Search NASA⌕ Search

SEARCH · Search NASA

Results for “threat awareness”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2
All sourcesNASA NTRSDOE OSTI
DOE OSTI2024

ByzSec — A Multi-layered Byzantine Resilient Architecture for Bulk Power System Protective Relays

Reliability, selectivity, and sensitivity are the fundamental attributes of any protection system, acting as the main drivers in the selection of schemes, and equipment. In high-voltage systems, microprocessor-based relays represent the industry’s preferred solution, providing engineers with a vast array of benefits. However, they remain vulnerable to cybersecurity events that may compromise their functionality. To help mitigate against potential cybersecurity risks, this paper presents a fault-tolerant, Byzantine Resilient (BR) architecture that significantly increases the cybersecurity attributes of a protection system while minimizing the amount of performance impacts and integration overheads introduced. The solution relies on an array of independent relays that utilize robust consensus methods (based on Spire [1], [2]) to ensure correct system behavior is achieved even when a relay has been compromised. Furthermore, the solution has been complemented with a custom-built Situational Awareness engine that can be used to detect and identify potential threats. The implemented solution has been developed in consultation with three hardware vendors and has been tested to comply with the performance requirements of a 345kV differential protection scheme (87T). The results indicate that the proposed architecture is a comprehensive solution that: supports the strict correctness and performance requirements of the bulk power grid while providing a cost-effective alternative that offers a seamless, long-term solution.

byzantine security, Fault Tolerant Application Sof↗
DOE OSTI2024

Retrieval Augmented Generation for Robust Cyber Defense

In cybersecurity, the ability to efficiently analyze and respond to vulnerabilities, weaknesses, attack patterns, and threat tactics is critical for effective defense strategies. With the increasing complexity and volume of cybersecurity data, traditional methods of querying and retrieving information are often inadequate. To address this challenge, we implemented Retrieval-Augmented Generation (RAG) systems—CyRAG and GraphCyRAG—that integrate large language models (LLMs) with both structured data from relational databases and knowledge graphs such as Neo4j. CyRAG is designed to handle structured data, focusing on CVE (Common Vulnerabilities and Exposures) and CWE (Common Weakness Enumeration) entities to generate accurate and context-rich responses. In contrast, GraphCyRAG leverages Neo4j knowledge graphs to retrieve interconnected information from CVE, CWE, CAPEC (Common Attack Pattern Enumeration and Classification), and ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) datasets. By utilizing Neo4j’s graph-based framework, GraphCyRAG enables deeper traversal of relationships between vulnerabilities and attack patterns, providing cybersecurity analysts with more comprehensive insights into potential attack vectors and mitigation strategies. Our preliminary results demonstrate that integrating knowledge graphs with RAG significantly enhances both the accuracy and depth of threat analysis, allowing for the retrieval of dynamic, real-time data and the generation of contextually aware responses. This approach helps analysts uncover hidden relationships between cyber entities, predict exploit paths, and prioritize mitigation efforts effectively. The integration of RAG with cybersecurity knowledge graphs represents a significant advancement in cybersecurity threat intelligence, enabling more informed decision-making and stronger defense strategies.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2020

Model-Free Data Authentication for Cyber Security in Power Systems

With the development and wide deployment of measurement equipment, data can be automatically measured and visualized for situation awareness in power systems. However, the cyber security of power systems is also threated by data spoofing attacks. This letter proposed a measurement data source authentication (MDSA) algorithm based on feature extraction techniques including ensemble empirical mode decomposition (EEMD) and fast Fourier transform (FFT), and machine learning for real-time measurement data classification. Compared with previous work, the proposed algorithm can achieve higher accuracy of MDSA using a shorter window of data from closely located synchrophasor measurement sensors.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2024

Exploring the Adoption Challenges of Post-Quantum Cryptography in EV Charging Infrastructure

