Search NASA⌕ Search

SEARCH · Search NASA

Results for “Threat Detection”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 217 records · Page 12
All sourcesNASA NTRSDOE OSTI
DOE OSTI2024

Severe Convective Storms in Limited Instability Organized by Pattern and Distribution

Abstract Severe convection occurring in high-shear, low-CAPE (HSLC) environments is a common cool-season threat in the southeastern United States. Previous studies of HSLC convection document the increased operational challenges that these environments present compared to their high-CAPE counterparts, corresponding to higher false-alarm ratios and lower probability of detection for severe watches and warnings. These environments can exhibit rapid destabilization in the hours prior to convection, sometimes associated with the release of potential instability. Here, we use self-organizing maps (SOMs) to objectively identify environmental patterns accompanying HSLC cool-season severe events and associate them with variations in severe weather frequency and distribution. Large-scale patterns exhibit modest variation within the HSLC subclass, featuring strong surface cyclones accompanied by vigorous upper-tropospheric troughs and northward-extending regions of instability, consistent with prior studies. In most patterns, severe weather occurs immediately ahead of a cold front. Other convective ingredients, such as lower-tropospheric vertical wind shear, near-surface equivalent potential temperature (θ e ) advection, and the release of potential instability, varied more significantly across patterns. No single variable used to train SOMs consistently demonstrated differences in the distribution of severe weather occurrence across patterns. Comparison of SOMs based on upper and lower quartiles of severe occurrence demonstrated that the release of potential instability was most consistently associated with higher-impact events in comparison to other convective ingredients. Overall, we find that previously developed HSLC composite parameters reasonably identify high-impact HSLC events. Significance Statement Even when atmospheric instability is not optimal for severe convective storms, in some situations they can still occur, presenting increased challenges to forecasters. These marginal environments may occur at night or during the cool season, when people are less attuned to severe weather threats. Here, we use a sorting algorithm to classify different weather patterns accompanying such storms, and we distinguish which specific patterns and weather system features are most strongly associated with severe storms. Our goals are to increase situational awareness for forecasters and to improve understanding of the processes leading to severe convection in marginal environments.

Meteorology & Atmospheric Sciences↗
DOE OSTI2020

Accessible Real-Time Surveillance Radar System for Object Detection

As unmanned ground and aerial vehicles become more accessible and their usage covers a wider area of application, including for threatening purposes which can cause connected catastrophe, a surveillance system for the public places is being considered more essential to respond to those possible threats. We propose an inexpensive, lighter, safer, and smaller radar system than military-grade radar systems while keeping reasonable capability for use in monitoring public places. The paper details the iterative process on the system design and improvements with experiments to realize the system used for surveillance. The experiments show the practical use of the system and configuration for a better understanding of using the system. Cyber-physical systems for outdoor environments can benefit from the system as a sensor for sensing objects as well as monitoring.

47 OTHER INSTRUMENTATION↗
DOE OSTI2020

Expectation-propagation for weak radionuclide identification at radiation portal monitors

We propose a sparsity-promoting Bayesian algorithm capable of identifying radionuclide signatures from weak sources in the presence of a high radiation background. The proposed method is relevant to radiation identification for security applications. In such scenarios, the background typically consists of terrestrial, cosmic, and cosmogenic radiation that may cause false positive responses. We evaluate the new Bayesian approach using gamma-ray data and are able to identify weapons-grade plutonium, masked by naturally-occurring radioactive material (NORM), in a measurement time of a few seconds. We demonstrate this identification capability using organic scintillators (stilbene crystals and EJ-309 liquid scintillators), which do not provide direct, high-resolution, source spectroscopic information. Compared to the EJ-309 detector, the stilbene-based detector exhibits a lower identification error, on average, owing to its better energy resolution. Organic scintillators are used within radiation portal monitors to detect gamma rays emitted from conveyances crossing ports of entry. The described method is therefore applicable to radiation portal monitors deployed in the field and could improve their threat discrimination capability by minimizing “nuisance” alarms produced either by NORM-bearing materials found in shipped cargoes, such as ceramics and fertilizers, or radionuclides in recently treated nuclear medicine patients.

