Search NASA⌕ Search

SEARCH · Search NASA

Results for “CyberSecurity”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 217 records · Page 12

Vulcan-Forge: Architecture and Design of a Multi-Modal Forensic Analysis Plugin for CALDERA

Forge and VULCAN together describe an open-architecture cybersecurity analysis ecosystem that unifies forensic artifact processing, detection engineering, and vulnerability intelligence within integrated platforms. Forge operates as a plugin for MITRE CALDERA, ingesting diverse evidence formats—including EVTX, PCAP/PCAPNG, CSV, JSON, YAML, XML, binaries, and archives—to construct a unified artifact graph enriched with severity scoring, TLP classification, and audit trails. It provides subsystems for artifact parsing, streaming structured-data visualization, NetworkMiner-based packet inspection, PE/.NET binary analysis, and LLM-assisted triage and rule generation, with outputs validated against CCCS-YARA and pySigma schemas. VULCAN complements this by serving as a cybersecurity analyst platform that integrates a Neo4j knowledge graph, Qdrant vector retrieval, SSVC-based triage, and a local LLM to deliver CVE intelligence and forensic analysis through a multi-source ingest pipeline drawing from NVD, CISA KEV, EPSS, MITRE ATT&CK, and CAPEC. Together, they bridge structured threat intelligence with automated forensic analysis and detection workflows.

97 MATHEMATICS AND COMPUTING↗

Tabletop Testing for EV Charging Ecosystem PKI (Project T34PKI Final Report)

To test the communications and cybersecurity functionality, Electric Vehicle and charging station vendors have had to ship their products to in-person testing events. This is cumbersome, expensive, inefficient, and an impediment to rapid time-to-deployment. In this project Sandia used COTS hardware and Open-Source Software to develop and demonstrate a more agile, productive approach: testing low-voltage controllers independently from high-voltage power delivery sub-systems. This approach allows communications controllers to be transported easily (e.g. shipped at low cost, checked as airline baggage); set up on a table-top (“bench testing”); and use ordinary 120 VAC outlets to conduct agile testing. Table-top platforms become end nodes that can connect to laboratory and cloud-based servers to test communications and cybersecurity, specifically Public Key Infrastructure (PKI) functionality and interoperability, separately from EV battery charging (power/energy transfer) functionality.

33 ADVANCED PROPULSION SYSTEMS↗

Advanced Transmission Technologies (ATTs) Supplier Cohort Workshops Cohort Summary [Slides]

This Summary slide deck summarizes the key outcomes of the Advanced Transmission Technologies (ATTs) supplier cohort, part of Idaho National Laboratory’s (INL) Technical Assistance for Digital Assurance (TADA) program. The program aimed to strengthen grid resilience through cybersecurity controls, supply-chain security, and Cyber-Informed Engineering (CIE) for advanced transmission technologies. The cohort brought together vendors representing the full range of Grid-Enhancing Technologies (GETs), including providers of Dynamic Line Ratings (DLR), Advanced Power Flow Control (APFC), Transmission Topology Optimization (TTO), and High-Performance Conductors (HPCs). Discussions focused on institutional, integration, and operational barriers limiting GET adoption; cybersecurity risks at EMS/SCADA, cloud, and network integration points; and supply-chain transparency issues such as semiconductor dependence and SBOM/HBOM expectations. Participants also addressed operator trust, human-in-the-loop requirements, and challenges with utility adoption, while exploring how CIE can support secure deployment of GETs. This deck represents a consolidated summary of challenges and risks identified by vendors, cross-cutting themes and technology-specific insights from three cohort workshops, and actionable mitigations to guide utilities, vendors, and the Department of Energy in advancing secure, trusted deployment of GETs.

