Search NASA⌕ Search

SEARCH · Search NASA

Results for “Detection and Defense”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2
All sourcesNASA NTRSDOE OSTI
DOE OSTI2021

Synchrophasor spoofing detection and remediation for wide-area damping control

Evolving cyber-attack threats put at risk automatic closed-loop systems to be incorporated in the smart grid. Wide-area control systems are particularly vulnerable to signal spoofing attacks due to sensor remoteness and dependence on satellite communication for time synchronization. A successful cyber-attack on a wide-area controller has the potential to reduce relative stability of the power system or worse, destabilize it. As such, detection algorithms must be deployed as defense against such attacks with the ability to autonomously correct for detected tampering or misoperation. The Spoof Catch and Restore Routine (SCR 2 ), a combination of three real-time spoof detectors, each requiring limited information about the plant, is reported here. Nonlinear simulations of a compromised wide-area control system deployed in the Western Interconnection show the effectiveness of SCR 2 in detecting both delay-type and counterfeit-type spoofing attacks on wide-area sensors.

42 ENGINEERING↗
DOE OSTI2023

Increased Interpretability for Model-Driven Deception: MARS LDRD Project

Machine learning has been proposed as a solution to several cybersecurity solutions and one of the most promising applications is for digital twins for intrusion detection and driving deceptive defense. However, machine learning techniques often result in a black-box function that is difficult for end users to interpret which for deception limits their ability to effectively define decoys. In this report, an approach to validate the equations learned are accurate is provided and demonstrated. Following, begins the process of addressing this issue for a model-driven deception technology that produces equations representing the physical process controlled by operation technology devices. This research was performed by applying subject matter expert context to machine learned models.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Enabling Cybersecurity, Situational Awareness and Resilience in Distribution Grids with High Penetration of Photovoltaics (CARE-PV) (Final Report)

Since legacy distribution systems have very limited visibility beyond the substation, high penetration of PV at the grid edge presents some unique operational challenges. One approach to address these challenges is to use information from advanced metering infrastructure (AMI) and µPMUs. However, exploiting this information is impacted by a number of factors, including multi-timescale measurements, volume of data generated, communication network impairments (e.g., information loss and latency) and susceptibility to cyber-attacks. Therefore, one of the critical tasks involved in the management of a distribution grid is to develop complete situational awareness by integrating cyber-security mechanisms with state estimation strategies and leveraging this situational awareness to assure energy services at strategic locations while exploiting AMI/PV inverter/ µPMU data. This CARE-PV project addresses the fundamental challenges in situational awareness and resilience to cyber and physical vectors by exploiting the synergy between innovative modeling, estimation, data analytics, testing and validation using smart PV inverters designed at K-State and facilities at NREL. Specifically, the project involved the development, testing and validation of the following novel enabling technologies: (Thrust 1) Resilience to cyber vectors that impact data integrity was addressed via a two-level defense strategy that combines cyber intrusion detection using self-learning, cooperative smart PV inverters, and a novel moving target defense framework to combat data integrity attacks. (Thrust 2) Resilience to cyber-physical vectors that impact situational awareness by limiting data availability was addressed via novel centralized and decentralized, sparsity-based static and dynamic state estimation approaches that enhance observability even when the underlying system is unobservable. (Thrust 3) Leveraging a unique probabilistic sensitivity analysis approach accompanied by one-of-a-kind dominant influencer set computation, the vulnerability of critical infrastructure at strategic locations was evaluated so that proactive PV-based control strategies can be used to support operations under normal/outage scenarios. These CARE-PV project innovations were demonstrated on both small-scale IEEE and larger utility-scale testbeds (Thrust 4). Feedback from Industry Advisory Board members was used to formulate a commercialization pathway for a subset of CARE-PV technologies. These CARE-PV technologies will ultimately lead to reliable and secure, large-scale integration of renewable energy and mitigate the risk of energy disruption resulting from cyber incidents and other emerging threats within the energy environment.

