Search NASA⌕ Search

SEARCH · Search NASA

Results for “Detection and Defense”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 271 records · Page 15
All sourcesNASA NTRSDOE OSTI
NASA NTRS2015

Lightning Imaging Sensor (LIS) for the International Space Station (ISS): Mission Description and Science Goals

In recent years, the NASA Marshall Space Flight Center, the University of Alabama in Huntsville, and their partners have developed and demonstrated space-based lightning observations as an effective remote sensing tool for Earth science research and applications. The Lightning Imaging Sensor (LIS) on the Tropical Rainfall Measuring Mission (TRMM) continues to acquire global observations of total (i.e., intracloud and cloud-to-ground) lightning after 17 years on-orbit. However, TRMM is now low on fuel, so this mission will soon be completed. As a follow on to this mission, a space-qualified LIS built as the flight spare for TRMM has been selected for flight as a science mission on the International Space Station (ISS). The ISS LIS will be flown as a hosted payload on the Department of Defense Space Test Program (STP) H5 mission, which has a January 2016 baseline launch date aboard a SpaceX launch vehicle for a 2-4 year or longer mission. The LIS measures the amount, rate, and radiant energy of total lightning over the Earth. More specifically, it measures lightning during both day and night, with storm scale resolution (approx. 4 km), millisecond timing, and high, uniform detection efficiency, without any land-ocean bias. Lightning is a direct and most impressive response to intense atmospheric convection. It has been found that lightning measured by LIS can be quantitatively related to thunderstorm and other geophysical processes. Therefore, the ISS LIS lightning observations will continue to provide important gap-filling inputs to pressing Earth system science issues across a broad range of disciplines, including weather, climate, atmospheric chemistry, and lightning physics. A unique contribution from the ISS platform will be the availability of real-time lightning data, especially valuable for operational applications over data sparse regions such as the oceans. The ISS platform will also uniquely enable LIS to provide simultaneous and complementary observations with other ISS payloads such as the European Space Agency's Atmosphere-Space Interaction Monitor (ASIM) that will be exploring the connection between thunderstorms and lightning with terrestrial gamma-ray flashes (TGFs) and the Japan Aerospace Exploration Agency's Global LIghtning and Sprites MeasurementS (GLIMS) with its focus on global lightning and sprite connections. Another important function of the ISS LIS will be to provide cross-sensor calibration/validation with a number of other payloads, including the TRMM LIS and the next generation geostationary lightning mappers such as the GOES-R Geostationary Lightning Mapper (GLM) and Meteosat Third Generation Lightning Imager (MTG LI), as well as with ground-based lightning detection systems. These inter-calibrations will improve the long term climate monitoring record provided by all these systems. Finally, the ISS LIS will extend the time-series climate record of LIS lightning observations and expand the latitudinal coverage of LIS lightning to the climate significant upper middle-latitudes.

Blakeslee, R. J.↗
DOE OSTI2021

Optimizing Ventilation Using Low-Cost Sensors to Improve Health, Safety, and Energy Efficiency

Air is the primary carrier of hazards within a space, whether it be hazardous byproducts of laboratory research activities or airborne pathogens. As a result, building ventilation is a primary defense against unseen airborne hazards. Critical laboratory facilities require effective mitigation of exposure to research-related, airborne hazards, providing a proving ground for effective ventilation strategies that optimize safety of occupants and reduce energy use. The heart of smart laboratory building operation is dynamic, analytics-based ventilation, which requires an in-depth intimate knowledge of building environmental conditions achieved through contaminant-detection systems. Unfortunately, currently many contaminant-detection solutions are expensive, elaborate systems that raise barriers for building managers. Through the successful deployment of a novel low-cost, modular sensor technology, we have developed a demand-control ventilation protocol effective in improving safety and reducing energy in critical laboratory environments. In this article, we will highlight best practices and lessons learned through this deployment that can be applied beyond laboratories. This article describes a low-cost sensor to support providing a safe, healthy building environment and reduce energy use through effective and efficient ventilation.

