Search NASA⌕ Search

SEARCH · Search NASA

Results for “Threat Detection”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 235 records · Page 13
All sourcesNASA NTRSDOE OSTI
DOE OSTI2022

Smart sensor for online situational awareness in power grids

Waveforms in power grids typically reveal a certain pattern with specific features and peculiarities driven by the system operating conditions, internal and external uncertainties, etc. This prompts an observation of different types of waveforms at the measurement points (substations). An innovative next-generation smart sensor technology includes a measurement unit embedded with sophisticated analytics for power grid online surveillance and situational awareness. The smart sensor brings additional levels of smartness into the existing phasor measurement units (PMUs) and intelligent electronic devices (IEDs). It unlocks the full potential of advanced signal processing and machine learning for online power grid monitoring in a distributed paradigm. Within the smart sensor are several interconnected units for signal acquisition, feature extraction, machine learning-based event detection, and a suite of multiple measurement algorithms where the best-fit algorithm is selected in real-time based on the detected operating condition. Embedding such analytics within the sensors and closer to where the data is generated, the distributed intelligence mechanism mitigates the potential risks to communication failures and latencies, as well as malicious cyber threats, which would otherwise compromise the trustworthiness of the end-use applications in distant control centers. The smart sensor achieves a promising classification accuracy on multiple classes of prevailing conditions in the power grid and accordingly improves the measurement quality across the power grid.

Dehghanian, Payman↗
DOE OSTI2022

Master State Threat Identifier (masti)

The MSE cyber sensor offers a novel approach for scalable network monitoring using heterogeneous computing. Packet data is collected, analyzed, and stored by a stand alone cyber sensor. Machine learning algorithms are run to discover patterns in the communication without the need for deep packet inspection. Tuning of the detection algorithms happens automatically, without need for an engineer to manually create detection rules.

Russell, PierceL↗
DOE OSTI2021

How Cooperative Engagement Programs Strengthen Sequencing Capabilities for Biosurveillance and Outbreak Response

The threat of emerging and re-emerging infectious diseases continues to be a challenge to public and global health security. Cooperative biological engagement programs act to build partnerships and collaborations between scientists and health professionals to strengthen capabilities in biosurveillance. Biosurveillance is the systematic process of detecting, reporting, and responding to especially dangerous pathogens and pathogens of pandemic potential before they become outbreaks, epidemics, and pandemics. One important tool in biosurveillance is next generation sequencing. Expensive sequencing machines, reagents, and supplies make it difficult for countries to adopt this technology. Cooperative engagement programs help by providing funding for technical assistance to strengthen sequencing capabilities. Through workshops and training, countries are able to learn sequencing and bioinformatics, and implement these tools in their biosurveillance programs. Cooperative programs have an important role in building and sustaining collaborations among institutions and countries. One of the most important pieces in fostering these collaborations is trust. Trust provides the confidence that a successful collaboration will benefit all parties involved. With sequencing, this enables the sharing of pathogen samples and sequences. Obtaining global sequencing data helps to identify unknown etiological agents, track pathogen evolution and infer transmission networks throughout the duration of a pandemic. Having sequencing technology in place for biosurveillance generates the capacity to provide real-time data to understand and respond to pandemics. We highlight the need for these programs to continue to strengthen sequencing in biosurveillance. By working together to strengthen sequencing capabilities, trust can be formed, benefitting global health in the face of biological threats.

