AI models could suppress alarms, destabilize beam operations, or endanger personnel and infrastructure.
To address these challenges, this project will develop adapter-based defenses and physics-aware AI models that can detect and mitigate cyber threats across multi-sensor and imaging systems. The research will pursue two integrated thrusts:
- Designing parameter-efficient per-sensor adapters that enable rapid, secure few-shot adaptation under evolving conditions.
- Modeling and defending against physics-aware backdoor attacks on JLab’s Hydra imaging system through cross-modal validation and anomaly localization.
These thrusts will form a resilient monitoring framework that embeds physics-informed constraints, adversarial robustness, and reliability-aware fusion into accelerator operations. The outcomes will advance the cybersecurity of critical national infrastructure while producing transferable methodologies applicable to other DOE laboratories and safety-critical AI systems.
Project Investigators
- Jiang Li – Old Dominion University – JLi@odu.edu
- Lusi Li – Old Dominion University – l3li@odu.edu
- Monika Yadav – Old Dominion University – myadav@odu.edu
- Weijun Xiao – Virginia Commonwealth University – wxiao@vcu.edu
Senior Personnel
- Rui Ning – Old Dominion University – rning@odu.edu
Agentic AI Security & AI Infrastructure Hardening
Abstract
Agentic AI systems, powered by large language models (LLMs), are increasingly deployed in mission-critical contexts such as energy, healthcare, transportation, and emergency response. These systems rely on the Model Context Protocol (MCP) to dynamically discover and invoke external tools and resources. While MCP accelerates interoperability, it introduces significant new attack surfaces, including unverified tool servers, malicious adapters, runtime hijacking, and data exfiltration threats.
This project will design and prototype FORTAI, an AI-enabled Zero-Trust Security Framework for MCP-based Agentic AI serving infrastructures. Our approach combines a zero-trust framework with AI-driven anomaly detection and policy synthesis to safeguard AI serving pipelines.
Project Investigators
- Yue Cheng – University of Virginia, Data Science & Computer Science – mrz7dp@virginia.edu
- Songqing Chen – George Mason University, Computer Science – sqchen@gmu.edu
Abstract
Critical infrastructure providers such as municipal utilities and service operators manage heterogeneous and continuously deployed software stacks that incorporate legacy codebases, vendor-locked control systems, undocumented execution behaviors, and opaque supply chains. These constraints—coupled with regulatory uptime requirements and limited ability to re-engineer deployed systems—create a widening attack surface that adversaries increasingly exploit.
We propose Bastion, an AI-driven platform designed to harden and monitor these systems without requiring extensive developer effort or re-engineering. Bastion constructs rich program representations by integrating static and dynamic analysis with microarchitectural profiling, enabling fine-grained reasoning about vulnerabilities and performance constraints across diverse platforms. Leveraging multi-agent LLM frameworks, it enables a wide array of security engineering tasks such as patch synthesis and legacy code migration to safe languages at scale, supported by modular high-assurance verification engines enforcing key functional and security properties.
Through continuous feedback and adversarial refinement, Bastion also enables a robust detection layer to identify anomalous execution, exploit attempts, and logic manipulation at runtime—adapting to emerging threats without imposing substantial operational overhead. This provides a deployable pathway to securing systems that cannot be rapidly replaced and must remain continuously available.
Project Investigators
- Dr. Ashish Venkat – University of Virginia, Computer Science – venkat@virginia.edu
- Dr. Sai Manoj Pudukotai Dinakarrao – George Mason University, Electrical and Computer Engineering – spudukot@gmu.edu
CrossModal SideChannel Security & Anomaly Detection
Abstract
Critical infrastructure systems are increasingly reliant on IoT and cyber-physical devices. Anomalies caused by cyberattacks, device malfunctions, or unsafe user behaviors can escalate into service disruptions, equipment failures, or safety hazards. These risks are especially acute for small cooperatives with limited cybersecurity resources and for municipalities targeted by nation-state actors.
