SEARCH · Search NASA

Results for “intrusion detection”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 181 records · Page 10

All sources NASA NTRS DOE OSTI

DOE OSTI2020

Detecting Anomalous Computation with RNNs on GPU-Accelerated HPC Machines

This paper presents a workload classification framework that discriminates illicit computation from authorized workloads on GPU-accelerated HPC systems. As such systems become more and more powerful, they are exploited by attackers to run malicious and for-profit programs that typically require extremely high computing ability to be successful. Our classification framework leverages the distinctive signatures between illicit and authorized workloads, and explore machine learning methods to learn the workloads and classify them. The framework uses lightweight, non-intrusive workload profiling to collect model input data, and explores multiple machine learning methods, particularly recurrent neural network (RNN) that is suitable for online anomalous workload detection. Evaluation results on three generations of GPU machines demonstrate that the workload classification framework can tell apart the illicit authorized workloads with a high accuracy of over 95%.

Pengfei, Zou↗

DOE OSTI2021

Rotor blade imbalance fault detection for variable-speed marine current turbines via generator power signal analysis

Marine hydrokinetic (MHK) turbines extract renewable energy from oceanic environments. However, due to the harsh conditions that these turbines operate in, system performance naturally degrades over time. Thus, ensuring efficient condition-based maintenance is imperative towards guaranteeing reliable operation and reduced costs for marine hydrokinetic power. This work proposes a novel framework aimed at identifying and classifying the severity of rotor blade pitch imbalance faults experienced by marine current turbines (MCTs). In the framework, a Continuous Morlet Wavelet Transform (CMWT) is first utilized to acquire the wavelet coefficients encompassed within the 1P frequency range of the turbine's rotor shaft. From these coefficients, several statistical indices are tabulated into a six-dimensional feature space. Next, Principle Component Analysis (PCA) is employed on the resulting feature space for dimensionality reduction, and then the application of a K-Nearest Neighbor (KNN) machine learning algorithm is utilized for fault detection and severity classification. The effectiveness of the proposed framework is validated using a high-fidelity MCT numerical simulation platform, where results demonstrate that the presence of a pitch imbalance fault can be accurately detected 100% of the time and correctly classified based upon severity more than 97% of the time.

42 ENGINEERING↗

DOE OSTI2023

Flexible visualization of a 3rd party Intrusion Prevention (Security) tool: A use case with the ELK stack

A difficult aspect of cyber security is the ability to achieve automated real time intrusion prevention across various sets of systems. To this extent, several companies are offering comprehensive solutions that leverage an "accuracy of scale" and moving much of the intelligence and detection on the Cloud, relying on an ever-growing set of data and analytics to increase decision accuracy. Often, they provide tools to visualize the decision workflows in attack prevention (as well as tune the algorithm) but those solutions are not always practical as companies see the problem as "global" that is, from a unified Cyber-security standpoint. However, a key to a successful Cyber-security program is transparency and trust: from an experimental team viewpoint, this specifically means having the ability to immediately see what and from where, who has been blocked and being able to inform the community in case of a revoked access without the need for filing a "ticket" (that may eventually be answered) – in other words, rapid response to their user-base is essential but solutions targeting "sub-groups" in an organization are not often available. We have come up with a versatile solution leveraging the ELK stack (Elasticsearch, Logstash, & Kibana) and an IPS (Intrusion Prevention System) based WAF (Web Application Firewall) from Signal Sciences. Signal Science allows the streaming of detailed logs in a Logstash format suitable for custom solutions for visualization. By combining these two tools, we have strengthened our security posture and enabled individual experiments to monitor their own traffic. Specifically, the IPS WAF provides unique data such as country of origin, protocol, response code, source IP, and paths accessed. In this contribution, we will show how we engineered a visualization solution so experiment groups could access a dashboard with predefined graphs but also, where they can create individual customizable dashboards used to display blocked traffic and troubleshoot latency issues. We will discuss the details and procedures for developing and configuring these tools and how it benefits cyber security postures across our scientific based environment.