dynamic management of indoor air quality↗
DOE OSTI2023

Precursor Analysis Report: Ryuk Ransomware Attack on Universal Health Services 2020

The Ryuk Ransomware Attack on Universal Health Services (UHS) 2020 Precursor Analysis Report leverages publicly available information about the 2020 UHS cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. UHS manages over 400 hospitals and is one of the largest healthcare providers in the United States with 3.5 million patients each year. On 27 September 2020, UHS suffered a widespread ransomware attack that resulted in a denial of service to critical internet-dependent healthcare systems including workstations, phones, and data centers. Employees resorted to filing patient details with pen and paper, while other facilities had to redirect ambulances and urgent patients to other facilities for adequate care. Adversaries carried out the attack with Ryuk, a ransomware that encrypts data and generates a RyukReadMe.txt ransom note with the ransom fee to decrypt the data, varying from 15 Bitcoin (BTC) to 50 BTC, equivalent to roughly $\$$353,892 to $\$$964,617. UHS did not pay the ransom and was able to recover data through backups, but still reported an impact of $\$$67 million dollars in recovery costs. On 29 October, one month after the attack, UHS made an official statement that their systems had been restored and they were resuming normal operations. Researchers and analysts identified 18 unique techniques (used in a sequence of 19 steps) utilized during the attack with a total of 185 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Fourteen of the identified techniques used during the UHS cyber attack were precursors to the triggering event. Analysis identified 106 observables associated with these precursor techniques, 82 of which were assessed to have an increased likelihood of being perceived in the 30 days to two hours preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
NASA NTRS2016

Architecture for Mitigating Short-Term Warning Cosmic Threats: READI Project

Earth is being constantly bombarded by a large variety of celestial bodies and has been since its formation 4.5 billion years ago. Among those bodies, mainly asteroids and comets, there are those that have the potential to create large scale destruction upon impact. The only extinction-level impact recorded to date was 65 million years ago, during the era of dinosaurs. The probability of another extinction-level, or even city-killer, impact may be negligible, but the consequences can be severe for the biosphere and for our species. Therefore it is highly imperative for us to be prepared for such a devastating impact in the near future, especially since humanity is at the threshold of wielding technologies that allow us to do so. Majority of scientists, engineers, and policymakers have focused on long-term strategies and warning periods for Earth orbit crossing Near-Earth Objects (NEOs), and have suggested methods and policies to tackle such problems. However, less attention has been paid to short warning period NEO threats. Such NEOs test current technological and international cooperation capabilities in protecting ourselves, and can create unpredictable devastation ranging from local to global scale. The most recent example is the Chelyabinsk incident in Russia. This event has provided a wakeup call for space agencies and governments around the world towards establishing a Planetary Defense Program. The Roadmap for EArth Defense Initiative (READI) is a project by a team of international, intercultural, and interdisciplinary participants of the International Space University's Space Studies Program 2015 hosted by Ohio University, Athens, OH proposing a roadmap for space agencies, governments, and the general public to tackle NEOs with a short warning before impact. Taking READI as a baseline, this paper presents a technical description of methodologies proposed for detection and impact mitigation of a medium-sized comet (up to 800m across) with a short-warning period of two years on a collision course with Earth. The hypothetical comet is on a highly-inclined orbit having a high probability for Earth impact after its perihelion. For detection, we propose a space-based infrared detection system consisting of two satellites located at the Earth-Moon Lagrange points L1 and L2 coupled with space observatories, like the James Webb telescope and the Centennial telescope. These telescopes are supported by ground-based telescopes, like the Arecibo and Green Bank telescope, in the search for NEOs. Upon detection, the comet is tracked constantly using space- and ground-based telescopes. The deflection system is two-pronged, firstly involving the use of a high energy Directed Energy Laser Terminals (DELT) placed at Sun-Earth Lagrange points L4 and L5 so as to initiate and increase the ablation rate of the comet and deviate it from its collision trajectory, and secondly by the Hypervelocity Comet Intercept Vehicle (HCIV), a space-borne system combining a kinetic impactor with a thermonuclear device. The policy and international collaboration aspects to implement these methods are also outlined in the paper. The techniques mentioned could also be applied to mitigate medium-to-large sized asteroids (up to 2km across).