The rapid evolution of electric vehicle (EV) technology and the corresponding growth of the Electric Vehicle Charging Infrastructure (EVCI) brings to light significant cybersecurity concerns, notably in the context of emerging post-quantum computing capabilities. This report, prepared by Pacific Northwest National Laboratory (PNNL) under the U.S. Department of Energy contract, delves into the challenges associated with integrating Post-Quantum Cryptography (PQC) into EVCI to safeguard against potential quantum computing threats. Post-quantum computers will eventually be able to invalidate technologies secured through public key cryptography. As part of this effort, the primary gaps and challenges in the EVCI were investigated with a focus on comparing traditional algorithms against PQC algorithms. One of the notable findings was that the P-521 algorithm was frequently surpassed in performance by PQC algorithms. This document provides a thorough examination of the hurdles the industry can expect when transitioning to PQC within the EVCI, such as interoperability concerns, the computational and memory demands of PQC algorithms, and the organizational readiness for such a transition. It emphasizes the necessity of a forward-thinking approach to cybersecurity, advocating for early and strategic engagement among EVCI stakeholders to ensure a seamless and cost-effective migration to quantum-resistant cryptographic standards. Through this report, the authors aim to catalyze awareness and action among policymakers, industry leaders, and cybersecurity professionals towards fortifying the EVCI against emerging quantum threats, thereby securing the infrastructure essential for the future of electric mobility.

33 ADVANCED PROPULSION SYSTEMS↗
DOE OSTI2023

Towards Smart Grids Enhanced Situation Awareness: A Bi-Level Quasi-Static State Estimation Model

Smart Grid situational awareness is provided by Energy Management Systems. A core process of these systems is State Estimation. The great majority of state estimators model the Smart Grid through a set of nonlinear algebraic equations, named the measurement model. Problem formulation considers the Gauss solution. Several model improvements have been presented regarding the Gauss solution, aiming between others to provide measurement noise robustness to the state estimation process. While considerable effort has been focused on such developments, state estimation is still constrained by the implicit modelling error, and thus inevitably vulnerable to cyber-threats. In this work, a state estimation bi-level formal model is presented towards Smart Grids enhanced situational awareness considering the concepts of synthetic measurements and innovation. Comparative test results with the state-of-the-art on the IEEE 14-bus system are presented highlighting improved situational awareness to bad data. Easy-to-implement model, without hard-to-derive parameters, built-on the classic weighted least squares solution, highlight potential aspects for real-life implementation.

cyber security↗
DOE OSTI2024

Severe Convective Storms in Limited Instability Organized by Pattern and Distribution

Abstract Severe convection occurring in high-shear, low-CAPE (HSLC) environments is a common cool-season threat in the southeastern United States. Previous studies of HSLC convection document the increased operational challenges that these environments present compared to their high-CAPE counterparts, corresponding to higher false-alarm ratios and lower probability of detection for severe watches and warnings. These environments can exhibit rapid destabilization in the hours prior to convection, sometimes associated with the release of potential instability. Here, we use self-organizing maps (SOMs) to objectively identify environmental patterns accompanying HSLC cool-season severe events and associate them with variations in severe weather frequency and distribution. Large-scale patterns exhibit modest variation within the HSLC subclass, featuring strong surface cyclones accompanied by vigorous upper-tropospheric troughs and northward-extending regions of instability, consistent with prior studies. In most patterns, severe weather occurs immediately ahead of a cold front. Other convective ingredients, such as lower-tropospheric vertical wind shear, near-surface equivalent potential temperature (θ e ) advection, and the release of potential instability, varied more significantly across patterns. No single variable used to train SOMs consistently demonstrated differences in the distribution of severe weather occurrence across patterns. Comparison of SOMs based on upper and lower quartiles of severe occurrence demonstrated that the release of potential instability was most consistently associated with higher-impact events in comparison to other convective ingredients. Overall, we find that previously developed HSLC composite parameters reasonably identify high-impact HSLC events. Significance Statement Even when atmospheric instability is not optimal for severe convective storms, in some situations they can still occur, presenting increased challenges to forecasters. These marginal environments may occur at night or during the cool season, when people are less attuned to severe weather threats. Here, we use a sorting algorithm to classify different weather patterns accompanying such storms, and we distinguish which specific patterns and weather system features are most strongly associated with severe storms. Our goals are to increase situational awareness for forecasters and to improve understanding of the processes leading to severe convection in marginal environments.

