Search NASA⌕ Search

SEARCH · Search NASA

Results for “threat modeling”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 343 records · Page 19

U.S. Domestic Microreactor Security-by-Design

U.S. nuclear power facilities face increasing challenges in meeting dynamic security requirements caused by evolving and expanding threats while keeping cost reasonable to make nuclear energy competitive. The past approach has often included implementing security features after a facility has been designed and without attention to optimization, which can lead to cost overruns. Incorporating security in the design process can provide robust, cost effective, and sufficient physical protection systems. The purpose of this work is both to develop a framework for the integration of security into the design phase of a microreactor and increase the use of modeling and simulation tools to optimize the design of physical protection systems. Specifically, this effort focuses on integrating security into the design phase of a model microreactor that meets current Nuclear Regulatory Commission (NRC) physical protection requirements and providing advanced solutions to improve physical protection and decrease costs. A suite of tools, including SCRIBE3D©, PATHTRACE© and Blender© were used to model a hypothetical, generic domestic microreactor facility. Physical protection elements such as sensors, cameras, barriers, and guard forces were added to the model based on best practices for physical protection systems. Multiple outsider sabotage scenarios were examined with four-to-eight adversaries to determine security metrics. The results of this work will influence physical protection system designs and facility designs for U.S. domestic microreactors. This work will also demonstrate how a series of experimental and modeling capabilities across the Department of Energy (DOE) Complex can impact the design of and complete Safeguards and Security by Design (SSBD) for microreactors. The conclusions and recommendations in this document may be applicable to all microreactor designs.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗

Climate Impact of Primary Plastic Production

Plastics show the strongest production growth of all bulk materials over the last decade. The industry’s current growth trajectory is exponential and plastic production is expected to double or triple by 2050. The rapidly increasing production of plastics and the continued reliance on fossil fuels for production, have contributed to numerous environmental problems and health harms. As a result, plastic pollution has become an increasing threat to natural ecosystems, human health and climate. However, there is a lack of granularity on the contribution of the primary plastics specifically to greenhouse gas (GHG) emissions and their impact on the remaining global carbon budget needed to stay below a 1.5°C or 2°C global average temperature rise. In this report, we explore the contribution of primary plastic production to climate change disaggregated by polymer and technology. To this end, we have developed comprehensive bottom-up modeling of GHG emissions from global primary plastic production, with a special focus on polymer value chains. We have analyzed the results under various growth scenarios in the context of carbon budgets compatible with a 1.5°C global trajectory. Modeling includes the material flows of all production stages, processes and technologies used in primary plastic production value chains, including from the extraction of fossil fuels required for production to shaping the final product. We specifically focus on nine major types of fossil fuelbased plastic polymers that are produced and consumed in large quantities: three types of polyethylene (PE) – low-density (LDPE), linear low-density (LLDPE), and high-density (HDPE) – as well as polypropylene (PP); polyethylene terephthalate (PET); polyvinyl chloride (PVC); polystyrene (PS) and other key styrene-based plastics such as styrene acrylonitrile (SAN) and acrylonitrile butadiene styrene (ABS), and polyurethane (PU). Together these account for about 80% of plastics production.

54 ENVIRONMENTAL SCIENCES↗

Climate Impact of Primary Plastic Production

Plastics show the strongest production growth of all bulk materials over the last decade. The industry’s current growth trajectory is exponential and plastic production is expected to double or triple by 2050. The rapidly increasing production of plastics and the continued reliance on fossil fuels for production, have contributed to numerous environmental problems and health harms. As a result, plastic pollution has become an increasing threat to natural ecosystems, human health and climate. However, there is a lack of granularity on the contribution of the primary plastics specifically to greenhouse gas (GHG) emissions and their impact on the remaining global carbon budget needed to stay below a 1.5°C or 2°C global average temperature rise. In this report, we explore the contribution of primary plastic production to climate change disaggregated by polymer and technology. To this end, we have developed comprehensive bottom-up modeling of GHG emissions from global primary plastic production, with a special focus on polymer value chains. We have analyzed the results under various growth scenarios in the context of carbon budgets compatible with a 1.5°C global trajectory. Modeling includes the material flows of all production stages, processes and technologies used in primary plastic production value chains, including from the extraction of fossil fuels required for production to shaping the final product. We specifically focus on nine major types of fossil fuel-based plastic polymers that are produced and consumed in large quantities: three types of polyethylene (PE) – low-density (LDPE), linear low-density (LLDPE), and high-density (HDPE) – as well as polypropylene (PP); polyethylene terephthalate (PET); polyvinyl chloride (PVC); polystyrene (PS) and other key styrene-based plastics such as styrene acrylonitrile (SAN) and acrylonitrile butadiene styrene (ABS), and polyurethane (PU). Together these account for about 80% of plastics production.