14 SOLAR ENERGY↗
DOE OSTI2021

Data trustworthiness signatures for nuclear reactor dynamics simulation

With the increased reliance on digitization in industrial control systems, the need for effective monitoring techniques has risen dramatically. Specifically, there is now a growing concern about the so-called false data injection (FDI) attacks. These attacks aim to alter the raw sensors’ data to cause malicious outcomes. Any serious FDI algorithm is based on an intimate knowledge of the system and its associated physics models, which renders conventional outlier/anomaly detection techniques almost obsolete in the face of such attacks. Thus, a critical need has emerged to develop a new class of defense methods that are capable of detecting FDI attacks under the assumption that the attacker has a strong familiarity with the system and its physics modeling. This class of defense methods are denoted by model-based defenses which are premised on the assumption that the attacker, while having a good understanding of the system, does not have full privileged access to all proprietary data and historical records of operation. However, (s)he is assumed to be capable of learning system behavior using self-learning techniques during an initial lie-in-wait period. To defend against this scenario, we propose a new model-based randomized window algorithm that searches time-series data for signatures that can serve as classifiers between normal and FDI scenarios. The classifiers are based on the correlations between the dominant degrees of freedom (DOFs) and the less-dominant DOFs (expected to be very sensitive to the system details that are unknown to the attacker). For demonstration, RELAP5 models are employed to calculate representative nuclear reactor behavior during a number of transient scenarios. Finally, falsified data are injected into the RELAP5-simulated behavior, and the proposed signature-identification algorithm is employed to detect the injected data.

73 NUCLEAR PHYSICS AND RADIATION PHYSICS↗
DOE OSTI2021

Frequency Injection Based HVDC Attack-Defense Control Via Squeeze-Excitation Double CNN

Due to the independent controllability and fast power regulation capability, the High Voltage Direct Current (HVDC) system could be a prospective technology to provide multiple ancillary services to the system besides conventional bulk power transmission. However, with the increase of False Data Injection Attacks (FDIAs) on PMU data, the HVDC system could have the wrong response once the collected data that the HVDC system relied on is attacked, thus threatening the system operating security. How to ensure the security of the PMU-based HVDC ancillary service control become an urgent issue. To mitigate the risk, this paper proposed an HVDC attack-defense control based on the FDIAs detection method. Firstly, the Squeeze-Excitation based Double Convolutional Neural Networks (SE-DCNN) is proposed to realize fast identification of the attacking frequency type based on the time and frequency domain signals. Furthermore, the duration time of FDIAs is detected by the local outlier factor. Then, utilizing the results from SE-DCNN, HVDC ancillary service control framework is reorganized and an HVDC attack defense control is proposed for suppressing the potential influence of various types of FDIAs on the HVDC system ancillary service. Different experiments results demonstrate that the proposed method has the ability to significantly mitigate the frequency deviation and oscillation under the FDIA.

42 ENGINEERING↗
DOE OSTI2021

Time-frequency based cyber security defense of wide-area control system for fast frequency reserve

Global power systems are transiting from conventional fossil fuel energy to renewable energies due to their environmental benefits. The increasing penetration of renewable energies presents challenges for power system operation. The efficiency and sufficiency of responsive reserves have become increasingly important for power systems with a high proportion of renewable energies. The Fast Frequency Reserve (FFR), especially the Wide-area Monitoring System (WAMS)-based FFR, is a promising and effective solution to secure and enhance the stability of power systems. However, cyber security has become a new challenge for the WAMS-based FFR system. Cyber attacks on the FFR control system may threaten the safety of power system operation due to the rapid power controllability requirement of FFR. Therefore, to address this problem, a time-frequency based cyber security defense framework is proposed to detect the cyber spoofing of synchrophasor data in WAMS-based FFR control systems. This paper first introduces the Continuous Wavelet Transforms (CWTs) to decompose spoofing signals. Then, the Dual-frequency Scale Convolutional Neural Networks (DSCNN) is proposed to identify the time-frequency domains matrix from two frequency scales. Integrating CWTs and DSCNN, an identification framework called CWTs-DSCNN is further proposed to detect the spoofing attacks in the WAMS-based FFR system. Multiple experiments using the actual data from FNET/GridEye are performed to verify the effectiveness of the framework in securing WAMS-based FFR systems.

25 ENERGY STORAGE↗
DOE OSTI2021

Sequential Perturbation-based FDIA Detection using DERs for Unbalanced Distribution System

The power distribution system with its reliance on automated monitoring and control infrastructure makes it a complicated cyber-physical system and vulnerable to various cyber-attacks. This paper proposes a moving target defense inspired false data injection attack (FDIA) detection mechanism for an unbalanced distribution system. In the proposed grid diagnosis service framework, the distribution system operator judiciously manipulates power outputs of a subset of inverter-based distribution energy resources (DERs) to create secret low magnitude voltage perturbations which are inconsequential to the normal operation of the grid. A mixed-integer-linear-programming algorithm is developed to select the optimal set of DERs that can create a voltage perturbation signal of the required magnitude at each sensor location at a minimum cost. Then, a sequential detector is applied that detects for the FDIA as measurements are received from individual sensors. The performance of the proposed perturbation-based FDIA detection framework is demonstrated via simulation of the IEEE 123 bus test system.

