Search NASA⌕ Search

SEARCH · Search NASA

Results for “Threat Detection”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 271 records · Page 15
All sourcesNASA NTRSDOE OSTI
DOE OSTI2023

Cyber-Resilient Automatic Generation Control for Systems of AC Microgrids

In this paper we propose a co-design of the secondary frequency regulation in systems of AC microgrids and its cyber security solutions. We term the secondary frequency regulator a Micro-Automatic Generation Control (μ AGC) for highlighting its same functionality as the AGC in bulk power systems. We identify sensory challenges and cyber threats facing the μ AGC. To address the sensory challenges, we introduce a new microgrid model by exploiting the rank-one deficiency property of microgrid dynamics. This model is used to pose an optimal μ AGC control problem that is easily implemented, because it does not require fast frequency measurements. An end-to-end cyber security solution to the False Data Injection (FDI) attack detection and mitigation is developed for the proposed μ AGC. The front-end barrier of applying off-the-shelf algorithms for cyber attack detection is removed by introducing a data-driven modeling approach. Finally, we propose an observer-based corrective control for an islanded microgrid and a collaborative mitigation scheme in systems of AC microgrids. We demonstrate a collaborative role of systems of microgrids during cyber attacks. Furthermore, the performance of the proposed cyber-resilient μ AGC is tested in a system of two networked microgrids.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

AI-Based Protective Relays for Electric Grid Resiliency

The protection systems (circuit breakers, relays, reclosers, and fuses) of the electric grid are the primary component responding to resilience events, ranging from common storms to extreme events. The protective equipment must detect and operate very quickly, generally <0.25 seconds, to remove faults in the system before the system goes unstable or additional equipment is damaged. The burden on protection systems is increasing as the complexity of the grid increases; renewable energy resources, particularly inverter-based resources (IBR) and increasing electrification all contribute to a more complex grid landscape for protection devices. In addition, there are increasing threats from natural disasters, aging infrastructure, and manmade attacks that can cause faults and disturbances in the electric grid. The challenge for the application of AI into power system protection is that events are rare and unpredictable. In order to improve the resiliency of the electric grid, AI has to be able to learn from very little data. During an extreme disaster, it may not be important that the perfect, most optimal action is taken, but AI must be guaranteed to always respond by moving the grid toward a more stable state during unseen events.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2025

Hands-On, Heads-Up: Blending Cyber T&E with Data Science-Driven Training in Jupyter Notebooks

In an era of increasingly sophisticated threats to critical infrastructure, cybersecurity professionals must be more than just aware; they must be immersed, agile, and equipped to operate in environments where failure is not an option. Nowhere is this truer than in the nuclear sector, where cyber-physical systems, regulatory scrutiny, and insider threat potential demand a new generation of hands-on, technically fluent defenders. This paper presents a unified training approach that integrates Cybersecurity Test and Evaluation (T&E) with data science techniques using Jupyter Notebooks as the interactive lab environment. The program centers on a modular, scenario-driven curriculum designed to build not just knowledge but practical capability in the assessment and defense of radiation detection systems, firmware interfaces, and operational security postures.

98 - NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL↗
DOE OSTI2022

Cross-Layered Cyber-Physical Power System State Estimation towards a Secure Grid Operation

In the Smart Grid paradigm, this critical infrastructure operation is increasingly exposed to cyber-threats due to the increased dependency on communication networks. An adversary can launch an attack on a power grid operation through False Data Injection into system measurements and/or through attacks on the communication network, such as flooding the communication channels with unnecessary data or intercepting messages. A cross-layered strategy that combines power grid data, communication grid monitoring and Machine Learning based processing is a promising solution for detecting cyberthreats. In this paper, an implementation of an integrated solution of a cross-layer framework is presented. The advantage of such a framework is the augmentation of valuable data that enhances the detection of anomalies in the operation of power grid. IEEE 118-bus system is built in Simulink to provide a power grid testing environment and communication network data is emulated using SimComponents. The performance of the framework is investigated under various FDI and communication attacks.

cyber security, network security, cyber-physical s↗
DOE OSTI2021

Analysis of Organophosphorus-Based Nerve Agent Degradation Products by Gas Chromatography-Mass Spectrometry (GC-MS): Current Derivatization Reactions in the Analytical Chemist’s Toolbox