60 APPLIED LIFE SCIENCES↗
DOE OSTI2022

Reinforcement Learning for feedback-enabled cyber resilience

The rapid growth in the number of devices and their connectivity has enlarged the attack surface and made cyber systems more vulnerable. As attackers become increasingly sophisticated and resourceful, mere reliance on traditional cyber protection, such as intrusion detection, firewalls, and encryption, is insufficient to secure the cyber systems. Cyber resilience provides a new security paradigm that complements inadequate protection with resilience mechanisms. A Cyber-Resilient Mechanism (CRM) adapts to the known or zero-day threats and uncertainties in real-time and strategically responds to them to maintain the critical functions of the cyber systems in the event of successful attacks. Feedback architectures play a pivotal role in enabling the online sensing, reasoning, and actuation process of the CRM. Reinforcement Learning (RL) is an important gathering of algorithms that epitomize the feedback architectures for cyber resilience. It allows the CRM to provide dynamic and sequential responses to attacks with limited or without prior knowledge of the environment and the attacker. In this work, we review the literature on RL for cyber resilience and discuss the cyber-resilient defenses against three major types of vulnerabilities, i.e., posture-related, information-related, and human-related vulnerabilities. Here we introduce moving target defense, defensive cyber deception, and assistive human security technologies as three application domains of CRMs to elaborate on their designs. The RL algorithms also have vulnerabilities themselves. We explain the major vulnerabilities of RL and present develop several attack models where the attacker target the information exchanged between the environment and the agent: the rewards, the state observations, and the action commands. We show that the attacker can trick the RL agent into learning a nefarious policy with minimum attacking effort. The paper introduces several defense methods to secure the RL-enabled systems from these attacks. However, there is still a lack of works that focuses on the defensive mechanisms for RL-enabled systems. Last but not least, we discuss the future challenges of RL for cyber security and resilience and emerging applications of RL-based CRMs.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

1. Physical Security Engineering by Design for Nuclear Facilities; 2. Nuclear Power Plant Site Security Management – A Security Strategy; 3. The UAE Women in Nuclear Energy Security

1. Security by design, or SeBD, is a comprehensive approach that integrates the physical protection system of a nuclear plant into every stage of its existence. This includes planning, designing, constructing, commissioning, and operating the facility, using a combination of analytical, physical, technological, and procedural measures. Essentially, SeBD involves intentionally applying and incorporating security into all aspects of design and operation throughout the entire lifecycle of a facility. By implementing this methodology throughout various phases such as program development, process implementation, staff training and procedures management in conjunction with plant equipment, facilities can be optimized to minimize security risks without compromising functional design requirements. This ultimately improves the overall security posture of the site and reduces the need for costly modifications or additional security resources post-design. 2. A site security strategy is a living document that is revised on a periodic or event-driven basis, ensuring that site security operations and corresponding procedures provide long-term, effective protection for the entire nuclear power plant (NPP) site. A site security strategy aims to mitigate threats across the entire NPP site via in-depth defense approaches and mutual support; therefore, if a layer is omitted or altered, then the effect across all layers must be re-evaluated. Therefore, the aim of the site security strategy is to provide an appropriate, scalable security regime that deters, denies, delays, and detects incidents and, equally importantly, reassures legitimate users and the regulator that due diligence and regulatory compliance have been achieved, ensuring that the site is safe and secure. Robust access control for vehicles and pedestrians is at the heart of the strategy. Vehicle and pedestrian searching and screening are seen as the strongest mitigation methods against vehicle- and pedestrian-borne attacks. The security strategy must also be supported through comprehensive staff training and the development of robust processes, procedures, and planning. If all these measures are to be effective, then training must be implemented during each phase of construction, partial operation/commissioning, and full operation. No single element of site security is completely isolated from the influence of other elements. Ideally, consideration of all key elements will result in a security strategy that is integrated and proportional to the threat and that does not over specify individual security solutions through the application of isolated measures but rather applies a holistic, all-encompassing approach. 3. When women enter the labor force, numerous positive outcomes emerge, including increased GDP, educational gains, and decreased maternal mortality. Despite these benefits, women's employment rates and equality vary significantly worldwide as does support for women in the workforce. This paper will explore the multifaceted benefits of women's employment, the factors influencing labor force participation rates, and the urgency to achieve gender equality as outlined in the 2015 United Nations Sustainable Development Goals (SDGs). It will then examine the emerging presence of women in the traditionally male-dominated nuclear field, specifically within the United Arab Emirates (UAE) as a testament to their resilience and determination to break social norms and advance gender equality.

Zineddin, Dr. Z.↗
DOE OSTI2021

Laser ablation spectrometry for studies of uranium plasmas, reactor monitoring, and spent fuel safety