38 RADIATION CHEMISTRY, RADIOCHEMISTRY, AND NUCLEA↗
DOE OSTI2024

Utilizing HYSPLIT for Emergency Response Modeling at SRS

The threat of a disaster happening at the Savannah River Site (SRS) is low, but not zero. When an emergency arises, emergency responders utilize a variety of tools to detect, track, and mitigate the disaster. HYSPLIT is a community atmospheric dispersion model that is highly configurable and has been used operationally to simulate particle, chemical, and radionuclide releases. We have developed a preliminary user interface (UI) that configures HYSPLIT to run for a variety of Emergency Action Level (EAL) scenarios at SRS. Using a hypothetical EAL scenario of an accidental release of Pu-238 in H-area and K-area onsite, an analysis was done to show how a preliminary UI framework allows HYSPLIT to be run on a terminal without the need form an active network connection. The study was successful in multiple aspects. For the preliminary UI, users were able to input certain characteristics of the hypothetical EAL such as hours of emission (how long was Pu-238 being released), curies of release, release start time (when does the model run start), and type of radionuclide directly into the terminal. For HYSPLIT, the model was successful in being able to take the UI input, calculate the results from the inputs and output multiple figures of both total volumetric airborne concentrations and surface deposition. We used the Pu-238 Derived Intervention Level (DIL) deposition thresholds for produce, dairy, and beef for visualization of the surface deposition, showing how a release would impact ingestion pathways.

38 RADIATION CHEMISTRY, RADIOCHEMISTRY, AND NUCLEA↗
DOE OSTI2021

In situ TEM observation of calcium silicate hydrate nanostructure at high temperatures

Fire poses a substantial threat to concrete structures because calcium silicate hydrate (C-S-H) is not thermally stable at high temperatures. Herein, in situ TEM at temperatures from 20 to 800 °C was conducted to study the thermal-induced structural changes in C-S-H. We captured C-S-H shrinks at an average rate of 0.02 μm{sup 2}/{sup o}C upon heating with three stages observed, including induction, constant, and rapid periods. Our observation revealed that an 800 nm pore could be healed during pore structure evolution owing to the reconstruction and deformation among C-S-H blocks. The Ca/Si ratio was dropped at higher temperatures because of the leakage of calcium ions from the C-S-H structure to form CaO precipitates. The temperature-driven phase transformation and degradation were also detected using electron diffraction that C-S-H was transformed into metastable calcium silicate minerals above 800 °C. This work provides insights into the nanoscale transformation of C-S-H at high temperatures.

36 MATERIALS SCIENCE↗
DOE OSTI2021

Radiation Dispersal Devices. A brief overview [Slides]

In this presentation I lump together the "classified RDD" - a dispersion of aerosolized radioactive material - with the nefarious use of radioactive materials. This can include other means of dispersal as well as an RED - a Radiological Exposure Device. This combination is because the threat is the nefarious use of radioactive material, and most of our concerns are in regards to the loss of control of the material, potential(s) for misuse, and detection.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2021

Metagames and Hypergames for Deception-Robust Control

Cyber-physical systems (CPSs) consist of computing and communication devices integrated with physical components such as sensors and actuators. Increasing connectivity to the Internet for remote monitoring and control has made CPSs more vulnerable to deliberate attacks, which are distinctly different from random perturbations in the system. This provides a way for purely cyber attacks to have physical consequences. Stuxnet is a prominent example of such an attack, one in which the malware acted over an extended period of time while deliberately remaining undetected. Such attacks can be described as Advanced Persistent Threats (APTs) -- long-term, stealthy attacks. Here, we extend our previous work on hypergames to develop defender strategies that are robust to deception and do not rely on attack detection. We prove that the defender can bound the attacker payoff with these strategies even when the attacker can choose between different attack modes, and we numerically demonstrate our approach on a realistic building control system. Finally, we discuss next steps in extending this approach towards an operational capability.

hypergames, cyber-physical systems, robust control↗
DOE OSTI2022

WISP: Watching grid Infrastructure Stealthily through Proxies (Final Technical Report)