54 ENVIRONMENTAL SCIENCES↗

Deep Deception: Exemplars of Adversarial Machine Learning and Countermeasures Applicable to International Safeguards

As a follow-up to our more comprehensive report on Adversarial Machine Learning (AML), here we provide demonstrations of AML attacks against the Limbo image database of UF6 cylinders in a variety of orientations and amongst a variety of distractor images. We demonstrate the Carlini & Wagner AML attack against a subset of Limbo images, with 100% attack success rate; meaning all attacked images were misclassified by a highly accurate trained model, yet the image changes were imperceptible to the human eye. We also demonstrate successful attacks against segmented images (images with more than one targeted object). Finally, we demonstrated the Fast Fourier Transform countermeasure that can be used to detect AML attacks on images. The intent of this and our previous report is to inform the IAEA and stakeholders of both the promise of machine learning, which could greatly improve the efficiency of surveillance monitoring, but also of the real threat of AML and potential defenses.

97 MATHEMATICS AND COMPUTING↗

Linking climate change and human systems: a case study of Arctic pipelines

This case study estimates the potential economic risk from permafrost thaw on oil and gas pipelines in the Russian Arctic as part of a larger effort to better understand complex interactions between human and earth systems in the Arctic. Pan-Arctic simulations of permafrost thaw-depth from the Community Land Model version 4.5 and ground ice characteristics were used to generate ground subsidence projections over the period 2020 to 2040 with a quantification of uncertainty. Russian oil and gas transmission pipeline networks were then overlaid on the permafrost thaw projections in ArcGIS to identify pipelines vulnerable to damage from permafrost thaw. Recent pipeline construction costs were used to estimate the total replacement costs for at-risk pipelines under several thaw scenarios. The results indicate that permafrost thaw poses a major threat to pipeline infrastructure, especially gas pipelines, in the Russian Arctic. Over the twenty-year study period, total replacement costs for oil and gas pipelines were estimated at $\$$110 billion in 2020 USD. Reduced economic viability of pipelines under climate change will likely trigger major shifts in the Russian oil and gas industry, which would have impacts on markets, emissions, and geopolitics.

54 ENVIRONMENTAL SCIENCES↗

Faster network disruption from layered oscillatory dynamics

Nonlinear complex network-coupled systems typically have multiple stable equilibrium states. Following perturbations or due to ambient noise, the system is pushed away from its initial equilibrium, and, depending on the direction and the amplitude of the excursion, it might undergo a transition to another equilibrium. It was recently demonstrated [M. Tyloo, J. Phys. Complex. 3 03LT01 (2022)] that layered complex networks may exhibit amplified fluctuations. Here, I investigate how noise with system-specific correlations impacts the first escape time of nonlinearly coupled oscillators. Interestingly, I show that, not only the strong amplification of the fluctuations is a threat to the good functioning of the network but also the spatial and temporal correlations of the noise along the lowest-lying eigenmodes of the Laplacian matrix. Finally, I analyze first escape times on synthetic networks and compare noise originating from layered dynamics to uncorrelated noise.

97 MATHEMATICS AND COMPUTING↗

Efficient Anomaly Detection Driven By Different Machine Learning Architectures And Models

