Search NASA⌕ Search

SEARCH · Search NASA

Results for “Cyber Analytics”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2
All sourcesNASA NTRSDOE OSTI
DOE OSTI2024

Retrieval Augmented Generation for Robust Cyber Defense

In cybersecurity, the ability to efficiently analyze and respond to vulnerabilities, weaknesses, attack patterns, and threat tactics is critical for effective defense strategies. With the increasing complexity and volume of cybersecurity data, traditional methods of querying and retrieving information are often inadequate. To address this challenge, we implemented Retrieval-Augmented Generation (RAG) systems—CyRAG and GraphCyRAG—that integrate large language models (LLMs) with both structured data from relational databases and knowledge graphs such as Neo4j. CyRAG is designed to handle structured data, focusing on CVE (Common Vulnerabilities and Exposures) and CWE (Common Weakness Enumeration) entities to generate accurate and context-rich responses. In contrast, GraphCyRAG leverages Neo4j knowledge graphs to retrieve interconnected information from CVE, CWE, CAPEC (Common Attack Pattern Enumeration and Classification), and ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) datasets. By utilizing Neo4j’s graph-based framework, GraphCyRAG enables deeper traversal of relationships between vulnerabilities and attack patterns, providing cybersecurity analysts with more comprehensive insights into potential attack vectors and mitigation strategies. Our preliminary results demonstrate that integrating knowledge graphs with RAG significantly enhances both the accuracy and depth of threat analysis, allowing for the retrieval of dynamic, real-time data and the generation of contextually aware responses. This approach helps analysts uncover hidden relationships between cyber entities, predict exploit paths, and prioritize mitigation efforts effectively. The integration of RAG with cybersecurity knowledge graphs represents a significant advancement in cybersecurity threat intelligence, enabling more informed decision-making and stronger defense strategies.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2021

Cyber-Physical System Implementation for Manufacturing With Analytics in the Cloud Layer

Effective and efficient modern manufacturing operations require the acceptance and incorporation of the fourth industrial revolution, also known as Industry 4.0. Traditional shop floors are evolving their production into smart factories. To continue this trend, a specific architecture for the cyber-physical system is required, as well as a systematic approach to automate the application of algorithms and transform the acquired data into useful information. This work makes use of an approach that distinguishes three layers that are part of the existing Industry 4.0 paradigm: edge, fog, and cloud. Each of the layers performs computational operations, transforming the data produced in the smart factory into useful information. Trained or untrained methods for data analytics can be incorporated into the architecture. A case study is presented in which a real-time statistical control process algorithm based on control charts was implemented. The algorithm automatically detects changes in the material being processed in a computerized numerical control (CNC) machine. The algorithm implemented in the proposed architecture yielded short response times. The performance was effective since it automatically adapted to the machining of aluminum and then detected when the material was switched to steel. The data were backed up in a database that would allow traceability to the line of g-code that performed the machining.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

Deep Cyber-Physical Situational Awareness for Energy Systems: A Secure Foundation for Next-Generation Energy Management