The complex interdependencies of cyber systems (sensors and communications), physical grids and associated electricity market operations make protecting electric power grids a significant challenge. The energy sector is constantly under new, targeted, advanced and dangerous cyber-attacks that have the potential to result in the loss of human life. These threats are further exacerbated by our need to modernize the grid. One focus of cyber security research in smart grids is the securing of the SCADA system through advanced intrusion detection systems (IDS) and bad data detection algorithms in state estimation. These methods either require full knowledge of the system topology and parameters or fail to understand the physical behaviors under attack. WISP (Watching grid Infrastructure Stealthily through Proxies) is designed to provide additional protection to the power grid using only publicly available data. In particular, WISP exploits the spatio-temporal nature of the real time locational marginal prices (LMPs), in conjunction with other information such as bids, weather, outages and load data to analyze anomalous power pricing behaviors and then correlate those observations to localize regions of interest and identify potential cyber events. WISP is non-intrusive as the tool is deployed as a service in the Cloud or on premise and provides reliable information to system operators for enhanced situational awareness, without impeding energy delivery functions. The WISP technology comprises three modules: the data-driven anomaly detection core, the vulnerability and risk analysis and the root cause analysis. The data-driven anomaly detection core performs the tasks of feature selection, anomaly detection and attack region localization. The vulnerability and risk analysis module provides system level information of the vulnerable variables and times, assisting the operators in selecting monitoring and protection nodes. The root cause analysis module takes the detection results and identifies potential operational conditions that contribute to the detected anomalies. In Phase I, we have demonstrated the feasibility and effectiveness of WISP. We developed a realistic electricity market simulator capable of generating normal and attack market data under various operational conditions. We developed a series of cyber-attack detection and analysis algorithms and evaluated them under multiple data sources. Finally, we integrated all modules into an end-to-end software, providing functions for data management, data analytics and visualization. Specifically, we have achieved: (i) real-time data acceptance from external utility interfaces with >99% acceptance rate; (ii) high performance anomaly detection algorithms with >98% detection accuracy and <0.1% false alarm rate; and (iii) ultra-low computing delay <50 milliseconds. Additionally, our team developed algorithms to identify the vulnerable variables in electricity market operations and root cause analysis functions to identify major contributors to the price spikes. These ancillary modules are necessary when deploying WISP in real world industry environment. In Phase II, we have demonstrated the effectiveness of WISP software on realistic largescale power systems. We performed red team testing for the Phase I WISP software and identified software vulnerabilities and implemented corresponding mitigation solutions. We adapted the electricity market simulator for the Texas synthetic 2000-bus system and generated datasets for the false data injection attacks. We created database and visualization interfaces for the Texas system and the ISO New England system. We performed software optimization in terms of operation efficiency, computing speed and detection accuracy. Finally, we tested the software on the Texas system and the ISO New England system and evaluated the detection performance. Overall, we achieved above 89% detection rate, below 3% false alarm rate and below 37 seconds of end-to-end detection delay.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2025

Cybersecurity Incident Response Guide for Wind

As wind energy systems become increasingly digitized and interconnected, they face a growing array of cyber threats that can disrupt operations, compromise safety, and trigger cascading impacts across the energy ecosystem. The Wind Incident Response Guide provides a structured, wind-specific framework for preparing for, detecting, responding to, and recovering from cyber incidents. Drawing on lessons from field demonstrations, cyber-physical testbeds, and stakeholder engagement across the wind sector, this guide integrates technical, operational, and regulatory considerations to support asset owners, operators, and responders. It outlines key roles and responsibilities, maps incident response phases to wind-specific scenarios, and highlights applicable laws, regulations, standards, and best practices. By tailoring general cybersecurity principles to the unique architectures and operational constraints of wind systems—including remote access, legacy components, and environmental interfaces—this guide aims to enhance resilience, reduce response time, and support coordinated action across public and private stakeholders. It is intended as a practical resource for utilities, developers, regulators, and emergency managers working to secure the future of wind energy.