73 NUCLEAR PHYSICS AND RADIATION PHYSICS↗

DOE OSTI2020

Vulnerability Detection Methodology for a Digital Signal Processor Micro-Controller at Edge Level Distributed Energy Resource Controller

Integration of renewable energy and energy storage based Distributed Energy Resource (DER) assets to the grid has seen an upsurge over the past few decades. Traditionally, energy would be generated at a thermal or nuclear power plant and then transmitted over long distance through the transmission grid and then supply to the customers at the distribution grid. Modern renewable energy based DER assets have brought energy production at the edge of distribution grid, which has made the grid vulnerable to cyber intrusion as the power flow controllers for such DER assets are now distributed across the grid from distribution level to transmission level. This paper discusses the vulnerability posed by such power flow controllers of DER assets and demonstrates a detection methodology for unauthorized access and manipulation of system configuration for Digital Signal Processor based Microcontrollers. Experimental results proving efficacy of the methodology have been shown in paper.

Bhowmik, Pankaj↗

DOE OSTI2022

Insights on sources and formation mechanisms of liquid-bearing clouds over MOSAiC examined from a Lagrangian framework

Understanding Arctic stratiform liquid-bearing cloud life cycles and properly representing these life cycles in models is crucial for evaluations of cloud feedbacks as well as the faithfulness of climate projections for this rapidly warming region. Examination of cloud life cycles typically requires analyses of cloud evolution and origins on short time scales, on the order of hours to several days. Measurements from the recent Multidisciplinary drifting Observatory for the Study of Arctic Climate (MOSAiC) expedition provide a unique view of the current state of the central Arctic over an annual cycle. Here, we use the MOSAiC radiosonde measurements to detect liquid-bearing cloud layers over full atmospheric columns and to examine the cloud-generating air masses’ properties. We perform 5-day (120 h) back-trajectory calculations for every detected cloud and cluster them using a unique set of variables extracted from these trajectories informed by ERA5 reanalysis data. This clustering method enables us to separate between the air mass source regions such as ice-covered Arctic and midlatitude open water. We find that moisture intrusions into the central Arctic typically result in multilayer liquid-bearing cloud structures and that more than half of multilayer profiles include overlying liquid-bearing clouds originating in different types of air masses. Finally, we conclude that Arctic cloud formation via prolonged radiative cooling of elevated stable subsaturated air masses circulating over the Arctic can occur frequently (up to 20% of detected clouds in the sounding data set) and may lead to a significant impact of ensuing clouds on the surface energy budget, including net surface warming in some cases.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2020

Verifying Deep Reductions in the Nuclear Arsenals: Development and Demonstration of a Motion-detection Subsystem for a “Buddy Tag” Using Non-export Controlled Accelerometers

Future nuclear arms-control agreements may place numerical limits on items that are difficult to monitor with national technical means, even when complemented with onsite inspections. Such items could include small objects and mobile assets, such as non-deployed nuclear warheads and mobile missile launchers. Typically, this verification task can be addressed with unique identifiers, but standard tagging techniques may be unacceptable in this case due to host concerns about safety and intrusiveness. First proposed in the late 1980s and partially developed by Sandia National Laboratories in the early 1990s, the “Proximity Tag” or “Buddy Tag” concept seeks to overcome these concerns by separating the tag from the treaty accountable item itself. A buddy tag has two key elements: a tamper-indicating enclosure and a motion-detection system designed to detect illicit movements in a stand-down period. As part of this project, we have built a buddy-tag prototype for demonstration and evaluation purposes. This paper reviews the design choices and functionalities of the tag’s motion-detection subsystem.We pursue a modular approach for the tag’s hardware, built around an Arduino-class microcontroller and a non-export-controlled low-noise accelerometer, and use open-source algorithms for the motion-detection software. Finally, we discuss the results of an extensive experimental campaign involving both indoor and outdoor measurements assessing the performance of the tag under real-world environmental conditions.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗

DOE OSTI2022

Designing an Intrusion Proof Adjustable Speed Drive System Controlling a Critical Process