Laser Applications↗
NASA NTRS2016

Planetary Defense Architecture for Mitigating Short-Term Warning Cosmic Threats: READI Project

Earth is being constantly bombarded by a large variety of celestial bodies and has been since its formation 4.5 billion years ago. Among those bodies, mainly asteroids and comets, there are those that have the potential to create large scale destruction upon impact. The only extinction-level impact recorded to date was 65 million years ago, during the era of dinosaurs. The probability of another extinction-level, or even city-killer, impact may be negligible, but the consequences can be severe for the biosphere and for our species. Therefore it is highly imperative for us to be prepared for such a devastating impact in the near future, especially since humanity is at the threshold of wielding technologies that allow us to do so. Majority of scientists, engineers, and policymakers have focused on long-term strategies and warning periods for Earth orbit crossing Near-Earth Objects (NEOs), and have suggested methods and policies to tackle such problems. However, less attention has been paid to short warning period NEO threats. Such NEOs test current technological and international cooperation capabilities in protecting ourselves, and can create unpredictable devastation ranging from local to global scale. The most recent example is the Chelyabinsk incident in Russia. This event has provided a wakeup call for space agencies and governments around the world towards establishing a Planetary Defense Program. The Roadmap for EArth Defense Initiative (READI) is a project by a team of international, intercultural, and interdisciplinary participants of the International Space University's Space Studies Program 2015 hosted by Ohio University, Athens, OH proposing a roadmap for space agencies, governments, and the general public to tackle NEOs with a short warning before impact. Taking READI as a baseline, this paper presents a technical description of methodologies proposed for detection and impact mitigation of a medium-sized comet (up to 800m across) with a short-warning period of two years on a collision course with Earth. The hypothetical comet is on a highly-inclined orbit having a high probability for Earth impact after its perihelion. For detection, we propose a space-based infrared detection system consisting of two satellites located at the Earth-Moon Lagrange points L1 and L2 coupled with space observatories, like the James Webb telescope and the Centennial telescope. These telescopes are supported by ground-based telescopes, like the Arecibo and Green Bank telescope, in the search for NEOs. Upon detection, the comet is tracked constantly using space- and ground-based telescopes. The deflection system is two-pronged, firstly involving the use of a high energy Directed Energy Laser Terminals (DELT) placed at Sun-Earth Lagrange points L4 and L5 so as to initiate and increase the ablation rate of the comet and deviate it from its collision trajectory, and secondly by the Hypervelocity Comet Intercept Vehicle (HCIV), a space-borne system combining a kinetic impactor with a thermonuclear device. The policy and international collaboration aspects to implement these methods are also outlined in the paper. The techniques mentioned could also be applied to mitigate medium-to-large sized asteroids (up to 2km across).

Laser Applications↗
DOE OSTI2021

Optimizing Ventilation Using Low-Cost Sensors to Improve Health, Safety, and Energy Efficiency

Air is the primary carrier of hazards within a space, whether it be hazardous bi-products of research activities or airborne pathogens. As a result, building ventilation is the primary defense against unseen airborne hazards. Critical laboratory facilities already demand the need for effective mitigation of exposure to research-related, airborne hazards, providing a proving ground for effective ventilation strategies that optimize safety of occupants and reduce energy use. The heart of smart laboratory building operation is dynamic, analytics-based ventilation, which requires an intimate knowledge of building environmental conditions achieved through contaminant-detection systems. Unfortunately, currently available contaminant-detection solutions are expensive, elaborate systems that raise barriers for building managers on a limited budget. Through the successful deployment of a novel low-cost, modular sensor technology, we have developed a demand-control ventilation protocol effective in improving safety and reducing energy in the critical laboratory environment. In this session, we will highlight best practices and lessons learned through this deployment that can be applied beyond laboratories without breaking the bank. This paper describes a low-cost solution for providing a safe, healthy building environment and reducing energy use through effective, efficient ventilation.

ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATION↗
NASA NTRS2019

Supporting Crew Autonomy in Deep Space Exploration: Preliminary Onboard Capability Requirements and Proposed Research Questions. Technical Report of the Autonomous Crew Operations Technical Interchange Meeting

Communication delays are a critical challenge posed by long duration deep space exploration. Space missions historically have relied on an ever-present Mission Control Center (MCC) to direct operations in near real-time. As unanticipated anomalies that defeat fault detection and resolution systems do arise, the lack of real-time communication will significantly weaken what the MCC support represents: a reliable safety net for the flight crew through its deep and diverse areas of expertise and investigative resources. As a consequence, future space vehicles and habitats need to be equipped with capabilities to support the flight crew to operate with little or no ground support. Considerations must be given to vehicle and mission designs that will fortify the traditionally ground-centered safety net and forge new support systems, when communication delays exist. In August 2018, NASA’s Human Research Program, through its Human Factors and Behavioral Performance Element, convened a Technical Interchange Meeting (TIM) on Autonomous Crew Operations at NASA Ames Research Center. The goal of the meeting was to gather input from NASA centers, industry, academia, and branches of the Department of Defense (DoD) to address how intelligent technologies can be applied to augment onboard capabilities to support crew anomaly response. The TIM featured 24 presentations by 29 speakers and hosted a total of 59 attendees, including 43 from 5 NASA centers (Ames, Johnson, Langley, Marshall, and Jet Propulsion Lab) and 4 from the DoD (3 from Army Research Lab and 1 from Naval Postgraduate School), with remaining attendees from academia (e.g., UC Davis, CMU) and industry (e.g., IBM, Siemens). Discussions were centered around three themes: standards and guidelines, lessons learned in analog environments, and technologies. To help provide a framework for discussion, a concept matrix describing anomaly response processes was created prior to the TIM (Figure 1, page 6). The matrix captures the steps involved (monitoring and detection, diagnosis, solution development and evaluation, solution implementation and verification, resolution documentation) as well as the resources and capabilities required to support these steps (data, knowledge, analysis, synthesis, resource management). A wallpaper size printout of the matrix was utilized at the TIM to solicit attendee inputs along the three themes; the activity garnered 108 submissions of ideas. Overall, what emerged from TIM discussions was a picture of mismatch between crew anomaly response needs and support that can be provided by existing intelligent technologies. The needs are broad, spanning multiple steps and processes/resources, with many of which lacking support from existing technologies, such as knowledge management throughout the steps of problem solving (especially in resolution documentation) and manpower management. The solutions provided by existing intelligent technologies are specific to the steps/processes that they are designed to support and constrained to solving only problems similar to those that have occurred before. What is lacking from technologies is typically made up by humans, specifically their complex critical thinking, creative problem solving, and domain expertise. In the end, the TIM highlighted the pressing need to support responses to onboard anomalies during autonomous crew operations, particularly those that have eluded the system tests, inspection, and other assurance processes. Such anomalies can potentially threaten crew and vehicle safety, as well as significantly impact overall operations with additional workload. These fairly rare events are difficult to anticipate and prepare for, given the state-of-the-art in intelligent technologies. This is true even for anomalies that stem from “unknown knowns”—cases in which there is sufficient external information to characterize the problem but the overall pattern fails to be recognized by the problem solver, or in which the internal knowledge needed to solve a problem is held tacitly and potentially accessible by the problem solver but not articulated. It follows that the ability to tackle anomalies lies not only with the availability of relevant information and knowledge but also their accessibility in times of need. To that end, we propose research questions along the following three broad themes: • How intelligent technologies can help make relevant knowledge and information available? • How intelligent technologies can help make relevant knowledge and information accessible? • How intelligent technologies can help support the crew operating as a team in anomaly response processes?

autonomous crew operations↗
DOE OSTI2021

CPS Testbed Architectures for WAMPAC using Industrial Substation and Control Center Platforms and Attack-Defense Evaluation