Nuclear security is one of the defining challenges of our time. Nuclear threats range from deliberate dispersal of radioactive material to contaminate the vital infrastructure to diversion and smuggling of special nuclear material for clandestine nuclear programs and nuclear terrorism, respectively. There is an associated need to develop and sustain the nuclear forensics capabilities, which requires the understanding of complex processes that occur in plasmas of nuclear materials. The area of nuclear safety has seen a resurgence of public interest, and there is a concomitant need to safely store used nuclear fuel and detect structural material failure in nuclear power systems, especially in innovative reactor designs envisioned for future adoption. Laser-produced plasmas are complicated extreme environments that can generate intense and rich, highly specific signatures of nuclear and radiological materials, which can then be explored in a wide range of applications. They include interdiction and rapid detection of nuclear materials, including their isotopic composition, detection over long distances, laboratory simulation of weapons effects, monitoring the condition of structural materials in dry cask storage containers, and novel instrumentation for nuclear power systems. We present a compilation of recent representative examples of the application of laser spectroscopy, and laser-induced breakdown spectroscopy in particular, to nuclear safety and security problems. A case is made that spectroscopic techniques based on laser-produced plasmas offer complementary, and sometimes unique, capabilities that motivate the continued exploration of their efficient production and understanding of the signatures they produce

(020.3260) Isotope shifts, (140.3440) Laser-induce↗
DOE OSTI2023

Deep Deception: Exemplars of Adversarial Machine Learning and Countermeasures Applicable to International Safeguards

As a follow-up to our more comprehensive report on Adversarial Machine Learning (AML), here we provide demonstrations of AML attacks against the Limbo image database of UF6 cylinders in a variety of orientations and amongst a variety of distractor images. We demonstrate the Carlini & Wagner AML attack against a subset of Limbo images, with 100% attack success rate; meaning all attacked images were misclassified by a highly accurate trained model, yet the image changes were imperceptible to the human eye. We also demonstrate successful attacks against segmented images (images with more than one targeted object). Finally, we demonstrated the Fast Fourier Transform countermeasure that can be used to detect AML attacks on images. The intent of this and our previous report is to inform the IAEA and stakeholders of both the promise of machine learning, which could greatly improve the efficiency of surveillance monitoring, but also of the real threat of AML and potential defenses.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2020

SHARP-Net: Platform for Self-Healing and Attack Resilient PMU Networks

Synchrophasor technology plays a pivotal role in developing the next generation of wide-area monitoring, protection, and control in the smart grid environment. As technology and communications infrastructures evolve, however, so do the attack surfaces in the synchrophasor network that can be exploited by advanced persistent threat (APT) actors to affect power system stability and reliability. In this paper, we propose a novel platform for developing a self-healing and attack-resilient PMU network (SHARP-Net) by instituting a state-of-the-art intrusion detection system (IDS) with an intrusion mitigation system (IMS) and an alert management system (AMS). In particular, the proposed platform detects anomalies during cyberattacks on phasor data concentrators (PDCs) based on the rules defined in the IDS, then the generated alerts are published to the IMS through the AMS. The proposed IMS proceeds to take automated corrective responses to mitigate cyberattacks by reconfiguring the synchrophasor network to isolate the compromised PDCs, and it orchestrates new PDCs to prevent the future propagation of attacks. Further, the IMS restores the system's observability by reconnecting the new PDCs to make the grid attack-resilient. In this work, the SHARP-Net platform is developed by using Python-based libraries, minimega's software-defined network, and virtual machine orchestration. We implement and validate the proposed SHARP-Net architecture by testing a PMU network in the smart grid environment. SHARP-Net showed promising performance in detecting cyberattacks and mitigating them through the network reconfiguration.

computer architecture↗
DOE OSTI2024

Rapid Monitoring and Defense Approach for Resilience Improvement of Grid Cyber Security

Cyber-physical systems and electric utilities significantly depend on the reliability and efficiency of information and operational technology. However, false data injection attacks based on synchrophasor measurement data pose a serious threat to the safe and reliable operation of modern power systems. Here, to mitigate this problem, a rapid monitoring and defense approach is proposed to defend against cyber attacks. Initially, the Time and Frequency based Convolutional neural Network (TFCN) is proposed to detect different types of attacks. Within the TFCN, the advances are that both time and frequency domain information can be fused without extra spectrum analysis methods, and can save detection time to speed the calculation efficiency using the developed time-frequency block. Next, a comprehensive defense strategy is developed for multiple cyber attacks to ensure the stability and resilience of the power system according to the feedback detection results. The advances of this strategy are that different control strategies can be automatically selected to recover the stability to the greatest extent according to the detected attacks. To verify the effectiveness of the proposed approach, the high-speed frequency measurements collected from the wide-area monitoring system are used. The results demonstrate that the cyber attack detection performance can reach 95.57% accuracy, outperforming both traditional and some advanced neural networks. Importantly, the defense strategy is conducted and verified in a modified IEEE 39 bus system as well, which illustrates profound performance in faster stability restoration.