17 - WIND ENERGY↗
DOE OSTI2022

Establishment of a reverse transcription real-time quantitative PCR method for Getah virus detection and its application for epidemiological investigation in Shandong, China

Getah virus (GETV) is a mosquito-borne, single-stranded, positive-sense RNA virus belonging to the genus Alphavirus of the family Togaviridae . Natural infections of GETV have been identified in a variety of vertebrate species, with pathogenicity mainly in swine, horses, bovines, and foxes. The increasing spectrum of infection and the characteristic causing abortions in pregnant animals pose a serious threat to public health and the livestock economy. Therefore, there is an urgent need to establish a method that can be used for epidemiological investigation in multiple animals. In this study, a real-time reverse transcription fluorescent quantitative PCR (RT-qPCR) method combined with plaque assay was established for GETV with specific primers designed for the highly conserved region of GETV Nsp1 gene. The results showed that after optimizing the condition of RT-qPCR reaction, the minimum detection limit of the assay established in this study was 7.73 PFU/mL, and there was a good linear relationship between viral load and Cq value with a correlation coefficient ( R 2 ) of 0.998. Moreover, the method has good specificity, sensitivity, and repeatability. The established RT-qPCR is 100-fold more sensitive than the conventional RT-PCR. The best cutoff value for the method was determined to be 37.59 by receiver operating characteristic (ROC) curve analysis. The area under the curve (AUC) was 0.956. Meanwhile, we collected 2,847 serum specimens from swine, horses, bovines, sheep, and 17,080 mosquito specimens in Shandong Province in 2022. The positive detection rates by RT-qPCR were 1%, 1%, 0.2%, 0%, and 3%, respectively. In conclusion, the method was used for epidemiological investigation, which has extensive application prospects.

Cao, Xinyu↗
DOE OSTI2023

Reverse-zoonoses of 2009 H1N1 pandemic influenza A viruses and evolution in United States swine results in viruses with zoonotic potential

The 2009 H1N1 pandemic (pdm09) lineage of influenza A virus (IAV) crosses interspecies barriers with frequent human-to-swine spillovers each year. These spillovers reassort and drift within swine populations, leading to genetically and antigenically novel IAV that represent a zoonotic threat. We quantified interspecies transmission of the pdm09 lineage, persistence in swine, and identified how evolution in swine impacted zoonotic risk. Human and swine pdm09 case counts between 2010 and 2020 were correlated and human pdm09 burden and circulation directly impacted the detection of pdm09 in pigs. However, there was a relative absence of pdm09 circulation in humans during the 2020–21 season that was not reflected in swine. During the 2020–21 season, most swine pdm09 detections originated from human-to-swine spillovers from the 2018–19 and 2019–20 seasons that persisted in swine. We identified contemporary swine pdm09 representatives of each persistent spillover and quantified cross-reactivity between human seasonal H1 vaccine strains and the swine strains using a panel of monovalent ferret antisera in hemagglutination inhibition (HI) assays. The swine pdm09s had variable antigenic reactivity to vaccine antisera, but each swine pdm09 clade exhibited significant reduction in cross-reactivity to one or more of the human seasonal vaccine strains. Further supporting zoonotic risk, we showed phylogenetic evidence for 17 swine-to-human transmission events of pdm09 from 2010 to 2021, 11 of which were not previously classified as variants, with each of the zoonotic cases associated with persistent circulation of pdm09 in pigs. These data demonstrate that reverse-zoonoses and evolution of pdm09 in swine results in viruses that are capable of zoonotic transmission and represent a potential pandemic threat.

60 APPLIED LIFE SCIENCES↗
DOE OSTI2020

Hypergames and Cyber-Physical Security for Control Systems

The identification of the Stuxnet worm in 2010 provided a highly publicized example of a cyber attack that physically damaged an industrial control system. This raised public awareness about the possibility of similar attacks against other industrial targets—including critical infrastructure. Here, we use hypergames to analyze how strategic perturbations of sensor readings and calibrated parameters can be used to manipulate a system that employs optimal control. Hypergames form an extension of game theory that enables us to model strategic interactions where the players may have significantly different perceptions of the game(s) they are playing. Past work with hypergames has focused on relatively simple interactions consisting of a small set of discrete choices for each player. Here, we apply single-stage hypergames to larger systems with continuous variables. We find that manipulating constraints can be a more effective attacker strategy than manipulating objective function parameters. Moreover, the attacker need not change the underlying system to carry out a successful attack—it may be sufficient to deceive the defender controlling the system. It is possible to scale our approach up to even larger systems, but this will depend on the characteristics of the system in question, and we identify several characteristics that will make those systems amenable to hypergame analysis.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