Meteorology & Atmospheric Sciences↗
DOE OSTI2023

A review of privacy in energy applications

As the distribution system continues to experience an increase in distributed energy resource (DER) and electric vehicle (EV) penetration, so does the need for new solutions that can help grid operators manage and leverage their capabilities. This will undoubtedly lead to new operational schemes and business opportunities that will transform the traditional consumer into a prosumer who will be more actively engaged in grid operations. Although the field is still under active development, many of the potential use cases presented in literature or industry are built upon edge computing, two-way communications, and other innovative computational constructs to attain their goals. However, at their core, many use cases assume a great level of data access to aid with the decision-making process, an assumption that may need to be revised to ensure fair and equitable operational processes are maintained. This may be particularly true as edge resources are predicted to participate in retail-side, many-to-many, or peer-to-peer markets and thus may lead to financial impacts if data access considerations are ignored. The need to revise data access mechanisms can be further justified by the introduction of new participants into the operational process, who do not have the same level of trust, nor the incentives to focus on energy delivery as their primary objective. At the same time, more consumers are becoming aware of their own data, and the potential impacts of its abuse. To help solution developers better understand these risks, this report has been developed to offer an initial introduction to the topic of privacy. This is achieved by 1) Highlighting the need for privacy-aware solutions; 2) Encouraging system designers to be inquisitive about the status quo; 3) Documenting the existing threat space; 4) Presenting and evaluating tools that may be helpful towards enabling better privacy postures; and 5) Making recommendations to encourage the adoption of better practices. From a technical perspective, the report focuses on evaluating two potential techniques by applying them to the Transactive Energy Space. Based on the obtained results, it can be established that differential privacy (DP) methods may have limited applicability when highly correlated, time-series data records need to be protected. However, DP may be a powerful tool when it is used to aggregate and analyze mid-size and large-size data sets in a more traditional statistical environment. The second tool under evaluation is threshold cryptography, which can guarantee complete secrecy (and thus privacy) but requires the establishment of key management procedures and dedicated communication channels for key coordination. Therefore, due to its increased computational overhead, the use of threshold cryptography must be weighted using a cost/benefit analysis on a per-application basis.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2021

Digital Biosurveillance for Zoonotic Disease Detection in Kenya

Infectious disease surveillance is crucial for early detection and situational awareness of disease outbreaks. Digital biosurveillance monitors large volumes of open-source data to flag potential health threats. This study investigates the potential of digital surveillance in the detection of the top five priority zoonotic diseases in Kenya: Rift Valley fever (RVF), anthrax, rabies, brucellosis, and trypanosomiasis. Open-source disease events reported between August 2016 and October 2020 were collected and key event-specific information was extracted using a newly developed disease event taxonomy. A total of 424 disease reports encompassing 55 unique events belonging to anthrax (43.6%), RVF (34.6%), and rabies (21.8%) were identified. Most events were first reported by news media (78.2%) followed by international health organizations (16.4%). News media reported the events 4.1 (±4.7) days faster than the official reports. There was a positive association between official reporting and RVF events (odds ratio (OR) 195.5, 95% confidence interval (CI); 24.01–4756.43, p < 0.001) and a negative association between official reporting and local media coverage of events (OR 0.03, 95% CI; 0.00–0.17, p = 0.030). This study highlights the usefulness of local news in the detection of potentially neglected zoonotic disease events and the importance of digital biosurveillance in resource-limited settings.

59 BASIC BIOLOGICAL SCIENCES↗
DOE OSTI2022

A Cybersecurity Threat Profile for a Connected Lighting System

In this paper we analyze a threat profile performed on a fault-detection use case for streetlights. A threat profile establishes security requirements, justifies security measures, yields actionable controls, and effectively communicates risk to stakeholders. This effort provides critical information for making threat-based decisions to increase security at a reasonable cost, and can effectively be used by development teams, software architects, and managers to make cybersecurity a part of their ongoing culture of awareness, training, and prevention. This leads to more secure systems and better-understood security. On-premise, cloud, and hybrid architectures with different authentication mechanisms were modeled and later categorized using the Microsoft STRIDE framework. An analysis of the recommended controls for each threat was performed to determine which controls could and should be put in place by manufacturers or third-party suppliers, and which controls need to be left up the end-user to implement.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2022

