The Alan Turing Institute is creating two new tools to help protect the UK’s critical national infrastructure from cyber-attacks as part of its Defence and National Security grand challenge.

The National Cyber Security Centre reported in their latest annual review that cyber threats to the UK are high, with cyber being a “discreet, low-cost, high-impact vector through which threat actors target the UK’s CNI for espionage, ransomware, and disruptive purposes,” the report said.

Stark warnings and high-profile cyber-attacks, such as the fire and power outage in Heathrow substation, have driven research leads at the Turing Institute to develop a new AI-powered antivirus tool for operational technology malware.

The tool, called Smoke and Mirrors, will create virtual OT environments using AI to mimic real systems in an effort to duping malware into revealing its true motivations and behaviour, as the malware would activate itself as it would in a real environment.

Operators of critical national infrastructure could use this tool to check suspicious files without jeopardising real systems, while also allowing them to understand and learn how the malware acts.

The system can isolate malicious or suspicious samples away from important systems, and can also create technical reports explaining how the malware functions, what its targets are, and its motivations.

This not only safely prevents malicious attacks reach critical systems, but can allow operators to learn about malware, identify various system vulnerabilities, understand patterns of attack, and develop better defences.

The Institute is also developing cyber risk benchmarks for critical national infrastructure, driven by AI.

The benchmarks aim to make evaluation frameworks for better comparisons between AI agents, with standardised tasks and performance metrics to test systems against real-life threats.

Recommended reading

• Digitally Upgrading UK CNI Could Bring Billions in Benefits
• UK Gov: Data Centres Are Now Critical National Infrastructure
• NCSC Updates Cyber Assessment Framework for Rising CNI Threats

The Autonomous Cyber Defence Innovation and Research Lab (ACD-IRL) will develop and evaluate Ai agents for offensive and defence cyber tasks.

“A core of our CNI mission is to shift the balance of power towards defenders,” Turing Institute researchers wrote.

“As the threats to UK infrastructure grow in scale and complexity, so too must our responses. By bringing together researchers, government bodies, infrastructure operators and industry partners, we will create a shared space for experimentation and rapid learning.”