Comprehensive defense strategy↗
DOE OSTI2023

Complete Performance Comparison Between the Optimized Image Construction Algorithm (U-MBIR) and the Existing Reconstruction Algorithm for Detecting Defects and Damage in Concrete

Reinforced concrete (RC) is a composite material subjected to mechanical, thermal, and chemical loads throughout its service life. Because of these external stressors and the susceptibility of RC structural members to shrinkage and microcracking, the material degrades throughout its life cycle. This deterioration can lead to a decrease in member capacity and, ultimately, poses a threat to the structural integrity. Thus, it is crucial that the damage caused by aging and degradation be monitored and assessed at regular intervals throughout the material’s service life. Since coring of the material is typically not feasible for in-service structural systems, non-destructive evaluation (NDE) methodologies are used to assess remaining structural capacity. NDE methods enable surface and subsurface examination without damaging or degrading the medium. Moreover, RC is a critical component of nuclear power plants; thus, its safety and reliability must be thoroughly examined throughout the life cycle of the structural system. Ultrasonic measurements have been an industry standard for both surface and subsurface inspections. To this end, Oak Ridge National Laboratory (ORNL) has researched and developed advanced image reconstruction algorithms to capture internal damage. The results and discussion presented herein summarize the current state of the ultrasonic model–based iterative reconstruction (U-MBIR) algorithm developed at ORNL. More specifically, this report presents a comparison between reconstruction images produced via a widely employed ultrasonic NDE technique—the synthetic aperture focusing technique (SAFT)—and the ORNL-developed U-MBIR algorithm. These NDE methodologies are demonstrated using ultrasonic data collected from four concrete specimens. Overall, the U-MBIR algorithm eliminates artifacts and noise that are typically present within the SAFT reconstructions, and it shows defects and anomalies more clearly than the SAFT images. In conclusion, this algorithm is suitable for identifying concrete defects, although more improvements and optimization could be done to better define internal defects.

36 MATERIALS SCIENCE↗
DOE OSTI2021

Shotgun Immunoproteomic Approach for the Discovery of Linear B-Cell Epitopes in Biothreat Agents Francisella tularensis and Burkholderia pseudomallei

Peptide-based subunit vaccines are coming to the forefront of current vaccine approaches, with safety and cost-effective production among their top advantages. Peptide vaccine formulations consist of multiple synthetic linear epitopes that together trigger desired immune responses that can result in robust immune memory. The advantages of linear compared to conformational epitopes are their simple structure, ease of synthesis, and ability to stimulate immune responses by means that do not require complex 3D conformation. Prediction of linear epitopes through use of computational tools is fast and cost-effective, but typically of low accuracy, necessitating extensive experimentation to verify results. On the other hand, identification of linear epitopes through experimental screening has been an inefficient process that requires thorough characterization of previously identified full-length protein antigens, or laborious techniques involving genetic manipulation of organisms. In this study, we apply a newly developed generalizable screening method that enables efficient identification of B-cell epitopes in the proteomes of pathogenic bacteria. As a test case, we used this method to identify epitopes in the proteome of Francisella tularensis (Ft), a Select Agent with a well-characterized immunoproteome. Our screen identified many peptides that map to known antigens, including verified and predicted outer membrane proteins and extracellular proteins, validating the utility of this approach. We then used the method to identify seroreactive peptides in the less characterized immunoproteome of Select Agent Burkholderia pseudomallei (Bp). This screen revealed known Bp antigens as well as proteins that have not been previously identified as antigens. Although B-cell epitope prediction tools Bepipred 2.0 and iBCE-EL classified many of our seroreactive peptides as epitopes, they did not score them significantly higher than the non-reactive tryptic peptides in our study, nor did they assign higher scores to seroreactive peptides from known Ft or Bp antigens, highlighting the need for experimental data instead of relying on computational epitope predictions alone. The present workflow is easily adaptable to detecting peptide targets relevant to the immune systems of other mammalian species, including humans (depending upon the availability of convalescent sera from patients), and could aid in accelerating the discovery of B-cell epitopes and development of vaccines to counter emerging biological threats.