Advanced persistent threats and cyberattacks can impact wide-area monitoring, protection, and control (WAMPAC) system operation. Many cyber-physical system (CPS) testbeds have been developed for attack-defense experimentation and attack-resiliency tools evaluation for WAMPAC, but they are limited to a simulation-and-emulation based environment. This paper presents a quasi-realistic CPS attack-defense testbed-based framework for WAMPAC applications using the industrial substation and control center platforms such as eTerra integrated with the hardware-in-the-loop CPS smart grid testbed available at Iowa State University. The proposed framework includes various combinations of industry-grade substation and control center platforms, communication topologies, real-time digital simulators, and a novel cyber-physical distributed intrusion-and-anomaly detection system (D-IADS) for WAMPAC applications. The D-IADS includes a master at the control center and geographically distributed sensor devices at each substation. Each D-IADS sensor deployed at a substation or control center network monitors ingress and egress traffic, detect intrusions, and dispatch alerts to the D-IADS master. The D-IADS master centrally monitors and analyze the alerts and controls D-IADS sensors. We considered an EMP60 synthetic CPS grid as a case study to demonstrate the framework and proposed D-IADS for WAMPAC applications against cyberattack vectors such as Man-in-the-Middle DNP3 attack, denial-of-service, and data-integrity attacks.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2024

Countering Weapons of Mass Destruction Office (CWMD) Data Categorization Study: Chemical, Biological, Radiological, and Nuclear (CBRN) Detection Device Data

Pacific Northwest National Laboratory (PNNL) seeks to address critical questions related to chemical, biological, radiological, and nuclear (CBRN) detection devices. This research aims to enhance the security and understanding of these devices by investigating various aspects of their identification, communication, and functionality. The primary focus is on network security, malware detection, device identification, and intelligence gathering. CBRN data can be categorized in various ways depending on the purpose of CBRN detection devices and the specific context of the applications for analysis. Criteria that can be used to assist in this effort include but are not limited to data type, data protocol, source/destination, application, time, security, and content. This study will inform additional paths for data classification, data profiling, data mapping, and data modeling. This will help the Countering Weapons of Mass Destruction Office (CWMD) better understand their data and make informed decisions based on the insights gained from this study and their application. The CBRN Data Categorization study will include the identification of 5–10 different CBRN detection devices with unique characteristics for assessing and analyzing the data that is being produced by and transmitted from these devices.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2026

Thermal, RGB, and Multispectral Unexploded Ordnance Data Collection

As of May 1, 2026 Landmine contamination affects 58 countries and many hundreds of thousands of km² of land. For example, the National Mine Action Program Demining Ukraine reporting that up to 144,000 km² of territory are potentially contaminated and require survey and clearance (National Mine Action Program “Demining Ukraine,” n.d.) alone. This contamination includes mines and other explosive remnants of war and continues to constrain civilian access, agricultural use, infrastructure recovery, and broader socioeconomic activity (International Campaign to Ban Landmines–Cluster Munition Coalition [ICBL-CMC], 2024; Mine Action Review, 2024). Current response activities rely on established mine-action approaches including non-technical survey, technical survey, clearance, and explosive ordnance disposal, consistent with international mine-action terminology and operational practice (United Nations Mine Action Service [UNMAS], 2024; Geneva International Centre for Humanitarian Demining [GICHD], 2023). In this context, UAV-based sensing, including UAV-mounted thermal imaging, may provide a useful supplementary capability by supporting faster, safer detection and mapping of suspect hazards prior to ground intervention (Smiljanic, 2022).

