Search NASA⌕ Search

SEARCH · Search NASA

Results for “Threat Detection”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 253 records · Page 14

Correlated Signal Analysis for Nuclear Emergency Response

In the context of nuclear emergency response (NER) scenarios, the critical task is to quickly identify a "black box" as a potential threat, as failing to do so could have catastrophic consequences. Techniques for passive assay of a “black box” typically include gamma-ray spectroscopy and neutron coincidence/multiplicity counting. However, there are significant challenges associated with these type of measurements. First, the presence of intervening materials can obstruct the detection of relevant signatures. Second, the presence of strong non-fission neutron sources, like (α, n) emitters, can add uncertainties to the neutron multiplicity analysis. In our LDRD-MFR Phase II work, a portable neutron spectrometer, called the Compact Fast Neutron Spectrometer (CFNS), was developed for NER applications. The CFNS system leverages information-rich neutron energy spectra to derive actionable information. This work investigates the use of correlated signals in the CFNS from special nuclear material (SNM) to characterize physical properties, such as intervening shielding material and fission to non-fission neutron contributions. In this report, the Phase II results from bulk SNM measurements at the National Criticality Experiments Research Center (NCERC) are briefly discussed along with the motivation for this work. Afterwards, simulations using the MCNPX-PoliMi transport code are discussed, which were used to expand our correlated signal study. Signal triggered analysis for neutron multiplicity extraction will also be discussed. Lastly, the use neutron-photon correlations for intervening material identification are shown, along with the use of correlated neutron energy spectra for α-ratio extraction.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗

Development of a Host-Based Intrusion Detection and Control Device for Industrial Field Control Devices

Industrial control systems contain a multitude of devices deployed into the field to observe and control a physical process. Currently, most of these devices lack common host-based cybersecurity features, which can lead them to be seen as vulnerable targets. The Cymbiote device was developed to address this problem by examining multiple streams of data to determine what might indicate a potential threat, and to evaluate and execute appropriate response actions. This paper discusses the evolution of the Cymbiote device in response to evaluation and testing done on real-world hardware. Experimental results are discussed, as are the new developments that have been made to the device in response to the findings. In addition, we describe future research directions for this approach along with the experimental setup changes in response to the requirements for statistical rigor.

Rice, Theora R.↗

Field Insights: Strengthening Digital Assurance Through On-Site Network Monitoring

The accelerating deployment of digital energy infrastructure, ranging from inverter-based resources (IBRs), battery energy storage systems (BESS), to advanced grid control platforms, has brought unprecedented visibility, flexibility, and efficiency to the electric grid. However, this digital transformation also introduces new cybersecurity challenges, particularly in the form of supply chain risks and operational blind spots at the grid edge. Over the past year, the Department of Energy’s Office of Cybersecurity, Energy Security, and Emergency Response (CESER), through its Rapid Risk Assessment initiative, along with the Grid Deployment Office (GDO), through its Technical Assistance for Digital Assurance (TADA) initiative, have supported a series of on-site network engagements led by Idaho National Laboratory (INL). These engagements, conducted in partnership with asset owners across the country, have focused on identifying real-world vulnerabilities and misconfigurations in operational environments, many of which are not detectable through remote assessments or traditional compliance audits. The goal of this report is to distill key findings and lessons learned during network hunt engagements from INL’s fiscal year (FY) 2024 - 2025. It is intended to help asset owners—regardless of their participation in the program—better understand the evolving threat landscape and adopt practical measures to secure their digital energy infrastructure.

24 - POWER TRANSMISSION AND DISTRIBUTION↗

Prediction of Power Measurements Using Adaptive Filters

With the advent of smart grid concept, Internet of Things (IoT) and the deployment of smart meters, the cyberattack threats on power networks have increased due to the use of communication systems that can be accessed by adversaries. Attackers will have the ability to manipulate the outcomes of smart meters which in turn influence the core application of Energy Management System 9EMS): State Estimation (SE). Bad data analytic tools may fail to detect some attacks into measurements. Meanwhile, Machine Learning (ML) solutions have been proposed for detecting False Data Injection (FDI) attacks. However, there is a lack of ML time-series solutions presented in the state-of-the-art that is yet to be complex. In signal processing, time-series solutions do not only consider the signal, but also the statistics of the signal over time. Therefore, in this paper, a machine learning for time-series solutions is presented as an application to model the measurements of the power grid that are used in SE. The presented model takes into account adaptive linear and non-linear filters: Finite Impulse Response (FIR), and Infinite Impulse Response (IIR). The presented models are implemented and performed on the IEEE-118 bus system. The results indicate the advantage of applying those filters over the state-of-the-art machine learning solutions.