60 APPLIED LIFE SCIENCES↗
DOE OSTI2023

Reinforcement Learning Approach to Cybersecurity in Space (RELACSS)

Securing satellite groundstations against cyber-attacks is vital to national security missions. However, these cyber threats are constantly evolving. As vulnerabilities are discovered and patched, new vulnerabilities are discovered and exploited. In order to automate the process of discovering existing vulnerabilities and the means to exploit them, a reinforcement learning framework is presented in this report. We demonstrate that this framework can learn to successfully navigate an unknown network and detect nodes of interest despite the presence of a moving target defense. The agent then exfiltrates a file of interest from the node as quickly as possible. This framework also incorporates a defensive software agent that learns to impede the attacking agents progress. This setup allows for the agents to work against each other and improve their abilities. We anticipate that this capability will help uncover unforeseen vulnerabilities and the means to mitigate them. The modular nature of the framework enables users to swap out learning algorithms and modify the reward functions in order to adapt the learning tasks to various use cases and environments. Several algorithms, viz., tabular Q learning, deep Q networks, proximal policy optimization, advantage actor-critic, generative adversarial imitation learning, are explored for the agents and the results highlighted. The agent learns to solve the tasks in a light-weight abstract environment. Once the agent learns to perform sufficiently well, it can be deployed in a minimega virtual machine environment (or a real network) with wrappers that map abstract actions to software commands. The agent also uses a local representation of the actions called a ‘slot-mechanism’. This allows the agent to learn in a certain network and generalize it to different networks. The defensive agent learns to predict the actions taken by an offensive agent and uses that information to anticipate the threat. This information can then either be used to raise an alarm or to take actions to thwart the attack. We believe that with the appropriate reward design, a representative environment, and action set, this framework can be generalized to tackle other cybersecurity tasks. By sufficiently training these agents, we can anticipate vulnerabilities leading to robust future designs. We can also deploy automated defensive agents that can help secure satellite groundstation and their vital national security missions.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Threat Agnostic Virulence Assessment of Pathogens

Virulence assessment of new, emerging, and engineered pathogens is critical to mounting an appropriate response to a biothreat agent. The capacity of the pathogen to colonize human and harm tissues must be characterized to understand pathogenicity pathways and optimize diagnosis and treatment of resulting disease. Respiratory pathogens are of interest because they can have high transmissibility rates, as observed with the SARS-CoV-2 virus, the causative agent of Covid-19. Current technologies are insufficient to assess threats due to their reliance on systems with only one cell type and on sequencing the pathogen. However, it is known that sequence is not an accurate predictor of function, and sequencing can be unreliable for newly emerged or engineered pathogens. An ideal system would consist of relevant epithelial cell types and an assay sensitive enough to detect changes in host responses that do not rely on DNA sequencing. We chose a system consisting of host lung epithelial cells that can be used to assess the virulence of unknown respiratory pathogens. We interrogated pathogens using this model and assess features of pathogenicity. Our objective is to leverage PNNLs strengths in tissue engineering and proteomics capabilities to build a multiple reaction monitoring (MRM) or parallel reaction monitoring (PRM) liquid chromatography-tandem mass spectrometry assay for human host cell proteins whose abundance is influenced by infection. These responses can were then assessed for relative virulence using pathogen agnostic signatures. When confronted with a pathogen, cells activate dedicated signaling pathways, typically through phosphorylation of regulatory proteins and downstream activation of host cell networks.

59 BASIC BIOLOGICAL SCIENCES↗
DOE OSTI2025

Test and Evaluation of Radiofrequency Tamper Indicating Devices for Remote Monitoring of Advanced/Small Modular Reactors

Advanced and small modular reactors (A/SMRs), due to their versatile nature, are likely to be used in remote locations to provide electrical power or other services in regions that are difficult to access or have limited transportation infrastructure. This will result in limited on-site staff, therefore driving A/SMR vendors to consider remote monitoring as a solution to support nuclear security. Maintaining Continuity of Knowledge (CoK) of nuclear material quantities and locations is vital to nuclear security, and remote monitoring of active tamper indicating devices (TIDs) has been well established as a component of International Atomic Energy Agency (IAEA) Safeguards since the early 2000s. Active TIDs, such as radiofrequency TIDs (RFTIDs), immediately alarm upon unauthorized access attempts, promoting timely detection. In contrast, passive TIDs require a surveillance regime and offer delayed detection. Active TIDs deter insiders and enable prompt detection of malicious acts. They can be used on nuclear material containers and controlled entry points like vaults and toolboxes. Therefore, the implementation of RFTIDs into security programs bolsters overall nuclear material control, and provides a visible deterrent, with primary efficacy in mitigating the insider threat and potentially allowing for Security by Design considerations. They are a strong candidate technology for maintaining nuclear security of A/SMRs but need to be evaluated for feasibility and implementation into the wider physical protection system.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2025

