Nuclear Industrial Control System Simulation (NICSSIM)

The talk starts from the problem that small modular reactors, deployed as distributed energy resources, connect many reactors through digital links and widen the attack surface of nuclear operational technology. The presenters argue that Purdue-model defenses, firewalls and intrusion detection are rigid and cannot reason about a live fleet, and that OT defenders cannot restart services or block traffic freely because of safety concerns.

To address this, they introduce NICSSIM, a containerized testbed built on ICSSIM and Docker. It simulates reactors, PLCs, HMIs and telemetry with no live infrastructure at risk. A supervisory agent routes operator requests to a read-only vulnerability-analysis agent and a remediation agent, and an independent safety auditor reviews findings before they reach the operator. The live demonstration deployed one- and three-reactor fleets, ran a DDoS scenario, and showed blue and red agent roles, with a human approving any patch before it runs.

The evaluation covered response success rate, safety-threshold rejection, ISA/IEC 62443 mapping and latency and cost across seven models from four providers. The reported success rate reached 96 percent. Accuracy fell and latency rose as fleet size grew, and the presenters suggest faster models for routine checks and high-reasoning models for standards validation. Their takeaway is to build safe test environments, measure more than accuracy, and treat the human operator as part of the design.