24 - POWER TRANSMISSION AND DISTRIBUTION↗

FY25 Electric Grid Security Annual Report

Sandia’s Electric Grid Security program advances a national vision of energy dominance and accessibility, while applying our national security -emphasis on ensuring of a secure, resilient, and affordable electric system for all users. Our achievements reflect a strategic approach combining technology development; modeling, simulation, and data analytics; and partnered demonstrations and outreach to further the adoption of advanced grid and storage technologies. Our FY25 efforts leverage the strengths of our partnerships—spanning Sandia’s core science and technology competencies as well as external technology leaders—to develop the solutions today which enable the grid of tomorrow. Key accomplishments in this report that support our strategy span our technical program areas and include: • New open-source analytical tools for systems -level planning and optimization, including significant advances to the QuESt analytical environment; • Further advancement of artificial intelligence and machine learning to enhanced grid operations and planning as we rise to the challenge of new large loads; • Development of solid-state power conversion technologies and a new medium-voltage research lab; • New technologies to assess wildfire vulnerabilities and mitigate potential impacts; • Advanced applications of new cybersecurity technologies with industry partners; • Contributions to understanding the impacts of electromagnetic pulses and geomagnetic disturbances on grid components; and • Digital twin development for hybrid microgrids with multiple generators, storage, and loads. This report indicates key areas of research and engagement and summarizes the impact of Sandia’s contributions through notable accomplishments, journal publications, patents, and technical conferences and presentations. It is provided with the hope that readers discover ways we can further team to create our modern grid and apply the outcomes of our efforts. The bulk of work described herein is funded by several offices within the U.S. Department of Energy (USDOE), including the Office of Electricity (OE); Cybersecurity, Energy Security, and Emergency Response (CESER); former offices such as the Office of Energy Efficiency and Renewable Energy (EERE), the Grid Deployment Office (GDO), the Office of Clean Energy Demonstrations (OCED), and other key programs at USDOE. As we continue to state in these annual reports, the contributors to our successes are too numerous to name here, though our team wishes to express our deep gratitude to the numerous program and project sponsors at the US Department of Energy, who often function equally as technical collaborators; our many partners in industry, academia, utilities, and other national labs; and fellow researchers and business partners at Sandia whose leadership and creativity have enabled the accomplishments described herein.

24 POWER TRANSMISSION AND DISTRIBUTION↗

Site Integration and Regulatory Considerations for a Nuclear Power Plant Colocated with Industrial Facilities: Colocation Studies for a Petroleum Refinery, Methanol Plant, and Wood Pulp Plant

This research explores the colocation of nuclear power plants (NPPs) with industrial applications. Three existing industrial sites were considered to demonstrate the siting process and illuminate technological gaps for future work. The three applications demonstrated for colocation here are a petroleum refinery, a methanol production plant, and a pulp and paper plant. This study uses a modified version of the EPRI siting criteria to explore the geological and demographic characteristics of the location of the current industrial site, as well as exploring external hazards from the industrial plant and its surrounding land use. Data was collected from public databases to estimate site characteristics. We then discuss how the site characteristics may impact the ability to colocate an NPP with an industrial application. The application site and 5 additional sites were explored for each application to give a general indication of the siting implications for an NPP in each area. The hazards for each industrial application was also explored to determine how colocation may impact reactor safety. The following gaps have been identified and should be explored in future research on colocation of NPPs with petroleum refineries, methanol plants, and pulp and paper plants: - There is a variety of industrial use, hazards, and pipelines in the surrounding area. A more thorough review of these hazards should be considered for colocation. - In general, the whole region around some applications seems to have softer soil, with implications for large site preparation costs. Further site investigations should prioritize looking into the geotechnical conditions. - Applications along coastlines are susceptible to flooding and hurricanes. The benefits of colocation should be weighed against the potential design implications. - The benefits of natural gas pipeline infrastructure in place should be explored further. If heat supply from the NPP is not required or not feasible due to the distance between the NPP and the application, there may be an opportunity to supply hydrogen to the plant through an existing pipeline. - Because there are several collocated industrial plants in the regions for the refinery and methanol plant, the benefits of sharing resources from the NPP should be explored further. This may open up additional sites for colocation. The following knowledge gaps were identified for the colocation of NPPs with these three industries, and industrial applications in general. These gaps are: - While the STAND tool contains many important characteristics for the reactor siting process, it is not calibrated for the colocation of NPPs with industrial facilities. - There are aspects of both the NPP and industrial application that need to be quantified for a siting analysis. Particularly, we need to understand the water intake requirements for NPPs and each application. - Further work may focus on adapting the STAND site comparison methodology to comparison of sites for co-location. This will involve using the data documented in this report as a starting point and performing a comprehensive and quantitative comparison. - Without spending significant resources, it would be impossible to gather data for each site to evaluate all aspects of siting. One approach to finding data and understanding its implications to siting is looking at FSARs for existing plants. For example, most sites considered in this study have small Vs30 values, indicating soft soil. However, there are NPPs located in the vicinity of most of the sites (e.g., Waterford Steam Electric Station near New Orleans) and reviewing available site characteristics and geotechnical data for these NPPs, might provide further information for siting. - The siting analysis in this study indicates that colocation of the NPP with the industrial site could be difficult based on external hazards, cooling requirements, weather, or population. We need to determine the impact of distance between the two facilities on cost and quality of energy transport. - This study did not touch on socioeconomic impacts for NPP colocation with industrial facilities. The input-output analysis methodology could be applied to the communities referenced in this study to determine the socioeconomic impact of these projects. - Similarly, the impacts of colocation on emergency planning was not explored in this study. The impacts on emergency planning infrastructure are somewhat related to the socioeconomic impacts, and could be explored using a similar methodology. - This study also did not address physical and cybersecurity, which will be important aspects of co-location [ref] . Cybersecurity will be important, regardless of the distance, but physical security will be important if the facilities are located very closely. Physical security might also be important for the steam lines between the plants, unless they are determined to be non-safety significant. - In many site l