This document provides the final report for the CYPRES project. The purpose is (1) to highlight and summarize its major accomplishments and (2) to provide guidance on how its outcomes have informed and can inform important additional research and technology transfer. The goal of CYPRES was the research, development, and demonstration of a security-oriented next generation cyber-physical EMS for electric power systems that detects malicious and abnormal events through the fusion of cyber and physical data. To achieve this, the CYPRES project team researched, developed, and built a prototype of the solution, referred to as the CYPRES EMS. The CYPRES EMS is a proof-of-concept cyber-physical platform that demonstrates the management of the energy system, communications, security, and cyber-physical grid modeling and analytics. As part of the capabilities of the CYPRES EMS, the team designed and developed a suite of power system applications for monitoring, risk analyses, detection, and control that are inherently cyberaware. At its core, the project aimed to research, develop, and demonstrate a security-oriented next-generation cyber-physical Energy Management System (EMS) capable of detecting malicious and abnormal events through the innovative fusion of cyber and physical data. This approach represents a fundamental shift from traditional EMS, reimagining how critical infrastructure can be protected through unified cyber-aware and physics-aware secure data flow pipelines. The project’s cornerstone deliverable, the CYPRES EMS, serves as a proof-of-concept cyber-physical platform that revolutionizes the management of energy systems, communications, security, and cyber-physical grid modeling and analytics. This prototype implements a comprehensive suite of power system applications for monitoring, risk analyses, detection, and control, all designed with inherent cyber awareness. The system’s architecture extends from end-devices in the field through to control center applications, establishing a secure and resilient control framework that addresses the challenges posed by diverse devices of unknown trustworthiness connecting to modern power systems. Through this innovative approach to deep cyber-physical situational awareness, the CYPRES project not only advances the state-of-the-art in energy infrastructure protection but also establishes a new paradigm for how EMS can be designed, deployed, and operated in an increasingly complex threat landscape. The findings and developments from this project provide crucial insights for stakeholders across the energy sector, offering a blueprint for enhancing the reliability and resilience of our nation’s critical energy infrastructure in the face of evolving cyber threats.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2024

Sovereign Credit Rating Processes Adapted to Critical Infrastructure Cyber Risk Assessment

United States critical infrastructure entities are increasingly targeted by motivated and capable threat actors and must be prepared to assess and treat a diverse range of cyber risks. Consequently, this necessitates some form of analytical process to evaluate risks and inform cyber security investment decisions. A potential solution for structuring cyber risk evaluation exists within the field of sovereign credit ratings – where agencies employ mature approaches that integrate quantitative and qualitative data to produce a singular value of assessment. Adapting such approaches, we present a novel criterion and methodology for measuring and communicating the likelihood element of cyber risk. The methodology is composed of three sequential phases: a quantitative baseline organized by distinct capability frames, a bounded qualitative adjustment per frame, and a greater-bounded qualitative adjustment spanning the entire process. The process culminates in publication of a cyber capability rating that communicates a critical infrastructure entity’s ability and willingness to mitigate discontinuous function due to cyberattack.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Malicious Cyber Activity Detection using Zigzag Persistence

In this study we synthesize zigzag persistence from topological data analysis with autoencoder-based approaches to detect malicious cyber activity, and derive analytic insights. Cybersecurity aims to safeguard computers, networks, and servers from various forms of malicious attacks, including network damage, data theft, and activity monitoring. We focus on the cybersecurity domain and investigate the detection of malicious activity using log data. We consider the dynamics of the log data and explore the changing topology of a hypergraph representation of this data to gain insights into the underlying activity. These hypergraphs capture complex interactions between processes, together with their temporal information. To study the changing topology we use zigzag persistence, which captures how topological features persist at multiple dimensions over time. We observe that this detects malicious activity in a cyber data set. To automate this detection we implement an autoencoder trained on a vectorization of the resulting zigzag persistence barcodes. Our experimental results demonstrate the effectiveness of the autoencoder in detecting malicious activity. Overall, this study highlights the potential of zigzag persistence and its combination with temporal hypergraphs for analyzing cybersecurity log data and detecting malicious behavior.

hypergraphs, temporal hypergraph, topological data↗
DOE OSTI2024

A graph embedding‐based approach for automatic cyber‐physical power system risk assessment to prevent and mitigate threats at scale

Abstract Power systems are facing an increasing number of cyber incidents, potentially leading to damaging consequences to both physical and cyber aspects. However, the development of analytical methods for the study of large‐scale power infrastructures as cyber‐physical systems is still in its early stages. Drawing inspiration from machine‐learning techniques, the authors introduce a method inspired by the principles of graph embedding that is tailored for quantitative risk assessment and the exploration of possible mitigation strategies of large‐scale cyber‐physical power systems. The primary advantage of the graph embedding approach lies in its ability to generate numerous random walks on a graph, simulating potential access paths. Meanwhile, it enables capturing high‐dimensional structures in low‐dimensional spaces, facilitating advanced machine‐learning applications, and ensuring scalability and adaptability for comprehensive network analysis. By employing this graph embedding‐based approach, the authors present a structured and methodical framework for risk assessment in cyber‐physical systems. The proposed graph embedding‐based risk analysis framework aims to provide a more insightful perspective on cyber‐physical risk assessment and situation awareness for power systems. To validate and demonstrate its applicability, the method has been tested on two cyber‐physical power system models: the Western System Coordinating Council (WSCC) 9‐Bus System and the Illinois 200‐Bus System , thereby showing its advantages in enhancing the accuracy of risk analysis and comprehensiveness of situational awareness.