The field of gas chromatography-mass spectrometry (GC-MS) in the analysis of chemical warfare agents (CWAs), specifically those involving the organophosphorus-based nerve agents (OPNAs), is a continually evolving and dynamic area of research. The ever-present interest in this field within analytical chemistry is driven by the constant threat posed by these lethal CWAs, highlighted by their use during the Tokyo subway attack in 1995, their deliberate use on civilians in Syria in 2013, and their use in the poisoning of Sergei and Yulia Skripal in Great Britain in 2018 and Alexei Navalny in 2020. These events coupled with their potential for mass destruction only serve to stress the importance of developing methods for their rapid and unambiguous detection. Although the direct detection of OPNAs is possible by GC-MS, in most instances, the analytical chemist must rely on the detection of the products arising from their degradation. To this end, derivatization reactions mainly in the form of silylations and alkylations employing a vast array of reagents have played a pivotal role in the efficient detection of these products that can be used retrospectively to identify the original OPNA.

sarin↗
DOE OSTI2023

Hybrid Attack Graph Generation with Graph Convolutional Deep-Q Learning

Critical infrastructures such as power grids have become increasingly complex, connected, and vulnerable to adverse scenarios, including cyber and physical attacks and faults. Effective risk mitigation for such cyber-physical energy systems (CPES), requires preemptive knowledge of likely adversarial attack scenarios. Hybrid Attack Graph (HAG) is a structured way to represent an adversarial scenario as an attack sequence using a threat model. However, the scarcity of documented attack sequences hinders analysts and CPES planners’ ability to identify credible attack scenarios for a given CPES. We propose a data-driven Graph Convolutional Deep-Q Network (GCDQ) to address this data challenge through generating HAGs. By leveraging limited real-world observations from the MITRE ATT&CK knowledge base, our GCDQ model synthesizes realistic graphs with the targeted attribute of minimum detectability via reinforcement learning. This generative model is the first step in creating a tool to substantially boost the attack sequence dataset and enhance the performance of CPS defense-related tasks by providing insights into likely attack sequences with given attributes.

deep learning, artificial intelligence↗
DOE OSTI2021

Cybersecurity Resiliency of Marine Renewable Energy Systems Part 2: Cybersecurity Best Practices and Risk Management

Marine renewable energy (MRE) is an emerging source of power for marine applications, marine devices, and coastal communities. This energy source relies on industrial control systems and IT to support operations and maintenance activities, which create a pathway for an adversary to gain unauthorized access to systems and data and disrupt operations. Incorporating cybersecurity risk prevention measures and mitigation capabilities from inception, development, operation, to decommissioning of the MRE system and components is paramount to the protection of energy generation and the security of network architecture and infrastructure. To improve the resilience of MRE systems as a predictable, affordable, and reliable source of energy, cybersecurity guidance was developed to enable operators to assess cybersecurity risks and implement security measures commensurate with the risk. This publication is the second of a two-part series, with Part 1 addressing a framework to determine cybersecurity risk by assessing the vulnerability of an MRE system to potential cyber threats and the consequences a cyberattack would have on the end user. This Part 2 publication describes an approach to select appropriate cybersecurity best practices commensurate with the MRE system's cybersecurity risk. The guidance includes 86 cybersecurity best practices, which are associated with 36 cybersecurity domains and grouped into nine categories. The best practices follow the core functions of the National Institute of Science and Technology Cybersecurity Framework (e.g., identify, detect, protect, respond, and and recover) and insights from both maritime and energy industry guidance documents to identify security measures effective in protecting information and operational technology assets prevalent in MRE systems.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Imaging the Future Threats of the Sand Dunes Along the Northwestern Coast of Nile Delta Using SAR

Although the Sand dunes screen the coastal cities from the sand dunes hazards and their infrastructures from rising sea levels and storms, they might threaten and hide the surrounding developmental projects. Thus, imaging these coastal dunes' internal anatomy and dynamics are crucial to protect the environment. In this study, the Optical and Synthetic Aperture Radar (SAR) images were processed and integrated with field observations and surveys to extract information about the past, current, and future behavior of coastal dunes in the Nile Delta-Northwest sector. A conventional change detection method using the supervised Landsat-8 images for the years 2015 and 2017 were generated to show a rapid change in the sand dune cover, where the high-resolution images of Google Earth were used to digitize the dune crests and measure its encroachment rate, which has been reached about 4 m/year with the NW–SE direction. The full-polarimetric ALOS/PALSAR-2 images from the years 2015 and 2017 show very low coherence for the sand dunes, which means these dunes are dynamic, where the changes in both power and phase imbalances of different dune fields during the investigated years (2015 and 2017) show high differences in values, which reached 40 dB and 0.06°, respectively. Finally, the extracted radar facies from the field survey show two successive groups of coastal sand dunes show a decline in the heavy minerals content to a level that might threaten the properties at the shoreline due to sea level rise and wave storms if mitigation actions are not taken place soon.