In this paper, an intrusion proof adjustable speed drive system controlling a critical process in an industrial control system is detailed. In such a system, should the motor speed sensor signal data be compromised and/or altered via a cyber-attack, the system can potentially be unregulated, over speed and/or malfunction thereby disrupting the critical process. The proposed active detection scheme detailed in this paper introduces a private (secret) random signal termed as "watermark" into the inverter control signal that determines the PWM gating signals of the DC-AC inverter powering the motor. The watermarking signal introduced into the PWM modulation for the DC-AC inverter is shown to propagates its unique signature, which appears in all sensors signals at the inverter output such as voltage/current/speed used to control the motor. Now employing the measured data (from sensors), two statistical variance tests are conducted to identify anomalies if any in the presence of the watermarking signal. It is shown when an intrusion occurs to manipulate the sensor data to disturb and/or destabilize the process, the proposed tests immediately display a high value indicating a compromise in sensor data. It is shown that the proposed system is capable of immediate detection of a sophisticated attacks such as record/reply attack in which the actual speed sensor is disconnected and a prerecorded speed signal from the past of the same magnitude is played back to the controller. Several types of cyber-attacks such as speed reduction/increase including vibration have been tested. Extensive simulation results verify the proposed concepts. Experimental results will be discussed in the conference presentation.

Alotaibi, Faris↗

DOE OSTI2022

Detecting thermal crack growth on a large additive manufactured structure using acoustic emission

Large format additive manufacturing (LFAM) proved to have a great potential to become an adjacent technology to traditional manufacturing methods. One of the sectors LFAM is targeting is rapid tool/mold development for composites. This includes large mold structures used for high-temperature molding techniques (in-oven or autoclave). Although, these large printed structures (reaching hundreds of pounds) develop thermal-residual stress during cool-down and can eventually crack, turning the structure into waste. Acoustic emission (AE), a passive non-intrusive global nondestructive evaluation (NDE) technique, was used to monitor crack growth and can provide the right tools that can be used for feedback loop for corrective action. This research performs thermal testing on a large AM mold with preexisting cracks, in an attempt to monitor crack growth using AE. AE was able to detect, identify and locate the crack source by means of acoustic features, waveform characteristics, spectrum analysis, and difference in arrival times.

Spencer, Ryan↗

DOE OSTI2026

Model-observation discrepancies in Arctic moisture intrusions: causes and pathways for improved simulation

Arctic moisture intrusions (MIs), narrow filaments of strong moisture transport, are key drivers of poleward moisture flux and Arctic weather extremes, yet their representation in climate models is poorly understood. Using a new Arctic MI detection algorithm, we document persistent biases across three CMIP generations (CMIP3–CMIP6): models overestimate MI occurrence over the Pacific sector and underestimate it over the Atlantic sector. These errors stem from misrepresented midlatitude westerly jets, with an equatorward North Atlantic jet associated with too few Atlantic MIs, and a poleward, weakened North Pacific jet linked to too many Pacific MIs. Experiments that correct sea surface temperature and sea ice concentration biases and increase atmospheric resolution improve jet structure and MI statistics, while a cloud-locking simulation indicates that better high-frequency cloud–radiation–circulation interactions can yield further gains. Our results clarify pathways to reducing long-standing MI and jet biases, providing guidance for improving simulations of Arctic and midlatitude climate.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2023

Reduction of Iron‐Ore Pellets Using Different Gas Mixtures and Temperatures

Direct reduction of iron ore (DRI) is gaining an increased attention due to the growing need to decarbonize industrial processes. The current industrial DRI processes are performed using reformed natural gas, which results in CO 2 emission, although it is less than carbothermic reduction in the blast furnace. Carbon‐free reduction may be realized through the utilization of green H 2 as a reducing agent, in place of natural gas. Herein, the effects of various gas mixtures and temperature on the reduction kinetics of the hematite iron‐ore pellets are focused on in this work. Pellets are reduced at 700, 800, 850, and 900 °C in hydrogen and using various gas mixes at 850 °C. Morphology of the pellets is investigated with the help of scanning electron microscopy and mercury intrusion porosimetry. The effects of temperature and gas composition on the reduction kinetics and porosity of the pellets are discussed. A notable effect of reduction rate on the internal structure of the pellets is detected, slower reduction rate yielded bigger pores offsetting the gas composition. Higher temperature results in coarser pores and higher porosity. Finally, increase of CO content in the gas mix also leads to bigger pore size.