Sun, Shining↗
DOE OSTI2019

A Framework for Quantifying Energy and Productivity Benefits of Smart Manufacturing Technologies

The transformative possibilities of smart manufacturing, which is defined by digitization, enhanced connectivity, advanced analytics, and integrated cyber-physical systems in manufacturing processes and systems, have been extensively discussed in the literature. Potential benefits underscored include cost reduction, production flexibility, shorter product times-to-market, energy efficiency, environmental impact reduction, and increased productivity. Scant attention has been given to formal methods for quantifying and analyzing energy productivity to aid a broad range of manufacturing industries in evaluating the merits of adoption. Here we present a strategic analysis framework to estimate cost-effective improvements in energy efficiency and productivity that may be realized through smart manufacturing. The framework uses the cost of conserving energy (CCE) as a complementary measure to determine the feasibility of a set of smart manufacturing interventions in the context of a specific factory, firm, or entire industry. Guided by a function-driven approach based on key performance indicators, the CCE measure accounts for system-wide changes in direct and indirect costs and total energy use relative to the same manufacturing system without smart manufacturing interventions. These changes include cost of cyber-physical systems, which include components such as sensors, controllers, smart equipment, and information and communication technology (ICT) equipment. Additionally, cost and savings are accounted from changes in primary and intermediate inputs, production time, off-spec production, and waste. Energy calculations include upstream energy use of the cyber-physical systems. For complex processes with significant circularity and/or feedbacks, we propose the use of input-output models to characterize elements of the CCE. The framework is discussed in the context of recent efforts in craft breweries to use smart manufacturing for reducing energy intensity and increasing product yield.

Supekar, Sarang D.↗
DOE OSTI2019

Fused Sensor Analysis and Advanced Control of Industrial Field Devices for Security: Cymbiote Multi-Source Sensor Fusion Platform

Embedded field devices that sense and control physical processes in critical infrastructure are soft targets for cyber-attack because they lack the fundamental features for existing cyber security monitoring and control. In this paper we present a new platform to collect and fuse data across multiple cyber and physical streams from these field devices to enable the host based attack detection and security control capabilities that have become common within IT environments. Experiments of different attack behaviors are discussed and initial machine learning detection approach analysis is presented.

Data fusion, Fied Control Device, Cyber Security, ↗
DOE OSTI2017

Toward a Visualization-Supported Workflow for Cyber Alert Management using Threat Models and Human-Centered Design

Cyber network analysts follow complex processes in their investigations of potential threats to their network. Much research is dedicated to providing automated tool support in the effort to make their tasks more efficient, accurate, and timely. This tool support comes in a variety of implementations from machine learning algorithms that monitor streams of data to visual analytic environments for exploring rich and noisy data sets. Cyber analysts, however, often speak of a need for tools which help them merge the data they already have and help them establish appropriate baselines against which to compare potential anomalies. Furthermore, existing threat models that cyber analysts regularly use to structure their investigation are not often leveraged in support tools. We report on our work with cyber analysts to understand they analytic process and how one such model, the MITRE ATT&CK Matrix [32], is used to structure their analytic thinking. We present our efforts to map specific data needed by analysts into the threat model to inform our eventual visualization designs. We examine data mapping for gaps where the threat model is under-supported by either data or tools. We discuss these gaps as potential design spaces for future research efforts. We also discuss the design of a prototype tool that combines machine-learning and visualization components to support cyber analysts working with this threat model.

