FANCY-X: A nuclear power plant network testbed for cross-network cybersecurity evaluation and generalizability

With the proliferation of digital technologies in instrumentation and control systems comes an increased demand for improvements in cybersecurity. Developing strategies for preventing and detecting cyber-attacks is important in safety-critical systems such as those found in nuclear power plants (NPPs). The application of machine learning (ML) to automate cyber-attack detection on operational technology (OT) networks is increasing significantly. To help facilitate the development of ML algorithms for cyber-attack detection, it is necessary to develop testbeds that are representative of the target networks on which the algorithms will be deployed. However, the design of cyber-attack detection methods using data from a specific network testbed can result in models that achieve high performance on that network but do not generalize well to others. The design of cyber-attack detection algorithms for NPP networks that are generalizable across networks is therefore essential to avoid significant performance degradation as well as to minimize disruptive testing on a target physical plant and improve the generalization. To solve this challenge, an NPP cybersecurity testbed called FANCY-X is developed, which is composed of two disjoint networks. One is entirely virtual, while the other is a hybrid network containing both virtual and physical components that emulate an NPP network. Cyber-attack detection cross-network generalizability can be evaluated by training on the virtual network and testing on the hybrid network. A high-fidelity two-loop pressurized water reactor (PWR) simulator is used to represent the underlying NPP, enabling the generation of realistic network activity. The FANCY-X testbed is validated through both same-network and cross-network evaluations.