Hamad, Khaled↗

Alpha Spectrometry Results for Groundwater Samples Collected in Northern Iraq and a Summary of the Environmental Setting of the Adaya Burial Site

The Radiation Protection Center (RPC) of the Iraqi Ministry of Environment continues to evaluate the potential health impacts associated with the Adaya Burial Site, which is located 33 kilometers (20.5 miles) southwest of Mosul. This report documents the radiological analyses of 16 groundwater samples collected from wells located in the vicinity of the Adaya Burial Site and at other sites in northern Iraq. The Adaya Burial Site is a high-risk dump site because a large volume of radioactive material and contaminated soil is located on an unsecure hillside above the village of Tall ar Ragrag. The uranium activities for the 16 water samples in northern Iraq are considered to be naturally occurring and do not indicate artificial (man-made) contamination. With one exception, the alpha spectrometry results for the 16 wells that were sampled in 2019 indicate that the water quality concerning the three uranium isotopes (Uranium-233/234, Uranium-235/236, and Uranium-238) was acceptable for potable purposes (drinking and cooking). However, Well 7 in Mosul had a Uranium-233/234 activity concentration that slightly exceeded the World Health Organization guidance level. Eight of the 16 wells are located in the villages of Tall ar Ragrag and Adaya and had naturally occurring uranium concentrations. Wells in the villages of Tall ar Ragrag and Adaya are located near the Adaya Burial Site and should be sampled on an annual schedule. The list of groundwater analytes should include metals, total uranium, isotopic uranium, gross alpha/beta, gamma spectroscopy, organic compounds, and standard water quality parameters. Our current understanding of the hydrogeologic setting in the vicinity of the Adaya Burial Site is solely based on villager's domestic wells, topographic maps, and satellite imagery. To better understand the hydrogeologic setting, a Groundwater Monitoring Program needs to be developed and should include the installation of twelve groundwater monitoring wells in the vicinity of Tall ar Ragrag and the Adaya Burial Site. Characterization of the limestone aquifer and overlying alluvium is needed. RPC should continue to support health assessments for the villagers in Tall ar Ragrag and Adaya. Collecting samples for surface water (storm water), airborne dust, vegetation, and washway sediment should be conducted on a routine basis. Human access to the Adaya Burial Site needs to be strictly limited. Livestock access on or near the burial site needs to be eliminated. The surface-water exposure pathway is likely a greater threat than the groundwater exposure pathway. Installation of a surface-water diversion or collection system is recommended in order to reduce the potential for humans and livestock to come in contact with contaminated water and sediment. To reduce exposure to villagers, groundwater treatment should be considered if elevated uranium or other contaminants are detected in drinking water. Installing water-treatment systems would likely be quicker to accomplish than remediation and excavation of the Adaya Burial Site. The known potential for human exposure to uranium and metals (such as arsenic, chromium, selenium, and strontium) at the Adaya Burial Site is serious. Additional characterization , mitigation, and remediation efforts should be given a high priority.

54 ENVIRONMENTAL SCIENCES↗

Quantum Key Distribution for Critical Infrastructures: Towards Cyber-Physical Security for Hydropower and Dams

Hydropower facilities are often remotely monitored or controlled from a centralized remote control room. Additionally, major component manufacturers monitor the performance of installed components, increasingly via public communication infrastructures. While these communications enable efficiencies and increased reliability, they also expand the cyber-attack surface. Communications may use the internet to remote control a facility’s control systems, or it may involve sending control commands over a network from a control room to a machine. The content could be encrypted and decrypted using a public key to protect the communicated information. These cryptographic encoding and decoding schemes become vulnerable as more advances are made in computer technologies, such as quantum computing. In contrast, quantum key distribution (QKD) and other quantum cryptographic protocols are not based upon a computational problem, and offer an alternative to symmetric cryptography in some scenarios. Although the underlying mechanism of quantum cryptogrpahic protocols such as QKD ensure that any attempt by an adversary to observe the quantum part of the protocol will result in a detectable signature as an increased error rate, potentially even preventing key generation, it serves as a warning for further investigation. In QKD, when the error rate is low enough and enough photons have been detected, a shared private key can be generated known only to the sender and receiver. We describe how this novel technology and its several modalities could benefit the critical infrastructures of dams or hydropower facilities. The presented discussions may be viewed as a precursor to a quantum cybersecurity roadmap for the identification of relevant threats and mitigation.