A Cybersecurity Threat Profile for a Connected Lighting System

In anticipation of improved energy performance and cost savings, cities and building owners are increasingly considering “smart lighting initiatives” that aim to convert their collection of simple luminaires (i.e., lighting fixtures) into an intelligent connected lighting system (CLS) capable of remotely monitoring energy consumption and fault conditions, and possibly implementing adaptive lighting schemes. The U.S. Department of Energy (DOE) has set an national goal of tripling the energy efficiency and demand flexibility of the buildings sector by 2030, relative to 2020 levels 1. It is forecast that connected lighting systems can contribute to that goal by delivering 125 TWh of annual energy savings by 2035 2, equivalent to the annual output of 50 typical (500 MW) power plants. However, these energy savings and the DOE goal are put at significant risk if connected technologies are not adopted due to real or perceived cybersecurity concerns. Connected IoT devices such as these have historically been rife with vulnerabilities which sometimes put security considerations secondary to functionality and operability. What are the cybersecurity threats that will impact these systems, as formerly banal luminaires transition into intelligent connected devices that collect information about themselves, their surrounding environment, and possibly us? In this paper we analyze a threat profile performed on a fault-detection use case for streetlights. A threat profile establishes security requirements, justifies security measures, yields actionable controls, and effectively communicates risk to stakeholders. This effort provides critical information for making threat-based decisions to increase security at a reasonable cost, and can effectively be used by development teams, software architects, and managers to make cybersecurity a part of their ongoing culture of awareness, training, and prevention. This leads to more secure systems and better-understood security. On-premise, cloud, and hybrid architectures with different authentication mechanisms were modeled and later categorized using the Microsoft STRIDE framework. An analysis of the recommended controls for each threat was performed to determine which controls could and should be put in place by manufacturers or third-party suppliers, and which controls need to be left up the end-user to implement. Fifty-seven threats were identified. Among our key findings: (1) 65% (37/57) of the threats did not involve the luminaires, but rather the other components needed to communicate with and manage them; (2) 63% (36/57) of the threats could have been mitigated through manufacturer-implemented defensive techniques or “controls”; and (3) 23% (13/57) of the threats were dependent on the network configuration. Recommendations based on the results of this work are made to key stakeholder groups. Notably, lighting technology developers are advised to address all threats that can be reasonably controlled with baked-in technology solutions (e.g., encryption or authentication controls), and employ some form of secure supply chain management and tracking where other parts (e.g., sensors, microprocessors) of a luminaire must also be built and manufactured with the proper security controls in place. Developers should also review threats involving assets not developed in-house to understand how connectivity with other devices will affect their product during system operation and determine if a compensating control for a defense-in-depth strategy will be needed. Finally, those interested in deploying CLS should compare the differences between cloud and on-premise models to determine which is more suitable for their needs and the abilities of their security team.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗
DOE OSTI2025

Decision-Dependent Uncertainty-Aware Distribution System Planning Under Wildfire Risk

The interaction between power systems and wildfires can be dangerous and costly. Distribution grids can be liable for the outbreak of wildfires during extreme weather. In wildfire-prone areas, investment planning should consider the impact of operational actions on wildfire-related uncertainties affecting line failure likelihood. Here, in this case, endogenous-based uncertainty modeling should comprise the backbone of the investment planning model viz-a-viz the inability of standard exogenous-based uncertainty modeling. Therefore, we propose a decision-dependent uncertainty (DDU) aware methodology to optimize investment portfolios for distribution systems, considering that high power-flow levels in high-threat areas can ignite wildfires and increase line failure probability. The methodology identifies the best combination of upgrades (new lines, hardening existing lines, and placing switching devices). Methodologically, we propose a two-stage distributionally robust planning optimization problem with DDU that considers the distribution system's multiperiod operation. The first stage determines optimal switching actions and line investments, and the second stage evaluates the worst-case expected operational cost under a DDU framework designed to account for the endogenous impact of power-flow levels and hardening investment decisions in the line failure probabilities. An iterative method is tailored to handle the problem and numerical experiments demonstrate a more prepared grid to deal with wildfire risk.