Existing anomaly detection methods, which rely primarily on event logs, struggle with complex automation logic, lack explainability, and adapt poorly to evolving environments. We propose AI-powered, semantics-aware anomaly detection that leverages video and audio side channels to strengthen the cybersecurity of critical infrastructure. Inspired by human vision and hearing, we extract semantic information from visual and acoustic data (e.g., security cameras, speakers) to cross-check device states and detect anomalous behaviors. This enables accurate and adaptive detection of both cyber and physical anomalies.
This project supports CCI’s mission to deliver innovative cybersecurity solutions with tangible benefits for Virginia companies and communities.
Project Investigators
- Lisa Luo – George Mason University – lluo4@gmu.edu
- Liqing Zhang – Virginia Tech – lqzhang@vt.edu
6G / NextGen Network Security (ISAC)
Abstract
This project aims to explore and design novel physical layer (PHY) and data layer mechanisms to secure 6th-generation (6G) infrastructure for emerging Integrated Sensing and Communication (ISAC) functions. ISAC is considered one of the key innovations in 6G mobile networks and is expected to enable a wide variety of vertical applications, ranging from the detection of unmanned aerial vehicles (UAVs) for protecting critical infrastructure and national security to physiological sensing for mobile healthcare.
Despite its significant socioeconomic benefits, ISAC functions introduce new attack surfaces to 6G infrastructure, calling for novel countermeasures. One noticeable security challenge brought by ISAC for 6G is the requirement to secure analog waveforms. Existing data layer security mechanisms adopted in mobile networks are insufficient to defend against analog/wave-domain attacks that can compromise sensing functions while remaining undetectable at the bit or data layer. Furthermore, the need for network-wide collaboration and coordination for many ISAC applications urges new secure and privacy-preserving data-sharing mechanisms that can handle distributed time-series sensing data.
This project will build analytical models, conduct simulations, and evaluate the proposed security mechanisms using UAV detection as a specific use case. It is expected to produce promising preliminary results that lay the foundations for securing 6G infrastructure for ISAC. Broader impact activities include outreach to standardization working groups, NextG Alliance, National Spectrum Consortium (NSC), O-RAN Alliance, and industry partners, as well as sharing knowledge through publications, open-source code, and course material enrichment.
Project Investigators
- Kai Zeng – George Mason University (GMU), Electrical and Computer Engineering – kzeng2@gmu.edu
- Wenjing Lou – Virginia Tech (VT), Computer Science – wjlou@vt.edu
CostEffective, WorkforceAware Cyber Operations (Healthcare focus)
Abstract
Many critical infrastructure providers, ranging from local utilities to hospitals, face persistent budget constraints and a shortage of skilled personnel, making it difficult to adapt to an increasingly complex and evolving cybersecurity threat landscape. Agentic Artificial Intelligence (AI) has emerged as a promising approach to address these challenges. Today, AI agents can perform a wide range of tasks—from analyzing system logs to summarizing vulnerabilities and threat intelligence reports—ultimately providing actionable recommendations.
However, Agentic AI approaches are not flawless. They can make errors and require human oversight for verification, and they rely on human intervention for adaptation. As a result, they cannot yet be directly deployed by critical infrastructure providers without additional safeguards and guardrails.
This proposal outlines the design and implementation of an end-to-end Agentic AI framework for critical infrastructure providers, with a particular focus on the healthcare sector. The framework leverages existing organizational documentation to enable AI agents to automatically construct and maintain comprehensive databases of critical assets. Building upon this foundation, it incorporates advanced threat analysis capabilities, allowing AI agents to ingest and interpret threat intelligence reports and dynamically prioritize response actions. The prioritization process explicitly accounts for operational constraints, including device utilization patterns and system criticality, ensuring recommendations are both contextually grounded and practically actionable.
By reducing the manual demands of asset management and threat triage, the proposed work directly addresses workforce and budgetary constraints while enhancing the overall resilience and security posture of healthcare infrastructure.
Project Investigators
- Murat Kantarcioglu – Virginia Tech – muratk@vt.edu
- Daniel Takabi – Old Dominion University – takabi@odu.edu