Attack Detection↗
DOE OSTI2024

Safe Operations at Roadway Junctions: Intelligent Roadway Infrastructure as Functional Interlocking

Automated vehicle (AV) technology is quickly maturing, and the corresponding infrastructure systems that evaluate traffic and communicate to vehicles requires sophisticated sensing and perception technologies, referred to as intelligent roadway infrastructure (IRI), to complement emerging AV capabilities. IRI provides signals to vehicles, indicating right-of-way for vehicles and communicating to approaching AVs that no other vehicle is failing to yield. This capability, denoted as safety-affirmative signaling, provides a green light or a green arrow as appropriate and affirms through communication links to connected vehicles when it is safe to proceed. About 36% of collisions occur at intersections, with most occurring upon left turns (22.2%) or crossing over (12.6%), and only a small percentage (1.2%) while turning right at an intersection. Of all intersection crashes about half (52.5%) of those vehicles were traveling through a signalized intersection 2. Safety-affirmative signaling would guarantee safety of AV fleet vehicles, by providing the interlocking principle, a term from automated train control that only allows progression through a railway intersection after affirming no opportunity for a crash exists. IRI through safety-affirmative signaling would bring performance and safety to complex roadway intersections where AV transit fleet service is most needed, as well as safety benefits to traditional, non-automated vehicles and vulnerable road users. The implementation of IRI has functional, programmatic, and technical challenges. Research work performed at the National Renewable Energy Laboratory (NREL) in an integrative approach encapsulating these themes, and termed infrastructure perception and control (IPC) is motivated by improved performance (travel time), improved safety (reduced collisions), and improved energy efficiency (less fuel burned and minimized production of greenhouse gases). IPC is intended not only for roadway and intersection applications but also in extension to inform complementary buildings and grid systems to enable better co-management, as vehicles and their charging needs become increasingly integrated into the built environment. The NREL IPC project presents an open-source framework, architecture, and supporting technology to implement IRI, addressing critical issues such as fusion of data, reliability, standardization of data interfaces, and confidence of detection. The framework is informed by previous experience in U.S. Department of Defense research technology, specifically in the use of radar to detect, identify, and track aerial threats. These principles combined with multi-sensor fusion provides for a complete digital twin with known and measurable confidence and accuracy from which safety-affirmative signaling can be developed and deployed.

ADVANCED PROPULSION SYSTEMS,MATHEMATICS AND COMPUT↗
DOE OSTI2023

Proactive Intrusion Detection and Mitigation System

SAND2023-05661O The proactive intrusion detection and mitigation system (PIDMS) provides grid-edge situational awareness for cybersecurity defense by capturing real-time distributed energy resource (DER) network traffic and performance data with a novel approach that improves the detection and prevention of cyber-physical attacks. The PIDMS addresses the grid-edge security gap with real-time analysis of both network traffic and photovoltaic performance data to deliver a novel, cyber-physical intrusion detection system (IDS) approach that increases the accuracy and effectiveness of detection and mitigation. This hybrid IDS analysis enables dual monitoring that increases the workload of the adversary; both cyber and physical data would have to be simultaneously spoofed to evade detection. Furthermore, monitoring and analyzing cyber data are insufficient in some cases. For example, in an insider threat aimed at disrupting inverter grid-support functions where proper credentials and authentication are achieved, only the altered PV performance would indicate abnormal behavior. All in all, the PIDMS provides novel capabilities for: • Distributed, real-time cyber-physical detection and mitigation analysis • Cybersecurity defense for grid-edge systems • Analysis framework that can provide situational awareness across the transmission, distribution, and DER systems The PIDMS sensor is designed to collect cyber-physical data, process the data using machine-learning algorithms, detect abnormal events, and deploy mitigations. With these goals, the main functional PIDMS objectives are: • Capability to collect cyber-physical data • Onboard storage of cyber-physical data • Peer-to-peer communication • Computationally efficient machine-learning algorithms • Online cyber-physical data analysis • Alerting/visualization capabilities • Mitigation deployment capability with bump-in-the-wire (BITW) implementation Each of these functional objectives enable PIDMS to perform effective cyber-physical intrusion detection and mitigation. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.

