Search NASA⌕ Search

Engineering topics

Pinar, Ali

Publications and source records attributed to Pinar, Ali.

4 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2024

CI-MOR Final Report: Analysis and Validation of Critical Infrastructure Models using Model Order Reduction

This report summarizes the research and capabilities developed as part of the project “Analysis and Validation of Critical Infrastructure Models using Model Order Reduction” (CI-MOR) LDRD project. CI-MOR research enables the solution of large, complex optimization models that naturally arise in national security challenges involving critical infrastructures. Specifically, CI-MOR researchers developed methods to (1) rigorously approximate complex, nonlinear optimization formulations, (2) identify alternative near-optimal solutions, (3) accelerate optimization workflows used for complex applications, and (4) rigorously integrate domain knowledge in stochastic-process models. This report provides an overview of the research done in CI-MOR, and we describe application exemplars used to illustrate CI-MOR capabilities. Furthermore, we describe the software developed by CI-MOR that researchers can leverage to analyze new applications.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Experimental Validation of a Command and Control Traffic Detection Model

Network intrusion detection systems (NIDS) are commonly used to detect malware communications, including command-and-control (C2) traffic from botnets. NIDS performance assessments have been studied for decades, but mathematical modeling has rarely been used to explore NIDS performance. This paper details a mathematical model that describes a NIDS performing packet inspection and its detection of malware's C2 traffic. Here, the paper further describes an emulation testbed and a set of cyber experiments that used the testbed to validate the model. These experiments included a commonly used NIDS (Snort) and traffic with contents from a pervasive malware (Emotet). Results are presented for two scenarios: a nominal scenario and a “stressed” scenario in which the NIDS cannot process all incoming packets. Model and experiment results match well, with model estimates mostly falling within 95 % confidence intervals on the experiment means. Model results were produced 70-3000 times faster than the experimental results. Consequently, the model's predictive capability could potentially be used to support decisions about NIDS configuration and effectiveness that require high confidence results, quantification of uncertainty, and exploration of large parameter spaces. Furthermore, the experiments provide an example for how emulation testbeds can be used to validate cyber models that include stochastic variability.

mathematical model↗