08 HYDROGEN↗

Reverse Engineering of Medical Devices for Innovation and Advancement in Healthcare

Medical cybersecurity research addresses the critical intersection of healthcare and digital security. As medical devices expand and become increasingly interconnected, the healthcare sector is poised to become a primary target for cyber warfare. This project aims to mitigate the risks associated with a field that often underestimates the importance of cybersecurity.

Baldwin, David↗

Employing a Hardware-in-the-Loop Approach to Realize a Fully Homomorphic Controller for a Small Modular Advanced High Temperature Reactor

This paper addresses the cybersecurity challenges of advanced nuclear reactors by integrating fully homomorphic encryption (FHE) into their control systems, enabling encrypted processing of control signals without compromising functionality. Advanced nuclear reactors, including Small Modular Reactors (SMRs) and microreactors, aim to achieve autonomous and remote operations, reducing costs and enhancing competitiveness. However, these advancements expand the attack surface for cyberattacks, particularly in autonomous and remote operation scenarios. Cyberattacks can exploit vulnerabilities to manipulate physical processes, causing shutdowns, asset damage, or public harm. Such attacks begin with passive reconnaissance, where adversaries intercept communications or observe behaviors to gather information, which is then leveraged to execute cyber-physical attacks by injecting malicious commands. Nuclear power must adopt cybersecurity protection measures to secure the integrity and availability of their digital control systems. This paper demonstrates the application of FHE to secure operations by enabling encrypted processing of sensitive signals and parameters -- ensuring privacy without exposing data. FHE supports secure mathematical operations on encrypted data without requiring decryption. Using a hardware-in-the-loop (HIL) approach, this paper implements an FHE-integrated controller on a BeagleBone Black (BBB) controlling a simulation of the Small Modular Advanced High Temperature Reactor (SmAHTR). By doing so, the encrypted controller protects the integrity of critical set points and control signals during transmission and processing. Thus, FHE-integrated controllers enhance secure operations of advanced nuclear reactors while maintaining functionality.

control systems↗

Site Integration and Regulatory Considerations for an NPP Colocated with a Petroleum Refinery, Methanol Plant, and Wood Pulp Plant