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Precursor Analysis Report: Conti Ransomware Attack on the Health Service Executive of Ireland 2021

The Conti Ransomware Attack on the Health Service Executive (HSE) of Ireland 2021 Precursor Analysis Report leverages publicly available information about the attack and catalogs anomalous observables for each technique employed by the adversary. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. The HSE provides public healthcare corporate services and operational services throughout Ireland, with critical functions including the acute national ambulance service, acute hospital service, and community healthcare service. On 14 May 2021, Conti ransomware encrypted 80 percent of the HSE’s Information Technology (IT) infrastructure across corporate, hospital, community, and electronic health record services. Conti is a ransomware-as-a-service operation that encrypts local files, uses double extortion against victims, and is facilitated by many intrusion tools. The attack forced the HSE to shut down its entire IT infrastructure to contain the ransomware, forcing employees to revert to pen and paper recordkeeping and leading to the cancellation of many appointments and procedures. The adversary also exfiltrated 700 GB of data, compromising the confidentiality of patients’ protected health information. Had the adversary targeted the COVID-19 cloud systems or operational technology assets, such as Internet of Medical Things medical devices or smart building management systems, the impact of the attack would almost certainly have been far more severe. Researchers and analysts identified 21 unique techniques (used in a sequence of 23 steps) likely utilized during the attack with a total of 1,185 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Twenty-one of the identified techniques used during the attack on the HSE were precursors to the triggering event. Analysis identified 1,086 observables associated with these precursor techniques, 850 of which were assessed to have an increased likelihood of being perceived in the 57 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2025

Embedded Sensing in Additive Manufacturing Metal and Polymer Parts: A Comparative Study of Integration Techniques and Structural Health Monitoring Performance

This study presents a comparative evaluation of post-process sensor integration in additively manufactured (AM) metal and the in-situ process for polymer structures for structural health monitoring (SHM), with an emphasis on embedded sensors. Geometrically identical specimens were fabricated using copper via metal fused filament fabrication (FFF) and PLA via polymer FFF, with piezoelectric transducers (PZTs) inserted into internal cavities to assess the influence of material and placement on sensing fidelity. Mechanical testing under compressive and point loads generated signals that were transformed into time–frequency spectrograms using a Short-Time Fourier Transform (STFT) framework. An engineered RGB representation was developed, combining global amplitude scaling with an amplitude-envelope encoding to enhance contrast and highlight subtle wave features. These spectrograms served as inputs to convolutional neural networks (CNNs) for classification of load conditions and detection of damage-related features. Results showed reliable recognition in both copper and PLA specimens, with CNN classification accuracies exceeding 95%. Embedded PZTs were especially effective in PLA, where signal damping and environmental sensitivity often hinder surface-mounted sensors. This work demonstrates the advantages of embedded sensing in AM structures, particularly when paired with spectrogram-based feature engineering and CNN modeling, advancing real-time SHM for aerospace, energy, and defense applications.

additive manufacturing↗
DOE OSTI2025

Discovering methylated DNA motifs in bacterial nanopore sequencing data with MIJAMP

Abstract Bacterial DNA methylation is involved in diverse cellular functions, including modulation of gene expression, DNA repair, and restriction–modification systems for defense against viruses and other foreign DNA. Restriction systems hinder efforts to engineer organisms to produce fuels and chemicals from waste and renewable feedstocks by degrading DNA during transformation. Methylome analysis allows identification of motifs within a bacterial chromosome that may be targeted by native restriction enzymes. Further expression of the corresponding methyltransferases in Escherichia coli allows plasmid DNA to be protected from restriction in the target organism, thereby drastically enhancing transformation efficiency. Nanopore sequencing can detect methylated bases, but software is needed to transform modified base coordinates into methylated motifs. Here, we develop MIJAMP (MIJAMP Is Just A MethylBED Parser), a software package that was developed to discover methylated motifs from the output of ONT’s Modkit or other data in the methylBED format. MIJAMP employs a human-driven refinement strategy that empirically validates all motifs against genome-wide methylation data, thus eliminating incorrect motifs. MIJAMP also reports methylation data on specific, user-defined motifs. Using MIJAMP, we determined the methylated motifs both in a control strain (wild-type E. coli) and in Synecococcus sp. strain PCC7002, laying the foundation for improved transformation in this organism. MIJAMP is available at https://code.ornl.gov/alexander-public/mijamp/. One Sentence Summary: Here we describe software written to discover DNA methylation motifs from nanopore sequencing data.