97 MATHEMATICS AND COMPUTING↗

3D, Real-time Label-free Visualization of Cellular Health

This work directly addresses a key question raised in TA7, Topic L1 of HDTRA1-16-24-FRCWMDCall, “Can quantum level changes be detected, mapped, and understood in the biological environment to allow faster diagnostic responses?” This work will use the inherently sensitive quantum property of a molecular excited state lifetime to visualize and map discrete, subtle nanometer-scale changes (e.g. NADPH vs NADH) that are key indicators of cellular health in response to chemical and biological threats and MCMs. It will also develop and exploit new, fast imaging light-sheet methods to allow faster diagnostic responses. This new imaging system will exploit time-correlated single photon counting and new advances in single-objective light-sheet microscopy (oblique plane microscopy) for fast, quantitative analysis of cellular redox state. We will add an entirely new dimension (excited state fluorescence lifetime) to oblique plane microscopy—a method that even without this added dimension was labeled by Nature Methods in 2021 as a ‘Method to Watch.’ Following instrument development and validation, we will explore cellular response to Burkholderia infections and antibiotic treatment in immortal cell lines followed by expansion to more realistic cellular environments (such as neuro-muscular junctions, NMJs) to test nerve agent simulants and their MCMs. As a microscopy platform, these methods hold the promise of being able to visualize a single infected cell (or a cellular compartment) and MCM treatment well before a larger and later organ/organism response.

47 OTHER INSTRUMENTATION↗

Developing an AI-Powered Zero-Trust Cybersecurity Framework for Malware Prevention in Nuclear Power Plants

This study presents the development of an AI-powered Zero-Trust cybersecurity framework for malware prevention in nuclear power plants. The framework aims to enhance the security of critical systems within nuclear power plants by adopting the principles of Zero-Trust and leveraging artificial intelligence (AI) technologies. By assuming no implicit trust in any user or device and continuously authenticating and authorizing access, the framework ensures a robust defense against malware attacks. The integration of AI allows for the detection and prevention of malware through behavioral analytics, endpoint protection, network segmentation, and continuous monitoring. The paper discusses the key considerations, steps, and technologies involved in developing this framework, emphasizing the importance of regular updates, training, compliance, and auditing. The proposed framework serves as a comprehensive approach to safeguarding nuclear power plants from sophisticated malware threats and protecting the integrity and safety of critical infrastructure.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗

Intern Deliverable Poster 2025

An Incident Response Plan (IRP) is a document that is created and maintained by an organization that provides guidance in the event of a cyber incident. The primary objectives of an IRP are to aid in the detection, response, and recovery from incidents, as well as to enhance preparation and preventative measures. An IRP should outline specific procedures at each stage of an incident, with the goal of minimizing asset damage, data leakage, and operational impact. By investing in a well-defined IRP, organizations can better manage and mitigate risks associated with cyber threats, ensuring business continuity and resilience. This poster summarizes incident response guidelines for wind energy, which faces unique cybersecurity and physical challenges.

17 - WIND ENERGY↗

Human Mobility to Parks Under the COVID-19 Pandemic and Wildfire Seasons in the Western and Central United States

In 2020, people's health suffered a great crisis under the dual effects of the COVID-19 pandemic and the extensive, severe wildfires in the western and central United States. Parks, including city, national, and cultural parks, offer a unique opportunity for people to maintain their recreation behaviors following the social distancing protocols during the pandemic. However, massive forest wildfires in western and central US, producing harmful toxic gases and smoke, pose significant threats to human health and affect their recreation behaviors and mobility to parks. In this study, we employed the geographically and temporally weighted regression (GTWR) Models to investigate how COVID-19 and wildfires jointly shaped human mobility to parks, regarding the number of visits per capita, dwell time, and travel distance to parks, during June - September 2020. We detected strong correlations between visitations and COVID-19 incidence in southern Montana, western Wyoming, Colorado, and Utah before August. However, the pattern was weakened over time, indicating the decreasing trend of the degree of concern regarding the pandemic. Moreover, more park visits and lower dwell time were found in parks further away from wildfires and less air pollution in Washington, Oregon, California, Colorado, and New Mexico, during the wildfire season, suggesting the potential avoidance of wildfires when visiting parks. This study provides important insights on people's responses in recreation and social behaviors when facing multiple severe crises that impact their health and wellbeing, which could support the preparation and mitigation of the health impacts from future pandemics and natural hazards.