36 MATERIALS SCIENCE↗

DOE OSTI2023

Pore Structure and Wettability of Bossier Shale, East Texas, United States: Insights from Integrated Porosimetry, Scattering, and Imbibition Approaches

In this study, ascertaining the pore geometry and wettability characteristics of tight shales is of great significance for revealing the mechanisms of occurrence, migration, and production of shale resources. Taking the Bossier Shale collected from Well A, East Texas, USA, as an example, the pore geometry and wettability behavior in a broad nm-& μm scale pore spectrum were quantified based on integrated techniques, including water immersion porosimetry (WIP), mercury intrusion porosimetry(MIP), (ultra)small-angle X-ray scattering [(U)SAXS], contact angle, and liquid spontaneous imbibition (SI). Mainly owing to differences in the sample sizes used, data interpretation, as well as the detectable pore type (e.g., connected or not) and pore diameter ranges among different methods, sample porosities derived from WIP, MIP, and (U)SAXS were quite different, which range from 7.70 to 13.34%, 5.12 to 9.52%, and 2.48 to 6.44%, respectively. Therefore, a comparison of the porosities derived from different methods must be handled with utmost care. Additionally, although (U)SAXS is an effective technique for detecting both connected and non-connected pores, the fraction of non-connected pores could be underestimated by directly comparing the pore size distribution derived from (U)SAXS and MIP tests. This is because the sample sizes used for and pore information reflected by these two methods are different. Furthermore, the studied Bossier Shales exhibited various contact angle values and imbibition behaviors when using differently polarized liquids, revealing their mixed-wet characteristics. Comprehensively considering the differences in contact angle, imbibition slope, and imbibed liquid volume, three sub-categories of wettability behavior, with respect to more oil-wet, more water-wet, and intermediate mixed-wet, were qualitatively identified.

(U)SAXS↗

DOE OSTI2020

Distributed fiber sensor and machine learning data analytics for pipeline protection against extrinsic intrusions and intrinsic corrosions

This paper presents an integrated technical framework to protect pipelines against both malicious intrusions and piping degradation using a distributed fiber sensing technology and artificial intelligence. A distributed acoustic sensing (DAS) system based on phase-sensitive optical time-domain reflectometry (φ-OTDR) was used to detect acoustic wave propagation and scattering along pipeline structures consisting of straight piping and sharp bend elbow. Signal to noise ratio of the DAS system was enhanced by femtosecond induced artificial Rayleigh scattering centers. Data harnessed by the DAS system were analyzed by neural network-based machine learning algorithms. The system identified with over 85% accuracy in various external impact events, and over 94% accuracy for defect identification through supervised learning and 71% accuracy through unsupervised learning.

Peng, Zhaoqiang↗

DOE OSTI2026

Advancing Industry 4.0: Multimodal Sensor Fusion for AI-Based Fault Detection in 3D Printing

Additive manufacturing, particularly fused deposition modeling, is transforming modern production by enabling rapid prototyping and complex part fabrication. However, its layer-by-layer process remains vulnerable to faults such as nozzle clogging, filament runout, and layer misalignment, which compromise print quality and reliability. Traditional inspection methods are costly, time-intensive, and often limited to post-process analysis, making them unsuitable for real-time intervention. In this current study, the authors developed a novel, low-cost, and portable faultdetection system that leverages multimodal sensor fusion and artificial intelligence for real-time monitoring in FDM-based 3D printing. The system integrates acoustic, vibration, and thermal sensing into a non-intrusive architecture, capturing complementary data streams that reflect both mechanical and process-related anomalies. Acoustic and thermal sensors operate in a fully contactless manner, while the vibration sensor requires minimal attachment such that it will not interfere with printer hardware, thereby preserving portability and ease of deployment. The multimodal signals are processed into spectrograms and time-frequency features, which are classified using convolutional neural networks for intelligent fault detection. The proposed system advances Industry 4.0 objectives by offering an affordable, scalable, and practical monitoring solution that improves faultdetection accuracy, reduces waste, and supports sustainable, adaptive manufacturing.