Jones, Christian↗
DOE OSTI2022

Securing Inverter Communication: Proactive Intrusion Detection and Mitigation System to Tap, Analyze, and Act

The electric grid has undergone rapid, revolutionary changes in recent years; from the addition of advanced smart technologies to the growing penetration of distributed energy resources (DERs) to increased interconnectivity and communications. However, these added communications, access interfaces, and third-party software to enable autonomous control schemes and interconnectivity also expand the attack surface of the grid. To address the gap of DER cybersecurity and secure the grid-edge to motivate a holistic, defense-in-depth approach, a proactive intrusion detection and mitigation system (PIDMS) device was developed to secure PV smart inverter communications. The PIDMS was developed as a distributed, flexible bump-in-the-wire (BITW) solution for protecting PV smart inverter communications. Both cyber (network traffic) and physical (power system measurements) are processed using network intrusion monitoring tools and custom machinelearning algorithms for deep packet analysis and cyber-physical event correlation. The PIDMS not only detects abnormal events but also deploys mitigations to limit or eliminate system impact; the PIDMS communicates with peer PIDMSs at different locations using the MQTT protocol for increased situational awareness and alerting. The details of the PIDMS methodology and prototype development are detailed in this report as well as the evaluation results within a cyber-physical emulation environment and subsequent industry feedback.

14 SOLAR ENERGY↗
DOE OSTI2025

Secure and Resilient Operations Using Open-Source Distributed Systems Platform (OpenDSP)

The goal of this project is to identify and address cybersecurity gaps by developing a multi-layer multi-channel cyber-physical defense and survival mechanism for operating distribution networks with high penetration of solar / inverter-based resource (IBR) / distributed energy resource (DER). The proposed security enhancements are built upon the distributed framework and solution architecture for both information technology (IT) and operational technology (OT) systems. The technical solutions consist of two composite functionalities and six layers: proactive defense (vulnerability assessment, communication protection, and attack detection, as layers 1-3), and adaptive self-healing (attack-resilient control, adaptive recovery, and resilient survival, as layers 4-6). These layers, built on and extended from DHS CISA Cyber Framework, establish an integrated and robust cybersecurity framework for operating large-scale distribution networks.

14 SOLAR ENERGY↗
DOE OSTI2021

Review of internal cyber attacks in nuclear facilities and an artificial neural network model for implementing internal cyberforensics

Deployment of digital technologies within a modern shift in cyber defense systems is essential for protecting the energy production units. One of the important components of defense is cyberforensics: once an attack has been detected to locate its origin. In this paper, a review of well-known cyberattacks in nuclear facilities is provided, with the lessons learned leading to the development of a machine learning approach implementing identification of internal at- tacks in the facility's data networks. Our approach may be seen as one of the layers in a defense-in-depth strategy that identifies if the attack comes from inside, which may result in identifying faster the attacker's origin. The presented model exploits network packet examination to cast accurate predictions on detailing the origin of malicious network connections. The approach fuses multiple mathematical functions within an artificial neural network to provide a response in the form of 0/1, i. e., whether the attack is identified as internal or not. The utilization of a variety of test cases is developed to explore the relevance and validity of the predictive approach. The proposed implementation is examined with network data packet variance, and the results obtained exhibit a highly accurate detection rate.

Nuclear Science & Technology↗
DOE OSTI2026

MOD-Amp System Design Spring: Spring 2026 – Georgetown University, SYSM–5620

High-energy lasers (HELs) play an important role in both national defense and scientific research. In defense applications, HELs are used for target detection, tracking, and engagement. In research environments, they support studies of extreme physical conditions relevant to fusion energy and plasma science. These systems depend on the amplification of light through stimulated emission of radiation, allowing optical energy to be increased to the levels required for operation. This amplification occurs when light passes through an energized gain medium that receives energy from an external optical or electrical source. To achieve the desired output, laser systems often use multiple amplification stages, including high-gain preamplifiers and lower-gain power or booster amplifiers. At Lawrence Livermore National Laboratory (LLNL) and other national laboratories, many large-aperture laser amplifier systems are aging and rely on system-specific hardware, obsolete technologies, and incomplete documentation. These legacy systems create challenges for maintenance, supportability, and long-term operation. Their lack of standardization also increases the difficulty of sustaining reliable performance over time. As this infrastructure continues to age, the likelihood of unplanned downtime grows, which can negatively affect both national security missions and scientific research programs that depend on dependable HEL capabilities. The purpose of this document is to demonstrate the application of systems engineering fundamentals and design thinking through the development of a laser amplifier case study. The proposed system concept is intended as an academic exercise and not as a finalized engineering design. As a result, the development presented in this document is incomplete and may contain technical assumptions or errors that would require further investigation before any real-world implementation.