54 ENVIRONMENTAL SCIENCES↗

Hungary 908 Event - Risk Based Graded Approach to ITM

This presentation, Risk-Based, Graded Approach to Insider Threat Mitigation: Human Measures, introduces a structured framework for managing insider threat risk using internationally recognized guidance from the International Atomic Energy Agency (IAEA) Nuclear Security Series No. 8-G (Rev. 1) and the Joint Statement on Mitigating Insider Threats (INFCIRC/908). The presentation emphasizes that effective insider threat mitigation (ITM) depends on both positional controls, which manage inherent risk based on access, authority, and knowledge, and human measures, which address residual risk reflected in behavior, motivation, and reliability. Using a risk-informed and graded approach, the presentation outlines methods for identifying and prioritizing high-risk positions, applying layered organizational controls, and integrating human reliability mechanisms such as the Behavior Observation Program (BOP), Fitness-for-Duty (FFD) evaluations, Employee Assistance Programs (EAP), and Nuclear Security Culture (NSC). The human-focused portion examines behavioral and organizational indicators of opportunity, vulnerability, motivation, and crisis, demonstrating how early detection, deterrence, and response can prevent insider events. The session concludes with a case review of the Millstone Nuclear Power Station incident involving engineer George Galatis. The case illustrates how weak leadership and a poor safety culture can create conditions for failure and how a comprehensive ITM framework could have altered the outcome. The objective of this presentation is to help practitioners apply a risk-based, graded philosophy to human factors and promote a culture of accountability, communication, and resilience within nuclear organizations.

99 - GENERAL AND MISCELLANEOUS↗

A Cybersecurity Testbed for Smart Buildings

Smart buildings are equipped with a plethora of cyber-physical systems, such as Internet of Things (IoT) devices and building automation systems. These devices, especially in commercial buildings, use legacy communications and hardware that were not designed with cybersecurity in mind. With increasing cyber threats in recent years, smart buildings have become an increasing target for attacks, but not enough published data are available from these incidents to study or replicate the scenarios to defend buildings. As part of the U.S. Department of Energy-funded project focusing on developing the Building Intelligence with Layered Defense Using Security-Constrained Optimization and Security Risk Detection (BUILD-SOS) platform, we developed a cybersecurity test bed for smart buildings. This test bed includes a building simulation tool, virtual devices, emulated operational technology networks, and remote hardware-in-the-loop. Using this test bed, we performed different cyberattacks on the smart building model and collected both physical building data, to understand the impacts on the building, and network data, to aid in separating mechanical faults from cyberattacks during the detection. This test bed is a significant tool in protecting smart buildings from cyberattacks because it can aid in both cybersecurity analysis and the evaluation of other cyberattack detection tools by testing the tools in a secure environment without impacting the building operations.

cyber-physical systems↗

A Cybersecurity Testbed for Smart Buildings

Smart buildings are equipped with a plethora of cyber-physical systems, such as Internet of Things (IoT) devices and building automation systems. These devices, especially in commercial buildings, use legacy communications and hardware that were not designed with cybersecurity in mind. With increasing cyber threats in recent years, smart buildings have become an increasing target for attacks, but not enough published data are available from these incidents to study or replicate the scenarios to defend buildings. As part of the U.S. Department of Energy-funded project focusing on developing the Building Intelligence with Layered Defense Using Security-Constrained Optimization and Security Risk Detection (BUILD-SOS) platform, we developed a cybersecurity test bed for smart buildings. This test bed includes a building simulation tool, virtual devices, emulated operational technology networks, and remote hardware-in-the-loop. Using this test bed, we performed different cyberattacks on the smart building model and collected both physical building data, to understand the impacts on the building, and network data, to aid in separating mechanical faults from cyberattacks during the detection. This test bed is a significant tool in protecting smart buildings from cyberattacks because they can aid in both cybersecurity analysis and the evaluation of cyberattack detection tools by testing the tools in a secure environment without impacting the building operations.

alfalfa↗

Sequim Bay Underwater UXO (SBU2) Prototype Demonstration Site: Field Operations Summary, 2019

The U.S. Department of Defense (DoD) has identified more than 400 underwater sites that are potentially contaminated with munitions. Many of these sites are in shallow water (0–35 m deep) where the munitions pose a threat to human health and the environmental. To address this challenge, the Strategic Environmental Research and Development Program (SERDP) and Environmental Security Technology Certification Program (ESTCP) held a workshop in 2018 to establish the requirements and framework for developing a series of underwater unexploded ordnance (UXO) Standardized Demonstration sites (“test beds”) to support the evaluation of sensors, equipment, and technologies to detect UXO. Sequim Bay in Washington State was evaluated as a potential test bed and was determined to meet initial qualifying criteria with respect to environmental setting, and operational, logistical, and facilities support provided by the Pacific Northwest National Laboratory (PNNL).

