Representation
How security signals are encoded and modeled.
R&D · Cybersecurity DNA ML Technome
CDMLT: the AI cybersecurity engine built for critical infrastructure
Most AI security tools were built for enterprise IT. CDMLT was built for the environments where a false alarm shuts down a grid and a missed detection puts infrastructure at risk.
The problem
Why conventional cybersecurity AI fails in OT and energy environments
Operational technology environments, including EV charging networks, industrial control systems and power grids, generate fundamentally different data than enterprise IT. SCADA telemetry, OCPP transaction logs and device topology graphs require different detection logic, different threat models and different tolerance for false positives.
Existing AI security platforms apply general-purpose models to these environments and hope for the best. The result is either alert fatigue from excessive false positives, or coverage gaps from models never designed for the data they process. Neither is acceptable when the asset being protected is critical infrastructure.
The deeper problem is how these systems are built: through trial and error, stacking algorithms without a principled understanding of whether they are compatible or how they fail together. CDMLT eliminates that guesswork.
The innovation
Composable AI security, principled by design
CDMLT assembles machine-learning algorithms the way biological organisms assemble genetic building blocks: each component is validated as mathematically compatible with the others before any combination is attempted. Every deployment selects from six gene families.
Optimization
How models learn and adapt to new threat patterns.
Uncertainty
How confidence is calibrated so every alert carries a reliability score.
Learning signal
How labeled and unlabeled data are combined for maximum coverage.
Operational
How models stay accurate as infrastructure evolves.
Robustness
How the system resists adversarial manipulation and poisoning attempts.
The composition rules engine. Before any two gene families are combined, CDMLT validates their compatibility, checking inductive bias alignment, loss function interaction and output space consistency. Incompatible combinations are rejected before they are built, not after they fail in production. Every algorithm selection is documented, every design decision is traceable, and every output carries calibrated uncertainty bounds.
EVSE and ICS use case
Purpose-built for EVSE and industrial control system security
Electric vehicle supply equipment and industrial control systems are the OT environments expanding fastest, under the most active threat, with the least mature AI security coverage. For EVSE networks, CDMLT composes three complementary detection channels.
Tree-based classifier
Detects authentication anomalies, protocol violations and abnormal session patterns in OCPP transaction logs.
Temporal convolutional network
Finds slow-burn drift, coordinated timing attacks and unusual power delivery patterns in charger time-series.
Graph neural network
Detects cross-device coordination, lateral movement between chargers and grid interaction anomalies.
Why calibration matters
The three channels are calibrated with conformal prediction, a rigorous statistical method that produces coverage-guaranteed confidence intervals rather than bare probability scores. False-positive rates are bounded, not hoped for.
A detection system that cries wolf shuts down operations, and one with uncalibrated scores can't be trusted. For ICS environments, the same methodology applies to SCADA telemetry, PLC communication logs and control network topology, adapted through CDMLT's domain-specific gene variant library rather than a ground-up rebuild.
PQC integration
Post-quantum cryptographic governance, native not bolt-on
AI models are high-value targets: training data can be poisoned, model artifacts tampered with and audit trails manipulated.
CAPS
The Cryptographic Algorithm Provenance Schema assigns post-quantum primitives to each gene family component when the model is composed.
Signed at every step
Training data snapshots, feature store versions, model artifacts and evaluation reports are signed with lattice-based signature algorithms.
Gated deployment
Every deployment is verified against the complete cryptographic chain before a model enters production.
Tamper-evident inference
Every inference is backed by a tamper-evident audit record, protecting the AI doing the monitoring as well as the infrastructure.
Differentiators
How CDMLT is different
| Capability | CDMLT | Conventional AI security tools |
|---|---|---|
| Algorithm selection | Formal compatibility validation before composition | Trial and error, intuition or black-box AutoML |
| Alert confidence | Statistically calibrated confidence bounds | Uncalibrated probability scores |
| Decision auditability | Gene-level decision lineage, documented and signed | Black-box outputs, limited explainability |
| Adversarial integrity | Robustness gene with composition-boundary scoring | Post-hoc testing, if any |
| Cryptographic governance | PQC-native schema enforced at composition time | External signing at deployment, if at all |
| Domain specificity | Cybersecurity-specific gene taxonomy and constraint rules | General-purpose models adapted for security |
Who it's for
Built for organizations that can't afford to get it wrong
Operators and developers in environments where security decisions have direct physical and operational consequences.
Utilities and EVSE owners
Managing charging infrastructure under NEVI and DOE security requirements.
ICS operators
Energy, water and manufacturing teams that need OT-native threat detection.
Federal agencies and labs
Developing or procuring AI-driven cybersecurity for critical infrastructure.
Security platform developers
Building for regulated industries and needing a composable, auditable AI backbone.
Compliance and governance teams
Navigating the NIST AI RMF, NIST SP 800-82 and the post-quantum cryptography transition.
Research foundation
Grounded in peer-reviewed science
CDMLT is not a proprietary black box. It is an engineering methodology built on a documented theoretical foundation: the I-Con unified machine learning theory (Alshammari et al., ICLR 2025), which showed that classical ML algorithms share mathematical properties that govern whether they can be productively combined. CDMLT's cybersecurity-specific gene taxonomy extends that framework into operational technology.
HCISS is developing the CDMLT technical specification as an academic paper co-authored with researchers at Chaminade University of Honolulu, targeting arXiv publication, in active engagement with Argonne National Laboratory's EVSE security research program.
FAQ
About CDMLT
What does CDMLT stand for?
CDMLT stands for Cybersecurity DNA Machine Learning Technome, a composable AI cybersecurity framework that assembles machine-learning "gene families" only after validating their compatibility.
What environments is CDMLT designed for?
CDMLT's primary deployment context is electric vehicle supply equipment (EVSE) and industrial control systems (ICS), including OCPP transaction logs, charger telemetry, SCADA data and network topology.
How does CDMLT reduce false positives?
Its uncertainty gene family uses conformal prediction to produce coverage-guaranteed confidence intervals, so false-positive rates are statistically bounded and every alert carries a confidence level an operator can act on.
Is CDMLT available today?
CDMLT is in active development. HCISS is engaging with DOE-funded research programs, critical infrastructure operators and federal agencies to pilot the framework in real EVSE and ICS environments.
Work With HCISS
If your organization is deploying or securing EV charging infrastructure, industrial control systems or AI-powered security tools, and needs detection results you can defend technically, operationally and regulatorily, we want to talk.