Power systems investment planning↗
DOE OSTI2022

Computational Imaging for Intelligence in Highly Scattering Aerosols (Final Report)

Natural and man-made degraded visual environments pose major threats to national security. The random scattering and absorption of light by tiny particles suspended in the air reduces situational awareness and causes unacceptable down-time for critical systems and operations. To improve the situation, we have developed several approaches to interpret the information contained within scattered light to enhance sensing and imaging in scattering media. These approaches were tested at the Sandia National Laboratory Fog Chamber facility and with tabletop fog chambers. Computationally efficient light transport models were developed and leveraged for computational sensing. The models are based on a weak angular dependence approximation to the Boltzmann or radiative transfer equation that appears to be applicable in both the moderate and highly scattering regimes. After the new model was experimentally validated, statistical approaches for detection, localization, and imaging of objects hidden in fog were developed and demonstrated. A binary hypothesis test and the Neyman-Pearson lemma provided the highest theoretically possible probability of detection for a specified false alarm rate and signal-to-noise ratio. Maximum likelihood estimation allowed estimation of the fog optical properties as well as the position, size, and reflection coefficient of an object in fog. A computational dehazing approach was implemented to reduce the effects of scatter on images, making object features more readily discernible. We have developed, characterized, and deployed a new Tabletop Fog Chamber capable of repeatably generating multiple unique fog-analogues for optical testing in degraded visual environments. We characterized this chamber using both optical and microphysical techniques. In doing so we have explored the ability of droplet nucleation theory to describe the aerosols generated within the chamber, as well as Mie scattering theory to describe the attenuation of light by said aerosols, and correlated the aerosol microphysics to optical properties such as transmission and meteorological optical range (MOR). This chamber has proved highly valuable and has supported multiple efforts inclusive to and exclusive of this LDRD project to test optics in degraded visual environments. Circularly polarized light has been found to maintain its polarization state better than linearly polarized light when propagating through fog. This was demonstrated experimentally in both the visible and short-wave infrared (SWIR) by imaging targets made of different commercially available retroreflective films. It was found that active circularly polarized imaging can increase contrast and range compared to linearly polarized imaging. We have completed an initial investigation of the capability for machine learning methods to reduce the effects of light scattering when imaging through fog. Previously acquired experimental long-wave images were used to train an autoencoder denoising architecture. Overfitting was found to be a problem because of lack of variability in the object type in this data set. The lessons learned were used to collect a well labeled dataset with much more variability using the Tabletop Fog Chamber that will be available for future studies. We have developed several new sensing methods using speckle intensity correlations. First, the ability to image moving objects in fog was shown, establishing that our unique speckle imaging method can be implemented in dynamic scattering media. Second, the speckle decorrelation over time was found to be sensitive to fog composition, implying extensions to fog characterization. Third, the ability to distinguish macroscopically identical objects on a far-subwavelength scale was demonstrated, suggesting numerous applications ranging from nanoscale defect detection to security. Fourth, we have shown the capability to simultaneously image and localize hidden objects, allowing the speckle imaging method to be effective without prior object positional information. Finally, an interferometric effect was presented that illustrates a new approach for analyzing speckle intensity correlations that may lead to more effective ways to localize and image moving objects. All of these results represent significant developments that challenge the limits of the application of speckle imaging and open important application spaces. A theory was developed and simulations were performed to assess the potential transverse resolution benefit of relative motion in structured illumination for radar systems. Results for a simplified radar system model indicate that significant resolution benefits are possible using data from scanning a structured beam over the target, with the use of appropriate signal processing.

