Search NASA⌕ Search

SEARCH · Search NASA

Results for “network time protocol”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

165 records · Page 10
All sourcesNASA NTRSDOE OSTI
DOE OSTI2021

Using bursty announcements for detecting BGP routing anomalies

Despite the robust structure of the Internet, it is still susceptible to disruptive routing updates that prevent network traffic from reaching its destination. Our research shows that BGP announcements that are associated with disruptive updates tend to occur in groups of relatively high frequency, followed by periods of infrequent activity. We hypothesize that we may use these bursty characteristics to detect anomalous routing incidents. In this work, we use manually verified ground truth metadata and volume of announcements as a baseline measure, and propose a burstiness measure that detects prior anomalous incidents with high recall and better precision than the volume baseline. We quantify the burstiness of inter-arrival times around the date and times of four large-scale incidents: the Indosat hijacking event in April 2014, the Telecom Malaysia leak in June 2015, the Bharti Airtel Ltd. hijack in November 2015, and the MainOne leak in November 2018; and three smaller scale incidents that led to traffic interception: the Belarusian traffic direction in February 2013, the Icelandic traffic direction in July 2013, and the Russian telecom that hijacked financial services in April 2017. Our method leverages the burstiness of disruptive update messages to detect these incidents. We describe limitations, open challenges, and how this method can be used for routing anomaly detection.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Field Demonstration of the Brick Ontology to Scale up the Deployment of ASHRAE Guideline 36 Control Sequences

Many commercial buildings have a vast network of sensors as part of their building automation systems (BAS) that allows opportunities for energy consumption and cost savings by deploying advanced control sequences. However, this resource is often underutilized since BAS are typically programmed with simple control sequences with limited potential to deliver on these opportunities. The recent availability of ASHRAE Guideline 36 (G36) with advanced HVAC control sequences supports control retrofits in existing buildings to unlock much of the savings potential. However, barriers such as the lack of standard naming convention of building assets and data points, proprietary equipment and BAS, and the inherent uniqueness of buildings and their systems prevent building stakeholders from adopting any “plug-and-play” implementation of G36. Instead, control vendors must often undertake the manual and labor-intensive point mapping process to identify a data stream’s functional and spatial relationship within the HVAC system along with other relevant contexts and map it to the new control sequences. The vendor must carry out the point mapping process in each individual building since the mapping is unlikely to port over to another building. Even for the same building, the point mapping process can occur multiple times if various control vendors implement different control retrofits and/or multiple control retrofits happen over the lifecycle of the building. Then, there is the likelihood that G36 control sequences are programmed uniquely to the building, preventing the same implementation from being reused in another. Therefore, this paper presents a field demonstration of how we leveraged the Brick ontology with BACnet, OpenBuildingControl’s Control Description Language (CDL), and open-source support tools to implement scalable and portable advanced building controls. These tools provide standardized semantic descriptions and relationships of the building’s assets and data points (Brick), standardized communication protocol to read from and write to the building’s BAS (BACnet), and standardized code implementations (CDL) of standardized advanced control strategies (G36). We implemented G36’s hot water supply temperature setpoint reset in a Berkeley, CA building for this field demonstration. This field demonstration aims to show how integrating these tools may streamline the deployment of advanced control sequences such as G36 in a consistent manner regardless of differences found across buildings.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗
DOE OSTI2022

Precursor Analysis Report: Industroyer Targeting Ukraine Electric Power Transport Utility (Ukrenergo) 2016

The Industroyer Targeting Ukraine Electric Power Transport Utility (Ukrenergo) 2016 Precursor Analysis Report leverages publicly available information about the December 2016 cyber attack against the Ukrainian Ukrenergo electric transmission utility and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. Industroyer is a modular malware framework designed to deploy several Industrial Control System (ICS) protocol-specific attack payloads to disrupt electricity distribution. Adversaries deployed Industroyer within the target network on a Microsoft Windows endpoint capable of directly manipulating or communicating with ICS. Industroyer abuses the functionality of a targeted ICS’s legitimate control system to achieve its intended impact. Adversaries likely first gained access to Ukrenergo enterprise networks in early 2016 after a successful spearphishing campaign against organizations in the electric power sector. Adversaries then began capturing credentials beginning on 1 December 2016. This allowed access to the ICS environment at the Pivnichna electric transmission substation outside Kyiv through a device dual-homed on the Information Technology (IT) and ICS networks. Adversaries conducted discovery, targeting, and access to this device using information and previously captured credentials from compromised enterprise IT machines. Finally, the adversaries deployed and launched the Industroyer malware just before midnight on 17 December. By midnight, Ukrenergo had lost control of a targeted substation, resulting in electric power outages for over an hour in the city of Kyiv and the Kyiv region. Researchers and analysts identified 31 unique techniques (used in a sequence of 33 steps) utilized during the attack with a total of 846 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Twenty-nine of the identified techniques used during the Industroyer cyber attack were precursors to the triggering event. Analysis identified 548 observables associated with these precursor techniques, 353 of which were assessed to have an increased likelihood of being perceived in the 300 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