The rapid growth and ubiquitous adoption of the internet and cyber-physical systems (CPS) have fundamentally transformed modern communication, work, and human-system interactions. While networks now form the backbone of critical digital ecosystems, enabling seamless data transmission across diverse, interconnected systems, this increased connectivity also expands the attack surface, making real-time detection of network intrusions and anomalies a pressing challenge. Detecting unusual activities within network infrastructure requires advanced data traffic analysis to differentiate between legitimate and malicious interactions. Traditional approaches to network anomaly detectionâ??such as rule-based and signature-based systemsâ??often depend on predefined patterns to identify known anomalies, limiting their effectiveness against emerging, stealthy, or previously unseen threats. These conventional methods suffer from high false alarm rates and fail to adapt to the ever-evolving nature of network traffic, particularly in large-scale, decentralized environments where data volume, velocity, and variety are constantly increasing. This dissertation presents artificial intelligence (AI)-driven approaches to anomaly detection that leverage graphics processing unit (GPU)-enabled high-performance computing (HPC) platforms for processing massive network traffic data and monitoring the components of cyber-physical systems (CPS) for potentially hazardous conditions. The research advances several key contributions: (1) Designing efficient machine learning techniques for CPS condition monitoring and anomaly detection; (2) enabling federated learning (FL) frameworks that enable distributed detection while preserving data privacy and system resilience; (3) exploring graph-based methodologies combining graph neural networks (GNN) and graph machine learning (ML) approaches for the Internet of Things (IoT) and automotive network security, and (4) performing distributed edge computing optimizations that integrate FL with scalable technologies for reduced communication overhead. Through extensive experiments, these methodologies demonstrate that complex anomaly detection and condition monitoring tasks can be achieved while balancing computational efficiency and detection accuracy through fine-grained network information processing. The frameworks developed in this research establish a robust foundation for network anomaly detection, providing scalable, adaptive, and privacy-preserving solutions for safeguarding CPS and IoT networks in an increasingly interconnected digital landscape. The practical implications of these research findings are significant, as they can inform the development of next-generation network security systems and contribute to the protection of critical infrastructure against sophisticated cyber attacks.

Marfo, William↗

Multisectoral analysis of drought impacts and management responses to the 2008–2015 record drought in the Colorado Basin, Texas

Abstract. Drought has long posed an existential threat to society. Engineering and technological advancements have enabled the development of complex, interconnected water supply systems that buffer societies from the impacts of drought, enabling growth and prosperity. However, increasing water demand from population growth and economic development, combined with more extreme and prolonged droughts due to climate change, poses significant challenges for governments in the 21st century. Improved understanding of the cascading multisectoral impacts and adaptive responses resulting from extreme drought can aid in adaptive planning and highlight key processes in modeling drought impacts. The record drought spanning 2008 to 2015 in the Colorado Basin in the state of Texas, United States, serves as an outstanding illustration to assess multisectoral impacts and responses to severe, multi-year drought. The basin faces similar water security challenges to those across the western US, such as groundwater depletion and sustainability, resource competition between agriculture and growing urban populations, limited options for additional reservoir expansion, and the heightened risk of more severe and frequent droughts due to climate change. By analyzing rich, high-quality data sourced from nine different local, state, and federal sources, we demonstrate that characterizing regional multisector dynamics is crucial to predicting and understanding future vulnerability and possible approaches to reduce impacts to human and natural systems in the face of extreme drought conditions. This review reveals that, despite the severe hydrometeorological conditions of the drought, the region's advanced economy and existing water infrastructure effectively mitigated economic and societal impacts.

54 ENVIRONMENTAL SCIENCES↗

Reinforcement Learning for feedback-enabled cyber resilience

The rapid growth in the number of devices and their connectivity has enlarged the attack surface and made cyber systems more vulnerable. As attackers become increasingly sophisticated and resourceful, mere reliance on traditional cyber protection, such as intrusion detection, firewalls, and encryption, is insufficient to secure the cyber systems. Cyber resilience provides a new security paradigm that complements inadequate protection with resilience mechanisms. A Cyber-Resilient Mechanism (CRM) adapts to the known or zero-day threats and uncertainties in real-time and strategically responds to them to maintain the critical functions of the cyber systems in the event of successful attacks. Feedback architectures play a pivotal role in enabling the online sensing, reasoning, and actuation process of the CRM. Reinforcement Learning (RL) is an important gathering of algorithms that epitomize the feedback architectures for cyber resilience. It allows the CRM to provide dynamic and sequential responses to attacks with limited or without prior knowledge of the environment and the attacker. In this work, we review the literature on RL for cyber resilience and discuss the cyber-resilient defenses against three major types of vulnerabilities, i.e., posture-related, information-related, and human-related vulnerabilities. Here we introduce moving target defense, defensive cyber deception, and assistive human security technologies as three application domains of CRMs to elaborate on their designs. The RL algorithms also have vulnerabilities themselves. We explain the major vulnerabilities of RL and present develop several attack models where the attacker target the information exchanged between the environment and the agent: the rewards, the state observations, and the action commands. We show that the attacker can trick the RL agent into learning a nefarious policy with minimum attacking effort. The paper introduces several defense methods to secure the RL-enabled systems from these attacks. However, there is still a lack of works that focuses on the defensive mechanisms for RL-enabled systems. Last but not least, we discuss the future challenges of RL for cyber security and resilience and emerging applications of RL-based CRMs.

