The Johns Hopkins Applied Physics Laboratory has introduced a new framework aimed at unifying cybersecurity alerts across systems that safeguard vital infrastructure.
The innovation, known as Behavioral Alerting Sets for Control Systems, or BAS/CS, is already being utilized by military operators to streamline threat response and bolster defenses for critical systems such as power grids, water systems and natural gas networks, Johns Hopkins APL said Tuesday.
BAS/CS Standardizes Cyber Alerts
The BAS/CS framework, developed by APL researchers Alex Beall and Harley Parkes, standardizes cybersecurity alerts by assigning each flagged event a common identification number compatible across different systems and vendors.
These events are then analyzed using predefined correlation rules. An alert is triggered if specific patterns occur within a set timeframe—such as a remote login followed by suspicious activity. The detection logic and alert language are standardized, ensuring consistent and efficient threat response across control systems.
Real-Time Cyberthreat Detection
BAS/CS integrates with existing security information and event management platforms at no cost, allowing operators to respond to threats in real time. The framework’s uniform language and detection logic reduce confusion caused by varied sensor outputs and naming conventions.
Development Rooted in MOSAICS Program
BAS/CS evolved from APL’s More Situational Awareness for Industrial Control Systems, or MOSAICS, initiative. The team introduced standardized ID tags to identify sensor events based on known cyberattack tactics. BAS/CS refined this approach through iterative mapping, expert validation and adversarial testing, using diverse cyber defense tools to improve event correlations and alert accuracy.