Ramadan, Rabab↗
DOE OSTI2020

Bioscience COVID Rapid Response Report

The COVID-19 disease outbreak and its impact on global health and economies have highlighted the national security threat posed by pathogens with pandemic potential and the need for rapid development of effective diagnostics and medical countermeasures. The Bioscience IA selected for funding rapid COVID LDRD project proposals that addressed critical R&D gaps in pandemic response that could be accomplished in 1-3 months with the requested funding. In total, the Bioscience IA funded nine rapid projects that addressed 1) rapid and accurate methods for SARS-CoV-2 RNA detection, 2) modeling tools to help prioritize populations for diagnostic testing, 3) bioinformatic tools to track SARS-CoV-2 genomic sequence changes over time, 4) molecular inhibitors of SARS-CoV-2 cellular infection, and 5) method for rapid staging of COVID19 disease to enable administration of more effective treatments. In addition, LDRD funded one larger project to be completed in FY21 that leverages Sandia capabilities to address the need for platform diagnostics and therapeutics that can be rapidly tailored against emerging pathogen targets.

59 BASIC BIOLOGICAL SCIENCES↗
DOE OSTI2020

Seismic tomography of compressional wave velocity and attenuation structure for Makushin Volcano, Alaska

Located in the central portion of the Alaska-Aleutian subduction zone, Makushin Volcano is among the most active volcanoes in the United States and has been classified as a very high threat by the National Volcano Early Warning System based on its eruptive history and proximity to the City of Unalaska and international air routes. In 2015, five standalone seismic stations and three mini seismic arrays of 15 stations each were deployed on Unalaska Island to supplement the Alaska Volcano Observatory permanent seismic network. This temporary array was operational for one year. Taking advantage of the increased azimuthal coverage and the array's increased earthquake detection capability, we developed body-wave Vp and Vp/Vs seismic images of the velocity structure beneath the volcano. Our results show a complex structure with the upper 4 km of the crust. The shallow high-Vp features possibly delineate remnant magma pathways or conduits. Low-Vp regions are found east of the caldera at approximately 4–8 km depth. This is in agreement with previous seismic tomographic work and InSAR-based geodetic models, which had identified this region as a possible long-term source of magma. A three-dimensional compressional wave attenuation model complemented the velocity models. In general, we observe regions of corresponding low P-wave velocity and high attenuation east of the summit caldera between 5 and 7 km depth, supporting the presence of a melt-rich zone. The absolute Vp values (5.5–6.0 km/s) in this region are consistent with the presence of a magma body with a mafic signature. Here, we suggest that a triggering mechanism that involves mafic injections into a more evolved shallow magma chamber is representative of the current magmatic system below the volcano, similarly to what petrological studies have inferred for past eruptions.

58 GEOSCIENCES↗
DOE OSTI2023

DNA metabarcoding reveals consumption of diverse community of amphibians by invasive wild pigs (Sus scrofa) in the southeastern United States

Abstract Invasive wild pigs ( Sus scrofa ) are one of the most widespread, destructive vertebrate species globally. Their success can largely be attributed to their generalist diets, which are dominated by plant material but also include diverse animal taxa. Wild pigs are demonstrated nest predators of ground-nesting birds and reptiles, and likely pose a threat to amphibians given their extensive overlap in wetland use. DNA metabarcoding of fecal samples from 222 adult wild pigs culled monthly from 2017 to 2018 revealed a diverse diet dominated by plant material, with 166 plant genera from 56 families and 18 vertebrate species identified. Diet composition varied seasonally with availability for plants and was consistent between sexes. Amphibians were the most frequent vertebrate group consumed and represented the majority of vertebrate species detected, suggesting amphibians are potentially vulnerable to predation by wild pigs in our study region. Mammal, reptile, and bird species were also detected in pig diets, but infrequently. Our results highlight the need for research on the impacts of wild pigs on amphibians to better inform management and conservation of imperiled species.