97 MATHEMATICS AND COMPUTING↗

Network Anomaly Detection Using Federated Learning

The internet is turning out to be an integral part of every-one's lives as more and more devices are being connected to serve societal needs. Our work is motivated by two ma-jor observations. Firstly, one drawback of connecting to the network is the threat of network attacks that can compromise users' private information, leading to data loss and adversely affecting productivity. There are several traditional security mechanisms to defend against these attacks, such as firewalls, virtual private networks (VPNs), demilitarized zones (DMZs), and vulnerability scanners. One way to prevent these attacks is early detection and prevention. However, these kinds of architecture do not scale very well because of their centralized nature. Secondly, we observe from heuristics and data set distributions that the majority of the requests made to a server are innocuous. Therefore, almost all server request data sets are highly imbalanced, weighted highly towards the harmless requests.

Marfo, William↗

LDRD23-0730: Invoking Multilayer Networks to Develop a Paradigm for Security Science—Summary Report

Current approaches to securing high consequence facilities (HCF) and critical assets are linear and static and therefore struggle to adapt to emerging threats (e.g., unmanned aerial systems) and changing environmental conditions (e.g., decreasing operational control). The pace of change in technological, organizational, societal, and political dynamics necessitates a move toward codifying underlying scientific principles to better characterize the rich interactions observed between HCF security technology, infrastructure, digital assets, and human or organizational components. The promising results of Laboratory Directed Research and Development (LDRD) 20-0373—“Developing a Resilient, Adaptive, and Systematic Paradigm for Security Analysis”—suggest that when compared to traditional security analysis, invoking multilayer network (MLN) modeling for HCF security system components captures unexpected failure cases and unanticipated interactions.

97 MATHEMATICS AND COMPUTING↗

Virtual Reality for Shoot/No-Shoot Decision Training in Law Enforcement: A Literature Review and Research Agenda

Virtual reality (VR) can materially improve “shoot / no-shoot” (SNS) training by giving officers realistic, repeatable practice making high-stakes decisions under pressure. Traditional tools—live-fire ranges and video simulators—build basics, but they cannot adapt to each officer in real time or fully mirror the complexity of the field. VR closes that gap by creating immersive scenarios that are safer, more flexible, easier to scale across units, and able to capture objective performance data. SNS decisions are not just about marksmanship; they rely on perception, judgment, memory, and the ability to hold fire when a threat is uncertain. Effective training therefore needs realism, decision complexity, and branching outcomes that reflect the true consequences of choices. These elements strengthen recognition of hostile intent while reducing false positives and building the self-control required in ambiguous situations. VR brings specific advantages: dynamic environments, full-body interaction, and the ability to measure performance with precision—enabling targeted feedback and better transfer of learning to the street. At the same time, responsible deployment must address scenario quality (credible environments and behaviors), lawful decision models, and user wellbeing (appropriate stress levels, comfort, and safety). Sandia’s VIPER Lab is positioned to lead this work. The team combines human-performance science, AI/ML, and VR/AR development with a deep equipment bench (e.g., omnidirectional treadmill, eye-tracking, haptics, multiple HMDs). This ecosystem supports building and validating next-generation SNS training that is immersive, measurable, and trustworthy. Bottom line: Investment in VR-enabled SNS training that blends evidence-based design with careful validation and legal safeguards is expected to pay off in safer, more consistent decision-making and improved community trust, delivered through training that is practical to deploy at scale.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

Satellite Enveloped with STITCHED Engineering Sensors for Detection of Approaching Objects

Today as well as tomorrows spaceborne assets impact almost all areas of national and nuclear security. Spaceborne assets can not only collect and disseminate valuable data, well beyond just the visual, but also track terrestrial-based mobile assets in real-time, and active spaceborne platforms potentially pose serious risk to vulnerable earth-based systems and infrastructures. The capability to defend national spaceborne assets from attack/interference is critical for security interests. This effort supports this mission through the cost-effective preeminent detection of approaching threats to our nation’s vital resources, in order to help secure and trust these high-value assets against the threats of tomorrow. This project develops novel fabrication techniques for conformal, low-profile and lightweight leakywave antenna (LWA) detection/imaging systems, which fuses technical embroidery (TE) and laser ablation (LA) processes with LWA design. Technical embroidery is an emerging field in additive textile manufacturing where flexible materials and functionalized fabrics are created for a wide variety of uses and purposes, while laser ablation is the process of removing material from a solid surface by irradiating it with a laser beam. Here, thin, conformal antenna designs are designed, modeled and fabricated using both TE and LA, to create lightweight, flexible and conformal object detection and imaging radars. This novel development ensures our nation’s ability to field advanced lightweight and conformal technologies to protect spaceborne assets.