42 ENGINEERING↗

DOE OSTI2022

Cyber-Physical Resiliency for Wind Power Generation

During the next three years, wind power generation is expected to add more generation capacity to the national electrical grid than any other energy sector. With new wind turbine designs rated power over 10 MW and wind farms reaching over 1 GW capacities, the consequences of cyber-attacks on wind power generation are becoming increasingly more critical. Moreover, the known vulnerabilities of wind turbine control systems and the potential damaging effects of intrusions, motivate an urgent protection improvement for the wind power generation sector. This program has developed a variety of new adaptive defense technologies that enable wind power generation systems to survive sophisticated cyberattacks by enhancing the control systems capabilities of detection, localization, and accommodation. The introduction of these technologies in the on-shore and the emerging off-shore market will result in a significantly more reliable and secure wind power infrastructure.

17 WIND ENERGY↗

DOE OSTI2020

Using Raman scattering to study reacting gas flow over a catalyst

l present a series of computational methods for analyzing and correcting Raman scattering from a reacting gas flow. My work focused on the laser diagnostic measurements of formaldehyde production over a silver catalyst, specifically the Raman spectroscopy component. This technique offers a non-intrusive, in situ way to measure the coupling between the gas phase and surface activity of a catalytic reaction at relevant industrial conditions. This report outlines the steps followed for correcting the non-idealities in the data due to both the detection optics and scattering mechanics. By implementing such refinement steps, l can generate an accurate 2D spatial map of the temperature profile, number densities for major species, and relative consumption of reactants throughout the reactor cell.

37 INORGANIC, ORGANIC, PHYSICAL, AND ANALYTICAL CH↗

DOE OSTI2023

A semiempirical transparency model for dual energy cargo radiography applications

Cargo containers passing through ports are scanned by non-intrusive inspection systems to search for concealed illicit materials. By using two photon beams with different energy spectra, dual energy inspection systems are sensitive to both the area density and the atomic number of cargo contents. Most literature on the subject assumes a simple exponential attenuation model for photon intensity in which only free streaming photons are detected. However, this approximation neglects second order effects such as scattering, leading to a biased model and thus incorrect material predictions. This work studies the accuracy of the free streaming model by comparing it to simulation outputs, finding that the model shows poor atomic number reconstruction accuracy at high- Z and suffers significantly if the source energy spectra and detector response function are not known exactly. To address these challenges, this work introduces a semiempirical transparency model which modifies the free streaming model by rescaling different components of the mass attenuation coefficient, allowing the model to capture secondary effects ignored by the free streaming model. The semiempirical model displays improvement agreement with simulated results at high- Z and shows excellent extrapolation to materials and thicknesses which were not included during the calibration step. Furthermore, this work demonstrates that the semiempirical model yields accurate atomic number predictions even when the source spectra and detector response are not known exactly. In conclusion, using the semiempirical model, manufacturers can perform a simple calibration to enable more precise Z reconstruction capabilities, which has the potential to significantly improve the performance of existing dual energy radiographic systems.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗

DOE OSTI2026

Expandable Log Analyzing Framework

Prior to my internship, I was informed that a previous intern had built a tool to analyse MongoDB logs and look for invalid access attempts, which served as a great reference point for my project. I was initially tasked with expanding on her prototype and filling in the gaps such as integrating it with the main monitoring tool the lab uses. Eventually, the scope grew, expanding to support other databases and a growing collection of tools. I organized the framework around an observer pattern, meaning one point in the program sending updates to the rest of the framework. Every time a log was read and parsed, it was sent to be processed by the tools, using the type of event as a means to determine which tools should get a chance to act on the log. This decouples the tools from the log reader, making future updates and additions much easier. The framework processes MongoDB logs at ~135,000 entries per second and PostgreSQL logs at ~170,500 entries per second, accurately detecting anomalies such as slow queries and connections from unknown addresses. This framework serves to fill gaps in database monitoring tools currently implemented at the lab, such as tracking failed authentication for PostgreSQL and MongoDB which had very minimal or none before this framework. National labs such as Fermilab hold sensitive data and valuable computing resources, making them attractive targets. Monitoring intrusion attempts on databases is made much easier by this comprehensive monitoring suite.

Clark, Dylan [Unlisted, IL]↗

DOE OSTI2026

Expandable Log Analyzing Framework

Clark, Dylan [Unlisted, IL]↗