59 BASIC BIOLOGICAL SCIENCES↗
DOE OSTI2024

Surveillance & Detection (CRADA 567 Final Report)

This Cooperative Research and Development Agreement (CRADA) Final Report covers the work achieved by PNNL and it's commercial partner (Consolidated Resource Imaging, LLC) on video analytics for the DHS S&T Surveillance & Detection project. This project has been focused on development of the next-generation camera system (Guardian iiS) with extremely high resolution and video analytics specifically designed for crowded urban environments and congested transportation hubs.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2025

Precursor Analysis Report: Blackmatter Ransomware Attack on New Cooperative 2021

The BlackMatter Ransomware Attack on New Cooperative 2021 Precursor Analysis Report leverages publicly available information about the New Cooperative cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. The BlackMatter ransomware was first identified in July 2021 and is reported to have infected more than 50 corporations around the world. , The Iowa-based grain cooperative, New Cooperative, was impacted by the BlackMatter ransomware on or before 18 September 2021. The adversary likely resided on New Cooperative’s networks for 15 days prior to encrypting its network and demanding New Cooperative pay $5.9 million in ransom by 25 September to unlock systems and prevent 1 terabyte (TB) of sensitive data from being publicly released. It is not clear if New Cooperative paid the ransom. The full impact of the ransomware attack is not known; however, according to New Cooperative’s general manager, the attack caused the company’s automated processes to revert back to processes used in the 1970s. , As of 6 October, only 50 percent of New Cooperative’s operations were utilizing automated processes. The company took eight weeks to rebuild the entire network and information technology (IT) systems from the ground up, which puts the date of fully recovery around 13 November. Researchers and analysts identified 20 unique techniques utilized during the attack with a total of 404 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Seventeen of the identified techniques used during the New Cooperative cyber attack were precursors to the triggering event. Analysis identified 360 observables associated with these precursor techniques, 284 of which were assessed to have an increased likelihood of being perceived in the 15 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Precursor Analysis Report: Cyber Attack on Thyssenkrupp Blast Furnace 2014

The Cyber Attack on Thyssenkrupp Blast Furnace 2014 Precursor Analysis Report leverages publicly available information about the Thyssenkrupp Steel Mill cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. In December 2014, the German Government’s Federal Office for Information Security (BSI) released a report detailing a cyber attack on a German steel mill that occurred earlier that year, though exact dates and details of the attack were not revealed. While the report did not specify the name of the company, multiple sources identified the victim as one of Europe’s largest steel manufacturers, Thyssenkrupp AG. Further, Thyssenkrupp announced on 16 May of that year that Europe’s largest blast furnace, “Schwelgern 2,” located at its facility in Duisburg, Germany, would be offline for several weeks for repairs and upgrades, suggesting Schwelgern 2 was likely the target of the attack. The attack began in early 2014, when adversaries infiltrated the victim steel mill’s Information Technology (IT) network via a spearphishing campaign, then worked their way into the Operational Technology (OT) environment, where they executed software that caused denial of service, denial of control, and eventually a loss of control. This led to the blast furnace shutting down without proper safety procedures, resulting in catastrophic physical damage. No lives were lost in the incident, but ThyssenKrupp suffered $4 million in damage to the blast furnace and an additional $6 million in lost revenue. The adversaries required specialized knowledge and expertise in steel production, which enabled them to compromise a variety of internal systems and components across both IT and OT networks. The attack also demonstrated detailed knowledge of the industrial control systems (ICS) and production processes being used. This combination resulted in one of the earliest known publicly reported cybersecurity incidents resulting in physical damage to ICS equipment. Researchers and analysts identified 19 unique techniques (used in a sequence of 20 steps) utilized during the attack with a total of 454 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Fifteen of the identified techniques used during the Thyssenkrupp cyber attack were precursors to the triggering event. Analysis identified 369 observables associated with these precursor techniques, 316 of which were assessed to have an increased likelihood of being perceived in the 120 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