42 ENGINEERING↗

Aviation security screening optimizer for risk and throughput (ASSORT)

The increasing number of air travelers each year presents a challenge as many airports are near their capacity in terms of resources and space for passenger screening. Fortunately, advancements in technologies like next-generation millimeter wave scanning offer solutions to ease this strain. The focus remains on managing risk while enhancing the passenger experience for the traveling public. The risk model presented in this paper known as the Aviation Security Screening Optimizer for Risk and Throughput (ASSORT) is designed to assess risk-based approaches for passenger screening and checkpoint operations. Additionally, ASSORT is exploring various traveler categories — general, trusted, and trusted-plus — along with different checkpoint screening Concept of Operations tailored to each traveler type. For instance, travelers with a higher trust level may experience fewer screening technologies, resulting in quicker processing times at the checkpoint. The output of ASSORT provides a risk score for predefined threat scenarios, as well as the overall risk to the checkpoint, aircraft, and airport by traveler type. In conclusion, benefits of using this tool include assessing the trade-offs between the overall risk associated with checkpoints and the throughput rate of passengers screened. We show for example the impact that different passenger volumes at the checkpoint can have on risk.

99 GENERAL AND MISCELLANEOUS↗

Developing a Disaster-Ready Power Grid Agent Through Geophysically-Informed Fault Event Scenarios

Management of the nation’s power grid over the coming decades will need to factor multiple climate-driven threats to the power system that can be stressful or even detrimental to its operations. During disasters, grid operators suffer from cognitive overload where the electric grid is severely impacted by the weather, yet grid operators have limited awareness of these factors. Meanwhile, the electric grid is facing an explosion of data coming from a variety of sources which can enable the operator to evaluate the risks and develop mitigation strategies against hazardous events. In this work, we processed heterogeneous environmental and power grid data to learn and model grid behavior caused by extreme weather events. In this study, we focused on two weather-driven hazards, hurricanes and wildfires, which were analysed for the electric grid of Texas. We the used this data to train a Reinforcement Learning (RL) agent by analysing and predicting future behaviour of the grid during those hazard events. All these parts are incorporated in one framework to have a geophysically informed power simulators that can be used to train RL agents.

electic grid, reinforcement learning, climate adap↗

National Virtual Biotechnology Laboratory: Report on Rapid R&D Solutions to the COVID-19 Crisis