59 BASIC BIOLOGICAL SCIENCES↗
DOE OSTI2021

Data-Driven Cyber-Attack Detection for PV Farms via Time-Frequency Domain Features

The internetworking of grid-connected power electronics converters (PECs) in photovoltaic (PV) farms has inevitably expanded the cyber-attack surfaces. Here this paper presents a comprehensive study on cyber-attack detection and diagnosis for PEC-enabled PV farms via single waveform sensor to distinguish between normal conditions, open-circuit faults, short-circuit faults, and cyber-attacks. To our knowledge, this has not been attempted before. Firstly, we propose frequency-domain magnitude-based residuals to identify short-circuit faults and a time-domain mean current vector-based feature to distinguish open-circuit faults from other threats. These features can fully reflect the specific physical characteristics of PV farms during threat duration. Secondly, unlike micro phasor measurement units (µPMU) and raw electric waveform-based methods, the proposed innovative features can address novel cyber-attacks that are excluded from the training process. Thirdly, an online hardware-in-the-loop (HIL) testbed using the OPAL-RT real-time digital simulator has verified the effectiveness. The monitoring system runs in real-time while using HIL as an operational solar farm and a National Instruments (NI) data acquisition card as the electric waveform sensor at the point of coupling.

42 ENGINEERING↗
DOE OSTI2022

Cross-Layered Distributed Data-Driven Framework for Enhanced Smart Grid Cyber-Physical Security

Smart Grid (SG) research and development has drawn much attention from academia, industry and government due to the great impact it will have on society, economics and the environment. Securing the SG is a considerably significant challenge due the increased dependency on communication networks to assist in physical process control, exposing them to various cyber-threats. In addition to attacks that change measurement values using False Data Injection (FDI) techniques, attacks on the communication network may disrupt the power system's real-time operation by intercepting messages, or by flooding the communication channels with unnecessary data. Addressing these attacks requires a cross-layer approach. In this paper a cross-layered strategy is presented, called Cross-Layer Ensemble CorrDet with Adaptive Statistics(CECD-AS), which integrates the detection of faulty SG measurement data as well as inconsistent network inter-arrival times and transmission delays for more reliable and accurate anomaly detection and attack interpretation. Numerical results show that CECD-AS can detect multiple False Data Injections, Denial of Service (DoS) and Man In The Middle (MITM) attacks with a high F1-score compared to current approaches that only use SG measurement data for detection such as the traditional physics-based State Estimation, Ensemble CorrDet with Adaptive Statistics strategy and other machine learning classification-based detection schemes.

cyber-physical security↗
DOE OSTI2021

Security Vulnerability and Mitigation in Photovoltaic Systems

Software and firmware vulnerabilities pose security threats to photovoltaic (PV) systems. When patches are not available or cannot be timely applied to fix vulnerabilities, it is important to mitigate vulnerabilities such that they cannot be exploited by attackers or their impacts will be limited when exploited. However, the vulnerability mitigation problem for PV systems has received little attention. This paper analyzes known security vulnerabilities in PV systems, proposes a multi-level mitigation framework and various mitigation strategies including neural network-based attack detection inside inverters, and develops a prototype system as a proof-of-concept for building vulnerability mitigation into PV system design.

14 SOLAR ENERGY↗
DOE OSTI2021

Intelligent Consequence Control by Aerial Reconnoiter Using Unmanned Systems

In a nuclear accident, or in the aftermath of an improvised nuclear device or radiological dispersal device detonation, radioactive materials may pose a severe health threat to individuals near the site of the incident. The Intelligent Consequence Control by Aerial Reconnoiter Using Unmanned Systems (ICARUS) does the dull, dirty, and dangerous (and, sometimes, deep) work of mapping and characterizing valuable information to enable a safe and appropriate response. ICARUS provides timely answers to the questions, “What is it?” “Where is it?”, and “How far does it extend?” Using commercial, off-the-shelf proven components, the integrated chemical, biological, radiological, nuclear, and explosives detection architecture for our drones provides a solution for collecting radiological, chemical, and optical information on developing complex situations, returning actionable data for determining if it is safe for further response efforts. ICARUS can determine and transmit the location, identity, and intensity of radionuclide contamination to a remote base station. It can deliver on the unexpected.