Cyber Security↗
DOE OSTI2014

Meeting report: Ocean ‘omics science, technology and cyberinfrastructure: current challenges and future requirements (August 20-23, 2013)

The National Science Foundation’s EarthCube End User Workshop was held at USC Wrigley Marine Science Center on Catalina Island, California in August 2013. The workshop was designed to explore and characterize the needs and tools available to the community that is focusing on microbial and physical oceanography research with a particular emphasis on ‘omic research. The assembled researchers outlined the existing concerns regarding the vast data resources that are being generated, and how we will deal with these resources as their volume and diversity increases. Particular attention was focused on the tools for handling and analyzing the existing data, on the need for the construction and curation of diverse federated databases, as well as development of shared, interoperable, “big-data capable” analytical tools. The key outputs from this workshop include (i) critical scientific challenges and cyber infrastructure constraints, (ii) the current and future ocean ‘omics science grand challenges and questions, and (iii) data management, analytical and associated and cyber-infrastructure capabilities required to meet critical current and future scientific challenges. The main thrust of the meeting and the outcome of this report is a definition of the ‘omics tools, technologies and infrastructures that facilitate continued advance in ocean science biology, marine biogeochemistry, and biological oceanography.

59 BASIC BIOLOGICAL SCIENCES↗
DOE OSTI2016

A Novel Centrality Measure for Network-wide Cyber Vulnerability Assessment

In this work we propose a novel formulation that models the attack and compromise on a cyber network as a combination of two parts - direct compromise of a host and the compromise occurring through the spread of the attack on the network from a compromised host. The model parameters for the nodes are a concise representation of the host profiles that can include the risky behaviors of the associated human users while the model parameters for the edges are based on the existence of vulnerabilities between each pair of connected hosts. The edge models relate to the summary representations of the corresponding attack-graphs. This results in a formulation based on Random Walk with Restart (RWR) and the resulting centrality metric can be solved for in an efficient manner through the use of sparse linear solvers. Thus the formulation goes beyond mere topological considerations in centrality computations by summarizing the host profiles and the attack graphs into the model parameters. The computational efficiency of the method also allows us to also quantify the uncertainty in the centrality measure through Monte Carlo analysis.

Centrality↗
DOE OSTI2021

ML Clustering to Identify Natural Gas Pipeline Infrastructure Vulnerabilities

The network of more than 2.5 million miles of natural gas pipelines the U.S. are exposed to a range of vulnerabilities, ranging from extreme weather, to human behavior, and increasingly, to cyber threats. Advanced, data-driven analytics, including the use of machine learning and artificial intelligence, afford an opportunity to identify potential vulnerabilities, better understand risks, and help mitigate vulnerabilities in the network. At NETL, machine learning is being used to explore pipeline vulnerabilities and identify significant clusters of failure events, including failures due to weather, human behavior, and materials. These findings are being used to support the development of new technologies, including sensors, but can also be used to evaluate and inform mitigation strategies to reduce risks and vulnerabilities throughout the network.

Bauer, Jennifer↗
DOE OSTI2019

The Value of Resilience for Distributed Energy Resources: An Overview of Current Analytical Practices

Recent extreme weather events, natural disasters, and cyber incursions have brought the vulnerability of the electric system into sharp focus. These events have demonstrated that planning for long-duration power interruptions caused by high-impact, low-probability events will require new approaches to power system resilience above and beyond previous hardening efforts. At the same time, the rapid growth and declining costs of distributed energy resources (DERs) such as microgrids, solar photovoltaics, and batteries have introduced new technology options for energy resilience. Consequently, state policymakers across the country have established electricity resilience policies and programs, with several states focusing specifically on resilient DERs as part of clean energy programs and grid modernization efforts. Although it is clear that DERs offer resilience benefits, it is unclear how to determine the value of those benefits. Identifying appropriate methodologies to calculate the value of resilience will be an important step toward ensuring that resilient DERs are considered alongside alternatives and integrated into future energy infrastructure and investment planning efforts. This paper reviews current practices for calculating the value of resilience with a focus on valuing resilient DERs installed within the distribution system. It examines both regulatory decision-making and non-regulatory cost-benefit analyses in order to determine if, and how, a value of resilience was calculated and applied. The paper is designed to address questions that utility regulators have identified as being of interest: (1) Have regulators identified and utilized a value of resilience in regulatory decisions related to resilient DERs? (2) Is the value of resilience being used to analyze resilient DERs in venues other than regulatory proceedings? (3) What are the different methods to value energy resilience? (4) What are the pros and cons of different methods used to value resilience? (5) Can regulators adopt or improve value of resilience methods to support their decisions?