42 ENGINEERING↗
DOE OSTI2021

Radiation Detection Data Competition Report

In FY2018 through FY2020, NA-22, the Defense Nuclear Nonproliferation Research and Development Program, funded a Data Science project to develop and implement statistical methodology to effectively host data competitions with the goal of leveraging the opportunity provided by crowdsourcing. By accessing and engaging expertise from a broader research community, there is an opportunity to attract innovative solutions from a variety of different research disciplines to advance the ability to solve important non-proliferation problems. This report summarizes the key results of this project after hosting two data competitions focused on urban radiation detection. The first competition was focused on attracting participants from the U.S. national laboratories, while the second, hosted by TopCoder, was open to the broader international community and awarded prize money to the top 10 competitors. At the start of the project, there was strong interest from NA-22 to explore and develop the capability to host data competitions as a means of leveraging the broader community to solve important nuclear nonproliferation problems. Having a standard data set on which to compare different approaches based on clearly defined criteria was desirable to be able to evaluate the state of solutions for important problems. Initially, it was not clear that it would even be possible logistically and bureaucratically to host a competition with an international field of competitors and to award the prize money needed to attract solutions from top competitors. Happily, a path to host the competitions was ultimately found that allowed this powerful accelerator of improvements to be leveraged.

61 RADIATION PROTECTION AND DOSIMETRY↗
DOE OSTI2020

Detection of Head and Neck Cancer Based on Longitudinal Changes in Serum Protein Abundance

Head and Neck Squamous Cell Carcinoma (HNSCC) is significantly represented in the military population with substantial impact on military operations. Two-thirds of new HNSCC cases are first diagnosed at advanced stage III or IV with lymph node metastases. Thus, there is an urgent need of biomarkers for early detection and risk stratification. Archived serum samples from the Department of Defense Serum Repository provide a unique resource for longitudinal studies of HNSCC in the military and the identification of early detection biomarkers. Methods: We identified 175 patients diagnosed with HNSCC with 175 matched healthy controls and retrieved a total of 978 serum samples drawn at the time of diagnosis, 2 and 4 years prior to diagnosis, and 2 years after diagnosis. Following immunoaffinity depletion, serum samples were analyzed by targeted proteomics assays for multiplexed quantification of a panel of 146 candidate protein biomarkers from the curated literature. Results: We derived a 13-protein signature that distinguishes case versus controls based on longitudinal changes in serum protein concentration. The abundances of each of the 13 proteins remain constant over time in control subjects. The area under the curve for the derived random forest classifier was 0.90. Conclusions: This 13-protein classifier is highly promising for detection of HNSCC prior to overt symptoms. Impact: Use of longitudinal samples has significant potential to identify biomarkers for detection and risk stratification.

59 BASIC BIOLOGICAL SCIENCES↗
DOE OSTI2025

Detector Materials Scoping Study: Research and Development Recommendations

Radiation detection materials have a unique role in many nuclear security missions. The variety of different applications requires the use of different materials whose characteristics are determined by the specific application requirements. While baseline capabilities have been established to use radiation detection in these applications, the potential to greatly advance those capabilities still exists through the development of superior radiation detection materials and/or the development of new materials that enable new technologies to be implemented more effectively. In 2024 the Defense Nuclear Nonproliferation Research and Development (DNN R&D) Near Field Detection Portfolio charged a detector materials scoping study, composed of a group of radiation-detection materials subject matter experts, to produce a community-wide consensus view of the current state of radiation materials research and to set recommendations for expanded investment over a ten-year time frame. This scoping study sought to understand and document the landscape of how radiation detection materials are used, what characteristics drive the selection of various materials, and what developments are needed to drive the state of the art. To respond to this charge, the scoping study created three working groups, each focusing on a different topical area in radiation detection materials research - Semiconductor Materials, Inorganic Scintillators and Organic Scintillators - with the task to identify the current state of the art in materials research and to provide mission-relevant research and development recommendations. Each working group was chaired by two members of the project team with widely recognized expertise in the field. Solicitations were sent out to experts at the DOE national laboratories, industry, academia and federal government agencies to participate in these working groups. The working groups met at regular intervals throughout 2024 and early 2025, each delivering a technical roadmap designed to enable the pursuit of R&D more intensely on high-impact materials challenges and detector solutions that are deemed as the greatest strategic value to DNN R&D and its stakeholders. The roadmap is also intended to help communicate recommended programmatic priorities within DNN R&D and across the nonproliferation and research communities.

36 MATERIALS SCIENCE↗