DARPA-SN-25-26.pdf

Special Notice Information Innovation Office

Future Program: Reclaiming Bus-based Systems During Compromise (Red-C)

DARPA-SN-25-26

January 13, 2025

PROGRAM ANNOUNCEMENT

The purpose of this Special Notice is to provide public notification of additional research areas of interest to the Defense Advanced Research Projects Agency (DARPA) Information Innovation Office (I2O), specifically for the forthcoming Reclaiming Bus-based Systems During Compromise (Red-C) program by I2O Program Manager, Bernard McShea.

If released, the Broad Agency Announcement will be made available at https://sam.gov.

PROGRAM BACKGROUND AND OBJECTIVES

Reclaiming Bus-based Systems During Compromise (Red-C) will construct a neighborhood watch for compute components connected via communication highways, known as buses. Red-C will enable on-system recovery from active cyber-attacks on bus-based systems by turning bus components into forensic sensors with introspection and peer component monitoring.

Many of the Department of Defense’s critical systems (e.g., vehicles which typically have engine control modules, power steering modules, etc. and personal computers which typically have memory controllers, graphic processing units, disk controllers, etc.) are bus-based systems of systems with implicitly trusted modular components. Bus-based systems are currently vulnerable to cascading implicit trust attacks (e.g., any door or window gains access to the whole house) and system recovery is hindered by the lack of available forensic information (e.g., we know files have been corrupted, but not their original content).

Red-C envisions a resilient, distributed approach to on-system detection and repair of cyber-attacks implemented on current bus-based hardware via firmware updates – ending the lack of state data and the cascading implicit trust flaw in modern buses. Red-C seeks to explore algorithms to construct self-healing systems, by retrofitting firmware for individual components on a bus to function as forensic sensors that collectively monitor peers to detect, repair, and inoculate on-system during a cyber-attack.

Red-C’s approach to creating self-healing systems has two research focuses: Instrumentation and Response. First, Instrumentation adds a new level of resolution and aggregation to bus monitoring to provide more comprehensive sensing of system behavior. Second, cooperative Responses will be locally generated via a distributed approach to enable timely mitigation, remediation, and inoculation of an attack.

Modern buses provide super-highways, which are crossed multiple times by processes on a system leaving behind ever-growing forensic footprints. State-of-the-art research in instrumenting component firmware achieved 99% detection of ransomware and 92% detection of botnet denial of service attacks while only adding 6% additional component computational overhead.

The collective effect is that Red-C imposes a cost to the attacker for exposing vulnerabilities to the defender, thus penalizing attempts to learn, as trying the door may ensure it is locked next time.

Red-C will focus on Peripheral Component Interconnect Express (PCIe) and Compute Express Link (CXL) buses, addressing the following fundamental research challenges: a) develop fine-resolution https://sam.gov/ sensing via instrumenting a set of critical components to monitor each other cooperatively, leading to powerful forensic capabilities not available today; b) develop distributed algorithms for components to act independently in a range of tasks from attack detection to maximal recovery; and c) demonstrate online bus reclaiming and firmware retrofitting, thus ending the cascading implicit trust flaws in modern buses.

All Red-C research must address the overarching technical challenges of creating robust distributed algorithms with scarce availability of computation and limited bus bandwidth, while contending with the attacker(s) in the defined system during all stages.

TEAMING

DARPA highly encourages teaming prior to proposal submission. To facilitate introductions between potential teaming partners, DARPA will provide resources as outlined below.

1. DARPA will provide a teaming web page on the Proposers Day registration site. Attendees are encouraged to prepare one single slide that contains their contact information (name, organization, email, telephone number, mailing address, and, if applicable, organization website), a brief description of their technical competencies, and, if applicable, their desired expertise from other teams/organizations. A teaming slide template will be available for download from the registration page. Teaming slides are not required for Proposers Day attendance. All teaming slide submissions must be emailed to RedC@DARPA.mil no later than 12:00 p.m. on Jan 23, 2025, for inclusion on the teaming page.

2. Proposers Day participants who attend in-person, may choose to brief their organization’s teaming slide orally for two minutes to the event attendees. Two-minute timeslots will be available on a first come first served basis, should you choose this option. You must communicate your organization’s intent to brief orally in the email submission of your slide. Each organization will only be permitted to brief once during the event and will be limited to no more than two minutes.

Submissions that include Controlled Unclassified Information (CUI), company proprietary information, information regarding any other DARPA-funded work, or more than one slide will not be accepted.

Communications, networking, and team formation are the sole responsibility of the participants. Neither DARPA nor the Department of Defense (DoD) endorses the information and organizations contained on teaming profiles, nor does DARPA or DoD exercise any responsibility for improper dissemination of the teaming profiles.

DARPACONNECT

DARPAConnect offers free resources to potential performers to help them navigate DARPA, including “Understanding DARPA Award Vehicles and Solicitations,” “Making the Most of Proposers Days,” and “Tips for DARPA Proposal Success.” Join DARPAConnect at www.DARPAConnect.us to leverage on-demand learning and networking resources.

mailto:RedC@darpa.mil http://www.darpaconnect.us/

NOTE: This Special Notice does not constitute a formal solicitation for proposals. This notice is issued solely for information and program planning purposes and is not a Request for Information (RFI). Since this is not an RFI, no submissions against this notice will be accepted by DARPA. Interested parties to this notice are cautioned that nothing herein obligates DARPA to issue a solicitation.

NO CLASSIFED INFORMATION SHOULD BE INCLUDED IN ANY COMMUNICATIONS IN

RESPONSE TO THIS SPECIAL NOTICE.