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

Inferring adversarial behaviour in cyber‐physical power systems using a Bayesian attack graph approach

Abstract Highly connected smart power systems are subject to increasing vulnerabilities and adversarial threats. Defenders need to proactively identify and defend new high‐risk access paths of cyber intruders that target grid resilience. However, cyber‐physical risk analysis and defense in power systems often requires making assumptions on adversary behaviour, and these assumptions can be wrong. Thus, this work examines the problem of inferring adversary behaviour in power systems to improve risk‐based defense and detection. To achieve this, a Bayesian approach for inference of the Cyber‐Adversarial Power System (Bayes‐CAPS) is proposed that uses Bayesian networks (BNs) to define and solve the inference problem of adversarial movement in the grid infrastructure towards targets of physical impact. Specifically, BNs are used to compute conditional probabilities to queries, such as the probability of observing an event given a set of alerts. Bayes‐CAPS builds initial Bayesian attack graphs for realistic power system cyber‐physical models. These models are adaptable using collected data from the system under study. Then, Bayes‐CAPS computes the posterior probabilities of the occurrence of a security breach event in power systems. Experiments are conducted that evaluate algorithms based on time complexity, accuracy and impact of evidence for different scales and densities of network. The performance is evaluated and compared for five realistic cyber‐physical power system models of increasing size and complexities ranging from 8 to 300 substations based on computation and accuracy impacts.

Sahu, Abhijeet↗

Pathogenesis of Chapare Virus in Cynomolgus Macaques

Chapare virus (CHAPV) is an emerging New World arenavirus that is the causative agent of Chapare hemorrhagic fever (CHHF) responsible for recent outbreaks with alarmingly high case fatality rates in Bolivia near the Brazilian border. Here, we describe a nonhuman primate (NHP) model of CHHF infection which represents an essential tool to understand this emerging biological threat agent. Cynomolgus macaques challenged intravenously with CHAPV develop clinical disease, which recapitulates several key features of human CHHF. All subjects lost weight and had clinical scores following CHAPV challenge. Notably, one of four NHPs developed lethal disease with viral hepatitis and hemorrhagic features. Clinical chemistry and hematology revealed leukopenia, anemia, thrombocytopenia, and increased transaminase levels. In all four subjects, viremia was detectable for the first week following challenge and viral RNA was detectable in serum and many tissues persisting 35 days-post challenge. Several medical countermeasures (MCM) have efficacy against CHAPV infection in vitro, but the current model for MCM testing and approval of new drugs is reliant on the availability of animal models. This work lays the foundation for future CHHF MCM development.

60 APPLIED LIFE SCIENCES↗

Net Load Redistribution Attacks on Nodal Voltage Magnitude Estimation in AC Distribution Networks

A high penetration level of smart devices and communication networks increases the threat of cyber-attacks in the distribution system. In this paper, we model a hidden, coordinated, net load redistribution attack (NLRA) in an AC distribution system. Based on local information of an attack region, the attacker’s goal is to create violations in nodal voltage magnitude estimation. Acting as a system operator equipped with global AC state estimation and bad data detection, we validate the stealthiness of the hidden NLRA in multiple attack cases. Simulation results on a modified PG&E 69-node distribution system show the validity of the proposed NLRA. The influence of NLRA on the distribution system is assessed and the impact of attack regions, attack timing, and system observability is also revealed.

Zhang, Hang↗

Alerga: Alert Aggregation and Reasoning in GOOSE Simulation Pipeline

IEC 61850 specifies the Generic Object Oriented Substation Event (GOOSE) protocol as one option for low latency communication of substation-related events. Due to its strict timing requirements, GOOSE lacks any form of encryption or authentication and has only minimal integrity guarantees. These absences render the protocol vulnerable to a variety of communication anomalies, including adversarial action. In particular, an adversary with access to the substation network can launch man in the middle (MITM) attacks. We propose Alerga, a set of tools to allow operators to mitigate some of the risks of the protocol while retaining its strengths. To that end, we have developed first a GOOSE simulation pipeline including data generation, anomaly detection, alert handling, causal reasoning and data visualization components. The simulator is designed to be modular, allowing operators to swap components to better fit their network capabilities. The volume of alert traffic on a substation network threatens operators with alert fatigue. In order to combat this, we secondly present a novel form of alert aggregation and processing, offering operators a condensed view of any threats to the system. Thirdly, to facilitate the handling of these threats, our causal reasoning system traces the alerts back to their most likely cause, generating an initial hypothesis for operators to investigate.

alert aggregation↗