Radio Frequency Spectrum Audit to Inventory Private Cellular Base Station Infrastructure

The ever-changing cellular communication landscape makes it difficult to identify, map, and localize cellular base stations. Localizing cellular base stations provides various advantages, including information security, cybersecurity, spectrum management, and interference detection. For example, the MITRE ATT&CK® (Adversarial Tactics, Techniques, and Common Knowledge architecture) [1] and Common Attack Pattern Enumeration and Classification [2] emphasize the importance of being able to minimize the cyber security threat presented by unregulated private cellular base stations (PCBS). The majority of published research looks at the malicious use of PCBSs and focuses on using data retrieved from user equipment (UE), data obtained from an application on the UE, or data shared between the UE and a mobile network to locate it. This innovative strategy, however, focuses on the passively discovered uniqueness of radio frequency (RF) transmissions from commercial cellular infrastructure received in a designated monitoring position (DMP).

42 ENGINEERING↗
DOE OSTI2022

Network Anomaly Detection Using Federated Learning

The internet is turning out to be an integral part of every-one's lives as more and more devices are being connected to serve societal needs. Our work is motivated by two ma-jor observations. Firstly, one drawback of connecting to the network is the threat of network attacks that can compromise users' private information, leading to data loss and adversely affecting productivity. There are several traditional security mechanisms to defend against these attacks, such as firewalls, virtual private networks (VPNs), demilitarized zones (DMZs), and vulnerability scanners. One way to prevent these attacks is early detection and prevention. However, these kinds of architecture do not scale very well because of their centralized nature. Secondly, we observe from heuristics and data set distributions that the majority of the requests made to a server are innocuous. Therefore, almost all server request data sets are highly imbalanced, weighted highly towards the harmless requests.

Marfo, William↗
DOE OSTI2020

Cybersecurity Attacks in Vehicular Sensors

Today's modern vehicles contain anywhere from sixty to one-hundred sensors and exhibit the characteristics of Cyber-Physical-Systems (CPS). There is a high degree of coupling, cohesiveness, and interactions among vehicle's CPS components (e.g., sensors, devices, systems, systems-of-systems) across sensing, communication, and control layers. Cyber-attacks in the sensing or communication layers can compromise the security of the control layer. This paper provides a detailed review of potential cyber threats related to the sensing layer. Notably, the focus is mainly towards two categories of sensors: vehicle dynamics sensors (e.g., Tire Pressure Monitoring Systems (TPMS), magnetic encoders, and inertial sensors) and environment sensors (e.g., Light Detection and Ranging (LiDAR), ultrasonic, camera, Radio Detection and Ranging (Radar) systems, and Global Positioning System (GPS) units). Furthermore, the paper also offers perspectives through existing countermeasures from literature and stresses the need for data-driven cybersecurity solutions.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

Essence2.0 Development and Deployment (Final Report)

The objective of the project was to take two core technologies that have been developed under the Recipient’s solid laboratory products and integrate them into a single CyberPhysical awareness platform and complete development on current field-tested prototypes that will extend the integrated capability of the platform. During the final development phase, the Recipient development team and its selected industry partners tested and hardened the platform to ensure resilient and secure operation of the integrated platform. The team also executed substantial field testing and established the framework for defining the organization and/or commercial infrastructure needed to sustain operations and provide readiness for a national scale deployment. The focus of the project was (1) the improvement, refinement, and deployment of technology for the detection of cyber-attacks on utility operational technology (OT) and information technology (IT) networks and assets, including Supervisory Control and Data Acquisition Systems (SCADA) systems; and (2) support for containment and remediation of adversarial threats and actions against those systems and environments.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