Performance Evaluation of Vertical Federated Machine Learning Against Adversarial Threats on Wide-Area Control System: Preprint

Federated machine learning (FL) is gaining significant popularity to develop cybersecurity solutions in power grids because of its advanced capability to support decentralized data handing at local devices, its privacy preservation, and its low-bandwidth requirement. However, the evolving adversarial machine learning (AML) threats raise significant concerns for the cybersecurity of FL architectures. The FL-based split neural network (SplitNN) achieves high performance through the decentralized training of local neural network models while preserving data privacy across multiple entities. In this paper, we propose a methodology for evaluating the performance of a vertical FLbased anomaly detector against different types of AML attacks, including denial-of-service attacks, adversarial data injection attacks, and replay attacks on the trained local models deployed in the grid network. For a case study, we consider the modified IEEE 13-bus system, and we develop SplitNN-based binary and multiclass classification models to detect, locate, and identify different types of data integrity attacks on the volt-watt control with two pooling layers: maximum pooling and AvgPool. Our experimental results, computed through performance metrics, reveal that the severity of these AML attacks varies with the integrated pooling mechanism, the type of classification model, and the nature of the cyberattack. Further, the AML attacks negatively impacted the prediction time per sample for the pretrained SplitNN during the online testing.

adversarial threats↗
DOE OSTI2022

Systems and Implementation: Integrating Unmanned Aircraft Systems into Physical Protection Systems at Fixed Sites and During Transportation

Physical protection systems, and response forces in particular, are designed to prevent an adversary from successfully completing a malevolent act against a facility or transport operations. Timely detection and assessment of any potential adversary action against a target is an essential element of materials security. The timely detection and assessment must then be followed-up by a capable and timely response that might be enhanced with the additional situational awareness provided by unmanned aircraft systems (UAS). The United States Department of Energy’s National Nuclear Security Administration Office of International Nuclear Security has been exploring capabilities provided by UAS to support response force operations within the physical protection system. UAS have the potential to provide response force commanders and operators with situational awareness in assessing adversary locations and actions as well as the locations of responders. UAS may be utilized for area searches ahead of responder pathways to identify potential threats and to provide situational awareness of areas not normally covered by cameras (such as areas outside the fence line outside at fixed facilities). In addition, UAS can provide real-time information to transportation convoy teams that pass through constantly changing public access environments. This paper will provide operational recommendations to be addressed when integrating UAS into existing physical protection systems at fixed sites and during transport. Recommendations will include aspects of the following: needs analysis; tactics and techniques to support detection and assessment as well as response force deployment; remote pilot selection, qualifications, training, and currency; UAS selection criteria; UAS laws and regulations; possible cost sharing with other facility operations; and on-scene emergency management.

Stockwell, Brandon↗
DOE OSTI2022

Cyber risk assessment and investment optimization using game theory and ML-based anomaly detection and mitigation for wide-area control in smart grids