With funding from the CARES Act, the U.S Department of Energy (DOE) established the National Virtual Biotechnology Laboratory (NVBL) in March 2020 to address key challenges associated with the COVID-19 crisis. NVBL brought together the broad scientific and technical expertise and resources of DOE’s 17 national laboratories to help tackle medical supply short ages, discover potential drugs to fight the virus, develop and validate COVID-19 testing methods, model disease spread and impact across the nation, and understand virus transport in buildings and the environment. National laboratory resources leveraged for this effort include a suite of world-leading user facilities broadly available to the research community, such as light and neutron sources, nanoscale science research centers, sequencing and biocharacterization facilities, and high-performance computing facilities. Within months, NVBL teams produced innovations in materials and advanced manufacturing that mitigated shortages in test kits and personal protective equipment (PPE), creating nearly 1,000 new jobs. They used DOE’s high-performance computers and light and neutron sources to identify promising candidates for antibodies and antivirals that universities and drug companies are now evaluating. NVBL researchers also developed new diagnostic targets and sample collection approaches, and supported U.S. Food and Drug Administration (FDA), Centers for Disease Control and Prevention (CDC), and U.S. Department of Defense (DoD) efforts to establish national guidelines used in administering millions of tests. Researchers used artificial intelligence and high-performance computing to produce near-real-time data analysis to forecast disease transmission, stress on public health infrastructure, and economic impact, which supported decision-makers at the local, state, and national levels. NVBL teams also studied how to control indoor virus movement to minimize uptake and protect human health. NVBL’s accomplishments demonstrate not only the powerful resource represented by DOE’s national laboratories working together to meet national needs, but also the effectiveness of the integrated NVBL framework for rapidly responding to emergencies with research and development (R&D) solutions. As the fight against COVID continues, sustained efforts are needed to confront this pandemic as well as future threats. Examples include: 1) Establishing “supply chains on demand” to meet emergency production needs by leveraging the materials and manufacturing expertise of DOE national laboratories and developing advances in electronics, sensing, robotics, and automation capabilities; 2) Improving the speed and robustness of drug discovery by integrating experimental platforms with DOE’s computational and experimental user facilities, which provide unique resources to support the discovery of high-potential therapeutic agents; 3) Protecting public, environmental, and animal health by developing new testing protocols and instrumentation adaptable to diverse sample types (both physiological and environmental) to quickly detect a wide range of pathogens and monitor other biorisks; 4) Supporting near-real-time data needs of decision-makers at the local, regional, state, and national levels by advancing data curation, analysis, and modeling using artificial intelligence and new data science tools for managing and evaluating large diverse datasets; 5) Harnessing DOE’s expertise in environmental modeling to design rooms and air handling for offices, classrooms, restaurants, and other structures to minimize biorisk transmissions. Going forward, NVBL is poised to apply the unique capabilities and expertise of the national laboratory complex to future national and international emergencies, both natural and engineered. Through this framework, the Office of Science will continue to be an integral component of agency wide efforts to prepare for and respond to biorisks and other crises.

42 ENGINEERING↗

U.S. Domestic Pebble Bed Reactor: Security-by-Design

U.S. nuclear power facilities face increasing challenges in meeting dynamic security requirements caused by evolving and expanding threats while keeping cost reasonable to make nuclear energy competitive. The past approach has often included implementing security features after a facility has been designed and without attention to optimization, which can lead to cost overruns. Incorporating security in the design process can provide robust, cost effective, and sufficient physical protection systems. The purpose of this work is both to develop a framework for the integration of security into the design phase of High Temperature Gas Reactors (HTGRs) that utilize pebble-based fuels and increase the use of modeling and simulation tools to optimize the design of physical protection systems. Specifically, this effort focuses on integrating security into the design phase of a model HTGR that meets current Nuclear Regulatory Commission (NRC) physical protection requirements and providing advanced solutions to improve physical protection and decrease costs. A suite of tools, including SCRIBE3D©, PATHTRACE© and Blender© were used to model a hypothetical, generic domestic HTGR facility. Physical protection elements such as sensors, cameras, barriers, and guard forces were added to the model based on best practices for physical protection systems. Multiple outsider sabotage scenarios were examined with four-to eight adversaries to determine security metrics. The results of this work will influence physical protection system designs and facility designs for U.S. domestic HTGRs. This work will also demonstrate how a series of experimental and modeling capabilities across the Department of Energy (DOE) Complex can impact the design of and complete Safeguards and Security by Design (SSBD) for SMRs. The conclusions and recommendations in this document may be applicable to all SMR designs.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗

HIDES: Hybrid Intrusion Detector for Energy Systems

The establishment of a resilient electric grid accompanied by a secure communications network is an ongoing battle as advanced persistent threats continue to exploit existing vulnerabilities in legacy supervisory control and data acquisition system (SCADA) infrastructure. Traditional intrusion detection systems (IDSs) lack consistent performance because of the continuously evolving attack surface of SCADA systems. These shortcomings can be overcome by integrating logical system behavior, protocol-specific knowledge, and data-based learning to develop a comprehensive IDS solution. In this paper, we present a Hybrid Intrusion Detector for Energy Systems by integrating a network-based IDS, state-of-the-art machine learning-based IDS, and model-based IDS to detect unknown and stealthy cyberattacks targeting the SCADA networks. The proposed IDS uses synchrophasor measurements and cyber logs to learn patterns of different scenarios based on spatiotemporal behaviors of power systems. As a proof of concept, we implement and validate the proposed IDS by leveraging resources available at the National Renewable Energy Laboratory's Energy Systems Integration Facility test bed. Experimental results show promising performance in detecting cyberattacks while providing realtime visualization of power system measurements and cyber logs.

machine-learning intrusion detection system↗