14 SOLAR ENERGY↗
NASA NTRS2013

Hadoop for High-Performance Climate Analytics: Use Cases and Lessons Learned

Scientific data services are a critical aspect of the NASA Center for Climate Simulations mission (NCCS). Hadoop, via MapReduce, provides an approach to high-performance analytics that is proving to be useful to data intensive problems in climate research. It offers an analysis paradigm that uses clusters of computers and combines distributed storage of large data sets with parallel computation. The NCCS is particularly interested in the potential of Hadoop to speed up basic operations common to a wide range of analyses. In order to evaluate this potential, we prototyped a series of canonical MapReduce operations over a test suite of observational and climate simulation datasets. The initial focus was on averaging operations over arbitrary spatial and temporal extents within Modern Era Retrospective- Analysis for Research and Applications (MERRA) data. After preliminary results suggested that this approach improves efficiencies within data intensive analytic workflows, we invested in building a cyber infrastructure resource for developing a new generation of climate data analysis capabilities using Hadoop. This resource is focused on reducing the time spent in the preparation of reanalysis data used in data-model inter-comparison, a long sought goal of the climate community. This paper summarizes the related use cases and lessons learned.

analytics↗
DOE OSTI2017

Big Data, Big Solutions

Data—lots of data—generated in seconds and piling up on the internet, streaming and stored in countless databases. Big data is important for commerce, society and our nation’s security. Yet the volume, velocity, variety and veracity of data is simply too great for any single analyst to make sense of alone. It requires advanced, data-intensive computing. Simply put, data-intensive computing is the use of sophisticated computers to sort through mounds of information and present analysts with solutions in the form of graphics, scenarios, formulas, new hypotheses and more. This scientific capability is foundational to PNNL’s energy, environment and security missions. Senior Scientist and Division Director Bill Pike and his team are developing analytic tools that are used to solve important national challenges, including cyber systems defense, power grid control systems, intelligence analysis, climate change and scientific exploration.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2014

An integrated security framework for GOSS power grid analytics platform

In power grid operations, security is an essential component for any middleware platform. Security protects data against unwanted access as well as cyber attacks. GridOpticsTM Software System (GOSS) is an open source power grid analytics platform that facilitates ease of access between applications and data sources and promotes development of advanced analytical applications. GOSS contains an API that abstracts many of the difficulties in connecting to various heterogeneous data sources. A number of applications and data sources have already been implemented to demonstrate functionality and ease of use. A security framework has been implemented which leverages widely accepted, robust JavaTM security tools in a way such that they can be interchanged as needed. This framework supports the complex fine-grained, access control rules identified for the diverse data sources already in GOSS. Performance and reliability are also important considerations in any power grid architecture. An evaluation is done to determine the overhead cost caused by security within GOSS and ensure minimal impact to performance.

Gibson, Tara D.↗
DOE OSTI2011

Hatrick: A System for Real-time Threat Detection in Cyber Physical Systems

Complexity of cyber attacks has grown rapidly over the last few decades. Novel advance techniques are needed in order to counter these attacks. Detecting some of these complex cyber attacks can be reduced to detecting patterns and dynamics in computer network traffic. These patterns can be molded as directed graphs based on their propagation through the cyber physical systems. This work in progress report presents an implemented system, Hatrick, which enable scalable, low latency dynamic graph analytics on clouds and commodity clusters. Hatrick will enable continuous monitoring of cyber physical systems to detect attack patterns in real-time.

97 MATHEMATICS AND COMPUTING↗