This research explores the colocation of nuclear power plants (NPPs) with industrial applications. Three existing industrial sites were considered to demonstrate the siting process and illuminate technological gaps for future work. The three applications demonstrated for colocation here are a petroleum refinery, a methanol production plant, and a pulp and paper plant. This study uses a modified version of the EPRI siting criteria to explore the geological and demographic characteristics of the location of the current industrial site, as well as exploring external hazards from the industrial plant and its surrounding land use. Data was collected from public databases to estimate site characteristics. We then discuss how the site characteristics may impact the ability to colocate an NPP with an industrial application. The application site and 5 additional sites were explored for each application to give a general indication of the siting implications for an NPP in each area. The hazards for each industrial application was also explored to determine how colocation may impact reactor safety. The following gaps have been identified and should be explored in future research on colocation of NPPs with petroleum refineries, methanol plants, and pulp and paper plants: - There is a variety of industrial use, hazards, and pipelines in the surrounding area. A more thorough review of these hazards should be considered for colocation. - In general, the whole region around some applications seems to have softer soil, with implications for large site preparation costs. Further site investigations should prioritize looking into the geotechnical conditions. - Applications along coastlines are susceptible to flooding and hurricanes. The benefits of colocation should be weighed against the potential design implications. - The benefits of natural gas pipeline infrastructure in place should be explored further. If heat supply from the NPP is not required or not feasible due to the distance between the NPP and the application, there may be an opportunity to supply hydrogen to the plant through an existing pipeline. - Because there are several collocated industrial plants in the regions for the refinery and methanol plant, the benefits of sharing resources from the NPP should be explored further. This may open up additional sites for colocation. The following knowledge gaps were identified for the colocation of NPPs with these three industries, and industrial applications in general. These gaps are: - While the STAND tool contains many important characteristics for the reactor siting process, it is not calibrated for the colocation of NPPs with industrial facilities. - There are aspects of both the NPP and industrial application that need to be quantified for a siting analysis. Particularly, we need to understand the water intake requirements for NPPs and each application. - Further work may focus on adapting the STAND site comparison methodology to comparison of sites for co-location. This will involve using the data documented in this report as a starting point and performing a comprehensive and quantitative comparison. - Without spending significant resources, it would be impossible to gather data for each site to evaluate all aspects of siting. One approach to finding data and understanding its implications to siting is looking at FSARs for existing plants. For example, most sites considered in this study have small Vs30 values, indicating soft soil. However, there are NPPs located in the vicinity of most of the sites (e.g., Waterford Steam Electric Station near New Orleans) and reviewing available site characteristics and geotechnical data for these NPPs, might provide further information for siting. - The siting analysis in this study indicates that colocation of the NPP with the industrial site could be difficult based on external hazards, cooling requirements, weather, or population. We need to determine the impact of distance between the two facilities on cost and quality of energy transport. - This study did not touch on socioeconomic impacts for NPP colocation with industrial facilities. The input-output analysis methodology could be applied to the communities referenced in this study to determine the socioeconomic impact of these projects. - Similarly, the impacts of colocation on emergency planning was not explored in this study. The impacts on emergency planning infrastructure are somewhat related to the socioeconomic impacts, and could be explored using a similar methodology. - This study also did not address physical and cybersecurity, which will be important aspects of co-location [ref] . Cybersecurity will be important, regardless of the distance, but physical security will be important if the facilities are located very closely. Physical security might also be important for the steam lines between the plants, unless they are determined to be non-safety significant. - In many site l

08 - HYDROGEN↗

Hands-On, Heads-Up: Blending Cyber T&E with Data Science-Driven Training in Jupyter Notebooks

In an era of increasingly sophisticated threats to critical infrastructure, cybersecurity professionals must be more than just aware; they must be immersed, agile, and equipped to operate in environments where failure is not an option. Nowhere is this truer than in the nuclear sector, where cyber-physical systems, regulatory scrutiny, and insider threat potential demand a new generation of hands-on, technically fluent defenders. This paper presents a unified training approach that integrates Cybersecurity Test and Evaluation (T&E) with data science techniques using Jupyter Notebooks as the interactive lab environment. The program centers on a modular, scenario-driven curriculum designed to build not just knowledge but practical capability in the assessment and defense of radiation detection systems, firmware interfaces, and operational security postures.