The electric power grid is increasingly becoming susceptible to cyber attacks that exploit vulnerabilities in the smart grid control, information, and physical layers. Successful cyber attacks can have catastrophic impacts on the social and economic well-being of any nation all over the globe. It has, thus, become imperative to secure the smart grid against such adversarial actions to ensure stable, secure, and reliable operation of the grid. The existing research and industry practices prove to be inadequate in terms of providing pragmatic and effective defense methodologies and measures for long-term cybersecurity planning and real-time cybersecurity for grid operation. For example, existing works lack models that incorporate uncertain behavior of cyber-attackers and pragmatic defense measures for cyber risk assessment and cybersecurity investment optimization which often provide unreliable and strictly qualitative solutions to these problems. At the same time, with the growing number of cyber incidents in the grid, there still exists a need to develop attack-resilient algorithms for wide-area monitoring, protection, and control (WAMPAC) applications like the wide-area voltage control systems (WAVCS) for Flexible AC Transmissions Systems (FACTS) that lack in scalable and feasible solutions from the cybersecurity perspective. This dissertation proposes novel models and methodologies for: (1) Cybersecurity planning, and (2) Cybersecurity for system operation. The cybersecurity planning is achieved through cyber risk assessment and cybersecurity resource investment optimization for long-term cybersecurity of the grid using game theory and attack-defense trees. Cybersecurity for system operation consists of development of cyber anomaly detection and mitigation algorithms for flexible AC transmission system (FACTS) controller-based wide-area voltage control systems (WAVCS) using machine learning (ML), and software defined networking-based moving target defense network routing for achieving real-time cyber-physical security for grid operations. This is followed by hardware-in-the-loop (HIL) implementation and evaluation of these attack prevention, detection, and mitigation algorithms and methodologies showcasing their feasibility in a close to real-world environment. For cybersecurity planning, a novel approach involving a combination of game theory and attack defense trees (ADT) for optimal cybersecurity resource allocation in the smart grid is proposed. This methodology involves modeling of the cyber-physical smart grid substations as ADTs, defining attacker costs, defense costs, and attack probabilities for attack access points. Using game theoretical formulation, optimal defense strategies for the defender of the system to invest cybersecurity resources in the grid are obtained. Additionally, a game-theoretic framework is developed for quantitative cyber-physical risk assessment of the grid under a dynamically changing cyber threat space and uncertain behavior of cyber attackers which is further used to optimize investments in the smart grid's cybersecurity resources. The attacker, defender, and the smart grid system are modeled while incorporating attacker-stochasticity and federal guidelines for smart grid cybersecurity. This allows quantification of threat, vulnerabilities, and attack impact of the grid for quantitative risk assessment. The defender's budget to invest in the security resources in the grid is optimized based on the strategies leading to minimum system risk. The evaluation of the proposed solutions highlight the feasibility for practical implementation of these methodologies and algorithms in the smart grid, while taking the federal requirements and guidelines for smart grid security into consideration. For achieving cybersecurity for system operation, attack prevention, detection, and mitigation algorithms and methodologies are developed specifically for FACTS-based WAVCS. Anomaly detection and mitigation in the WAVCS are achieved using algorithms based on machine learning which involves offline training and testing of ML models with CPS datasets incorporating physics-based features that allow accurate distinction between system faults and cyber attacks. For attack prevention, a methodology based on software defined network (SDN)-based moving target defense (MTD) network routing is proposed that enables prevention of Denial of Service (DoS) type attacks on the smart grid communication system. Subsequently, these methodologies and algorithms are implemented and evaluated on an HIL testbed that allows for real-time attack prevention, detection, and mitigation of emulated cyber attacks on the WAVCS in a close to real-world environment. The results show highly accurate and efficient performance of the implemented algorithms and methodologies with the smart grid system operating within the NERC's system operation limits even in the presence of DoS and data integrity cyber attacks. This work opens up future research opportunities in other directions such as (1) Expanding cybersecurity planning methodologies to real-time cyber contingency analysis with different game formulations; and (2) Applying the cybersecurity for system operation algorithms to broader categories of wide-area control applications.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2024

Integrating PCTRAN with AI-Driven Host-Intrusion Detection and Secured Container Systems for Advanced Malware Analysis (Summer Internship Report)

This study presents a solution for enhancing the security of the Personal Computer Transient Analyzer (PCTRAN) PC-based Nuclear Power Plant Simulator by integrating the software with an artificial intelligence (AI)-driven host-intrusion detection system (HIDS), in addition to a secured container system, for malware analysis. PCTRAN is a Windows XP-based software package that has the ability to simulate a variety of accident and transient conditions for nuclear power plants (NPPs). It offers a high-resolution replica of the Nuclear Steam Supply System (NSSS) and displays the status of important parameters allowing for operator interaction. By including AI-driven HIDS for the NSSS, the framework can identify security threats in real-time, ensuring the integrity of the nuclear simulation environment. Additionally, the secured container system offers the ability to isolate and analyze malware, preventing potential threats from affecting core systems. The integration process involves extensive testing and validation in order to ensure accuracy, reliability, and compliance with security policies. This framework sets a new precedent for secure simulation and training in NPP operations, and offers insight for future advancements in cybersecurity.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