58 GEOSCIENCES↗
DOE OSTI2020

Multiple social platforms reveal actionable signals for software vulnerability awareness: A study of GitHub, Twitter and Reddit

Software vulnerabilities are flaws in computer systems that leave users open to attack. In many cases, these vulnerabilities go unnoticed and remain unresolved in codebases. Thus, awareness of software vulnerabilities among the public is crucial to ensure effective cybersecurity practices, the development of high quality software, and ultimately national security. This awareness can be better understood by studying the spread and evolution of software vulnerability discussions in online communities. This work is the first to evaluate and contrast how discussions about software vulnerabilities spread on three social platforms -- Twitter, GitHub, and Reddit. To lay the groundwork, we showcase a novel fundamental framework for measuring information spread that identifies the spread mechanisms and observables across platforms, the units of information, and the groups of measurements that can be applied to focus on a specific phenomena e.g., information cascades. We then analyze and contrast social network topologies for three example social networks and measure the scale and speed of the spread of discussion of specific vulnerabilities to understand how far and how widely they spread, how many users participate in discussions, and the duration of their spread. To demonstrate the awareness of more impactful software vulnerabilities, a subset of our analysis focuses on vulnerabilities targeted during recent major cyber attacks as well as vulnerabilities exploited by advanced persistent threat groups. We discover that usually, vulnerability discussions start on GitHub, before occurring on Twitter and Reddit. While studying how some user-level and content-level characteristics influence vulnerability spread, we observe that Twitter discussions started by users predicted to be humans have larger size, breadth, depth, adoption rate, lifetime, and structural virality compared to those started by users predicted to be bots. On Reddit, we contrast the differences in thread structure that originate from posts with positive, negative and neutral polarity. We find that posts that are positive have larger, deeper and wider discussions compared to negative and neutral posts. We anticipate the results of our analysis to not only increase the understanding of software vulnerability awareness but also inform models for simulating information spread across multiple social environments online.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

From Count Rates to Quantifying Isotopic Activities – Field Analysis of Radiation Monitoring Data

The Nevada National Security Site (NNSS) provides a comprehensive bicoastal radiological and nuclear emergency response to United States Department of Energy/National Nuclear Security Administration. A major part of the support is to provide systematic radiological search for lost or stolen sources, Radiological search is a core competency of the NNSS with its origin dating back to nuclear weapons test era. Search operations from multiple platforms is the common thread among the various NNSS assets, which include Aerial Measuring System (AMS), Maritime Support Team (MST), National Capitol Response (NCR), National Search Team (NST) and Radiological Assistance Program (RAP). Information collected and analyzed during search operations add to the actionable intelligence for the law enforcement agencies and provide valuable guidance for the tactical resolution of a nuclear or radiological crisis. Search is an intelligence and situational awareness driven operation and most often called upon during a radiological emergency, however it can be brought into play to thwart a potential threat by providing monitoring and surveillance support. The Office of Nuclear Incident Response (NA-84) serves as the technical leader in responding to and resolving nuclear and radiological threats worldwide and integrates its efforts with other NNSA stakeholders (e.g., NNSA office of Defense Nuclear Non-proliferation NA-22). The response includes expertise in the areas of radiological search, render safe, and consequence management. This article will discuss the methodologies, tools, procedures, and techniques to extract maximum radiological characterization information (isotopic composition, activities for individual isotopes, threat assessment etc.) from field monitoring or Search operation data.

61 RADIATION PROTECTION AND DOSIMETRY↗
DOE OSTI2025

Tactical Analysis for Calculating Contextual Risk at Boundaries: Summary of Laboratory Directed Research & Development Effort

The Tactical Analysis for Calculating Contextual Risk at Boundaries (TACCRAB) tool is an innovative digital twin (DT) platform and automated risk algorithm designed to transform operational decision-making in structured screening environments, with an initial focus on Southern Border Land Ports of Entry (POEs). The invention provides integration points for advanced artificial intelligence, predictive modeling, and real-time data analysis to produce a comprehensive risk management tool that enables proactive, data-informed security strategies. The core inventive features of TACCRAB center on its unique risk algorithm, which dynamically calculates contextual risk by synthesizing historical data, near real-time streaming data from the checkpoints themselves, and AI-generated predictions. Unlike traditional risk assessment methods, TACCRAB utilizes a DT to provide comprehensive operational insights, allowing stakeholders to visualize, simulate, and optimize checkpoint configurations with unprecedented speed and contextual awareness. TACCRAB's key innovation lies in its ability to combine multiple complex inputs - including technology detection probabilities, resource availability, screening pathway characteristics, and threat actor behavioral patterns - into a unified risk calculation and update these inputs based on changing operational and environmental conditions. By leveraging a DT that continuously updates and learns from linked data, TACCRAB can suggest adaptive mitigation strategies that minimize risk while maintaining operational efficiency. Particularly novel is the platform's approach to decision support, which goes beyond static risk assessment. The DT provides dynamic metrics such as wait times, resource allocation effectiveness, and potential emerging threat scenarios, enabling users to view sophisticated, relevant what-if simulations and optimize checkpoint operations in near real-time. The system's architecture allows for generalized application across different screening environments, such as secure facilities, ports of entry, and soft targets, making it a versatile tool for security and operational management. The invention distinguishes itself through its comprehensive integration of predictive modeling, AI-driven pattern discovery, and user-friendly interface design. By combining these elements, TACCRAB transforms complex risk data into actionable insights, supporting decision-makers at various organizational levels - from booth agents making split-second screening decisions to checkpoint managers optimizing the day's resource allocation to strategic planners managing long-term investments.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2020