98 - NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL↗

Operational Process for Trigger Identification and Comprehension (OPTIC)

The Operational Process for Trigger Identification and Comprehension (OPTIC) is a standalone, downloadable application designed to enhance the CyOTE (Cybersecurity for the Operational Technology Environment) methodology and will be made available for free download to industry. OPTIC brings key CyOTE functionalities into focus. OPTIC aids OT professionals in analyzing and determining whether an observed anomaly may indicate possible malicious activity or merely a maintenance related irregularity.

99 GENERAL AND MISCELLANEOUS↗

Bayesian Attack Model (BAM)

The Bayesian Attack Model (BAM) is an analytical tool designed to enhance the comprehension of adversarial activity in OT environments. BAM leverages both expert cybersecurity insights and historical data to characterize the likelihood of adversarial behavior given anomalous observable events.

99 GENERAL AND MISCELLANEOUS↗

Model Residuals as Shields: A Two-Level Formulation to Defend Smart Grids From Poisoning Attacks

The advancement of smart grids presents both vast opportunities and heightened cybersecurity risks. Data-driven defense mechanisms, though designed as a shield against these threats, can fall prey to poisoning attacks. We delve into regression settings, underscoring the imperative to fortify defenses against a spectrum of poison ratios, notably those above 0.5—an issue scarcely addressed in prior studies. Recognizing the susceptibilities of smart grids and their manipulable sensors, we exploit the very intent of poisoning attacks, compromising model accuracy, as our defense mechanism. Our proposed two-level optimization framework discerns between poisoned and authentic data based on model residuals, outperforming or matching existing methods in 72% to 77% of precision and 75% to 80% of recalls across various poisoning attacks, poison ratios, and datasets. Once the authentic data are identified, the trained model is adaptable for a variety of applications. Comprehensive evaluations on different smart grid datasets, pitted against myriad poisoning schemes, validate our methodology’s edge over existing methods. Here, we also shed light on the implications of model misspecification originating from temporal auto-correlation, a common feature in Internet of Things and smart grid data.

Adversarial machine learning (ML)↗

Model-Based Detection of Coordinated Attacks (DCA) in Distribution Systems

The fast-paced growth in digitization of smart grid components enhances system observability and remote-control capabilities through efficient communication. However, enhanced connectivity results in heightened system vulnerability towards cybersecurity risks in the cyber-physical power system. Coordinated cyber-attacks (CCA), when undetected, lead to system-wide impact in terms of large disturbances or widespread outages. Detecting CCA in the cyber layer is critical to thwart cyber-attacks in real-time before the attack impacts the physical system. The challenge of locating CCA stems from the complex grid dynamics, making it difficult to distinguish between normal operational variations and cyber-attack impact. CCA often employs multiple attack vectors targeting geographically distributed components, further complicating CCA identification. Existing research in intrusion detection is primarily focused on the transmission network and limited to detecting individual attacks. In this paper, a novel proactive DCA strategy is proposed for early detection of CCA by establishing correlations among distinct attack events through model-based reinforcement learning that utilizes abductive reasoning to conclude the attacker goal. The solution includes understanding the system model, learning the system dynamics, and correlating individual cyber-attacks to extract the attacker’s objective. The developed learning algorithm identifies the most probable attack path to reach the attacker’s objective by predicting the next attack steps. A DNP3-based cyber-physical co-simulation testbed is developed to test the proposed algorithm using the IEEE 13-node test feeder.