73 NUCLEAR PHYSICS AND RADIATION PHYSICS↗
DOE OSTI2024

The Design and Evaluation of Zero Trust Architecture for Electric Vehicle Charging Infrastructure: EVs @ Scale Series on EV Charging Station Cybersecurity

Implementing a zero trust architecture can significantly bolster the security of electric vehicle (EV) charging infrastructure. EV charging infrastructure includes numerous networked interfaces, each of which can present potential vulnerabilities. When these vulnerabilities are exploited, they can compromise the entire system, leading to severe operational and security risks. Zero trust is a security model that operates on the principle of "never trust, always verify," which helps manage the attack surface and limit the scope of any potential compromises. Fundamentally, this model ensures that no entity, whether inside or outside the network, is trusted by default. The design principles of zero trust include continuous verification, strict deny-by-default access controls, and micro-segmentation. Continuous verification ensures that every request is thoroughly checked, regardless of its origin. Strict access controls enforce the principle of least privilege, allowing users and devices only the minimum necessary access to perform their functions. Micro-segmentation involves dividing the network into smaller, isolated segments to prevent lateral movement in case of a breach. In the context of EV charging infrastructure, zero trust can be implemented through various strategies. For example, multi-factor authentication (MFA) can be required for engineers to access the management interfaces and control systems of charging stations. Real-time monitoring and analysis of network traffic can help detect and respond to anomalies. Systems that do not need to communicate with each other can be micro-segmented to enhance security. All communications should adhere to predefined policies to be permitted. Additionally, encrypting communications can protect sensitive information exchanged between chargers and management systems. This paper presents a zero trust architecture specifically designed for EV charging infrastructure. Implementing zero trust not only mitigates risks but also builds a resilient infrastructure capable of withstanding and quickly recovering from cyber threats. The architecture addresses six defined security objectives. A comprehensive test plan is developed to assess the architecture against these objectives, and the results of the evaluation are reported. This approach is essential for maintaining the reliability and integrity of EV charging services in an increasingly interconnected and vulnerable digital landscape. This is the first in a planned series of papers exploring the implementation of zero trust in EV charging infrastructure. Each paper will delve into different aspects and applications of zero trust, highlighting how various work processes and requirements can lead to distinct architectural designs. These architectures will be tailored to address specific security challenges and operational needs within the EV charging ecosystem, ensuring a robust and adaptable security framework.

33 ADVANCED PROPULSION SYSTEMS↗
DOE OSTI2026

Decentralised Reinforcement Learning for Dynamic Cyberattack Response in Microgrid Networks

Microgrids rely on communication networks for reliable operation, which makes them inherently vulnerable to cyberattacks. Such attacks can destabilise system dynamics and drive states away from their nominal operating trajectories. Although several physics-informed and machine learning-based strategies have been developed to counter these threats, the rapidly evolving cyber landscape enables adversaries to bypass static defences or rules-based mitigation approaches. This paper proposes a dynamic, online-trained and fully decentralised reinforcement learning (RL)-based cyberattack response framework to protect microgrids from evolving cyberattacks. The proposed framework deploys multiple deep Q-networks (DQNs), each associated with a distributed energy resource (DER), to enable localised and adaptive attack mitigation. In this framework, each DQN processes local voltage and frequency measurements—combined with intrusion detection system (IDS) alerts—as observations and rewards to guide decision-making. Extensive simulation studies demonstrate the robustness of the proposed framework under diverse attack scenarios and varying IDS-induced detection delays. Comparative analysis highlights its superiority over existing static or preexisting rules-based mitigation approaches. Finally, we present an analysis that shows the framework's scalability to real-life microgrids with more interacting agents.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

UAS Live Incursion Drills Survey

Unmanned aircraft systems (UAS/drones) are rapidly evolving and are considered an emerging threat by nuclear facilities throughout the world. Due to the wide range of UAS capabilities, members of the workforce and security/response force personnel need to be prepared for a variety of drone incursion situations. Tabletop exercises are helpful, but actual live exercises are often needed to evaluate the quick chain of events that might ensue during a real drone fly-in and the essential kinds of information that will help identify the type of drone and pilot. Even with drone detection equipment, the type of UAS used for incursion drills can have a major impact on detection altitude and finding the UAS in the sky. Using a variety of UAS, the U.S. National Nuclear Security Administration (NNSA) Office of International Nuclear Security (INS) would like to offer partners the capability of adding actual UAS into workforce and response exercises to improve overall UAS awareness as well as the procedures that capture critical steps in dealing with intruding drones.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