Secure and Cost-Effective Micro Phasor Measurement Unit (PMU)-Like Metering for Behind-the-Meter (BTM) Solar Systems using Blockchain-Assisted Smart Inverters

Recently, there is increasing interest in using behind-the-meter (BTM) solar systems for grid services. However, providing visibility and operational situational awareness of BTM solar systems mainly operated by small-scale solar inverters is challenging due to the requirement of relatively expansive networked observation tools (e.g., micro phasor measurement units (µPMUs)) and consequent cybersecurity threats through networks. This paper presents a secure, cost-effective, µPMUs-like metering method using a blockchain-assisted smart (BAS) inverters for a BTM solar system. The proposed BAS inverter consisting of an internet of things device as a node of a local blockchain network enables the secure provision of inverter measurement data for grid services. The BAS inverter sends the encrypted local measurement data with a timestamp to a local blockchain miner. Once the blockchain miner generates a tamper-resistant metering ledger including the measurements, it is used to assess the situational awareness of the BTM solar system. The concept of the proposed metering using the BAS inverters is validated by experimental studies.

behind the meter↗
DOE OSTI2020

Secure and Cost-Effective Micro Phasor Measurement Unit (PMU)-Like Metering for Behind-the-Meter (BTM) Solar Systems Using Blockchain-Assisted Smart Inverters: Preprint

Recently, there is increasing interest in using behind-the-meter (BTM) solar systems for grid services. However, providing visibility and operational situational awareness of BTM solar systems mainly operated by small-scale solar inverters is challenging due to the requirement of relatively expansive networked observation tools (e.g., micro phasor measurement units (uPMUs)) and consequent cybersecurity threats through networks. This paper presents a secure, cost-effective, uPMUs-like metering method using a blockchain-assisted smart (BAS) inverters for a BTM solar system. The proposed BAS inverter consisting of an internet-of-things device as a node of a local blockchain network enables the secure provision of inverter measurement data for grid services. The BAS inverter sends the encrypted local measurement data with a timestamp to a local blockchain miner. Once the blockchain miner generates a tamper-resistant metering ledger including the measurements, it is used to assess the situational awareness of the BTM solar system. The concept of the proposed metering using the BAS inverters is validated by experimental studies.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2021

Design Considerations for Distributed Energy Resource Honeypots and Canaries

There are now over 2.5 million Distributed Energy Resource (DER) installations connected to the U.S. power system. These installations represent a major portion of American electricity critical infrastructure and a cyberattack on these assets in aggregate would significantly affect grid operations. Virtualized Operational Technology (OT) equipment has been shown to provide practitioners with situational awareness and better understanding of adversary tactics, techniques, and procedures (TTPs). Deploying synthetic DER devices as honeypots and canaries would open new avenues of operational defense, threat intelligence gathering, and empower DER owners and operators with new cyber-defense mechanisms against the growing intensity and sophistication of cyberattacks on OT systems. Well-designed DER canary field deployments would deceive adversaries and provide early-warning notifications of adversary presence and malicious activities on OT networks. In this report, we present progress to design a high-fidelity DER honeypot/canary prototype in a late-start Laboratory Directed Research and Development (LDRD) project.

24 POWER TRANSMISSION AND DISTRIBUTION↗