24 POWER TRANSMISSION AND DISTRIBUTION↗

Interdisciplinary Approaches to Cybervulnerability Impact Assessment for Energy Critical Infrastructure

As energy infrastructure becomes more interconnected, understanding cybersecurity risks to production systems requires integrating operational and computer security knowledge. We interviewed 18 experts working in the field of energy critical infrastructure to compare what information they find necessary to assess the impact of computer vulnerabilities on energy operational technology. These experts came from two groups: 1) computer security experts and 2) energy sector operations experts. We find that both groups responded similarly for general categories of information and displayed knowledge about both domains, perhaps due to their interdisciplinary work at the same organization. Yet, their discussion of each group’s domain-specific training, motivations, and limitations, as well as their suggestions for collaboration across domains, highlighted how these two groups can work together to help each other secure the energy grid. Our findings inform the development of interdisciplinary security approaches in critical-infrastructure contexts.

97 MATHEMATICS AND COMPUTING↗

Digital risk analysis in nuclear engineering projects: Designing for safety, performance, reliability, and security

Cyber-informed engineering and security-by-design frameworks are important in promoting the need to identify cybersecurity concerns early in the systems engineering lifecycle so risks from adversarial cyber-attacks can be eliminated or reduced through engineering design practices. In addition to adversarial risk, risk in operational technology systems also includes non-adversarial and unintentional risk from other factors such as human performance errors, environmental conditions, design flaws, and device degradation or failure. This paper introduces a new concept for characterizing digital risk, both adversarial and non-adversarial, and provides the basis for initial research into a novel digital risk analysis approach focused on incorporating attack difficulty into a multi-attribute analysis technique using robust decision-making. This digital risk characterization is also used to frame a discussion on the challenges of competing objectives and competing stakeholder requirements in an integrated energy system project that incorporates a small modular reactor and industrial facility.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

eGridGPT: Trustworthy AI in the Control Room

This report outlines the synergy between human decision making and generative artificial intelligence (GenAI), where GenAI supports power system operators by analyzing procedures, suggesting actions, simulating scenarios with physics-based digital twins, and recommending optimal decisions. This report is the first research effort to apply large language models (LLMs), a type of GenAI, in the power grid control room. The authors describe the Electric Grid Generative Pretrained Transformer (eGridGPT), an LLM that virtually assists system operators. Developed with cybersecurity and regulatory requirements in mind, eGridGPT represents an opportunity to responsibly evolve control room technologies to meet the needs of a rapidly changing grid. As an innovative concept, eGridGPT seeks to spearhead productive discussions about the advanced technologies in the control room of the future amid the transition to clean energy.

24 POWER TRANSMISSION AND DISTRIBUTION↗

PLC Vulnerabilities and Mitigations

Programmable Logic Controllers (PLCs) are used extensively in many high-importance industrial and nonindustrial settings including controlling elevators, manufacturing machines, and utility facilities such as power and natural gas, however cybersecurity protection for them has been neglected. Within recent years, PLCs have been put under more security scrutiny and experts have advocated for changes from the addition of protocol encryption and network segmentation to intrusion detection systems on the PLCs themselves. While PLC security is critical, a large portion of the PLCs available today will never receive these changes due to being legacy or the difficulty of overhauling the security on existing systems. Due to the infeasibility of applying many recommended security measures towards currently available machines, we aim to provide realistic and affordable best practices for hardening PLCs. We will first conduct security analysis and consider attack vectors within our target PLC. Once we’ve analyzed the device’s security, we will evaluate a variety of mitigation methods and create guidelines to effectively reduce the threat posed by PLC attacks with minimal disruption to operations.

42 ENGINEERING↗

Cyber Informed Engineering (CIE) Principles Slide Presentation [Slides]

This document describes the concept and application of Cyber-Informed Engineering (CIE), a methodology that integrates cyber threat awareness into all stages of the systems engineering life cycle. It delineates how CIE enhances the security posture of critical infrastructure systems, which are increasingly targeted by sophisticated cyber threats. The exposition proceeds to methodically walk through the twelve foundational principles of CIE, each serving as a strategic guidepost for embedding cybersecurity into the fabric of system design, development, operation, and maintenance. The principles highlight the importance of proactive and comprehensive security measures that span from risk assessment to continuous improvement, ensuring that systems are not only designed with security in mind but are also resilient in the face of evolving cyber threats.

42 ENGINEERING↗