AUTOMATED CYBER SECURITY TESTING PLATFORM FOR INDUSTRIAL CONTROL SYSTEMS.
Abstract not provided.
Hahn, Andrew Stuart↗
SEARCH · Search NASA
Results for “cyber systems”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Automated Cyber Security Testing Platform for Industrial Control Systems.
Abstract not provided.
Hahn, Andrew Stuart↗
Energy-Informed Cyber and Physical Resilience for Distributed Energy Systems
Explore the source record for details and available documents.
29 ENERGY PLANNING, POLICY, AND ECONOMY↗
Cyber Informed Engineering Cie Analysis Tool
Main Benefits: • Collaborate on assessment via the web and access and share assessments on your mobile device. • Helps you maximize your cybersecurity investment and resources • Saves you significant time and money by eliminating the requirement to research each government and industry standard in order to understand your cybersecurity posture • Contains easy to follow, step by step instructions to guide you through the process of identifying the cybersecurity posture of your organization • Provides a place to begin with cybersecurity improvement and a way to prioritize your tasks and budgets. • Covers all major cyber relevant topic areas for a comprehensive assessment of your organization’s cybersecurity posture. • Dives deep into the details of each topic area. • Contributes to the organization's risk management and decision-making process • Highlights vulnerabilities and gaps in your organization's IT and control systems. • Raises awareness and facilitates discussion on cybersecurity within your organization • Educates the controls system community on cyber security.
Hansen, Barry [Idaho National Laboratory (INL), Id↗
Industrial control system device classification using network traffic features and neural network embeddings
Characterization of modern cyber–physical Industrial Control System (ICS) devices is critical to the evaluation of their security posture and an understanding of the underlying industrial processes with which they interact. In this work, we address two related ICS device identification tasks: (1) separating ICS from non-ICS devices and (2) identifying specific ICS device types. We propose two distinct methods (one based on the existing IP2Vec method, and a novel traffic-features-based method) for achieving the first task. For transferability of the first task between two datasets, the traffic-features-based method performs significantly better (75% overall accuracy) compared to IP2Vec (22.5% overall accuracy). We further propose a novel method called DNP2Vec to address the second task. DNP2Vec is evaluated on two different datasets and achieves perfect multi-class classification accuracy (100%) for both datasets.
42 ENGINEERING↗
Connecting the Dots: An Assessment of Cyber-risks in Networked Building and Municipal Infrastructure Systems
The buildings and city streets we walk down are changing. Driven by various data-driven use cases, there is increased interest in networking and integrating lighting and other building systems (e.g., heating, ventilation, and air conditioning (HVAC), security, scheduling) that were previously not internet-facing, and equipping them with sensors that collect information about their environment and the people that inhabit it. These data-enabled systems can potentially deliver improved occupant and resident experiences and help meet the U.S. Department of Energy (DOE) national energy and carbon reduction goals. Deploying connected devices new to being networked, however, is not without its challenges. This paper explores tools available to system designers and integrators that facilitate a cybersecurity landscape assessment – or more specifically the identification of threats, vulnerabilities, and adversarial behaviors that could be used against these networked systems. These assessments can help stakeholders shift security prioritization proactively toward the beginning of the development process.
cyber-risk assesment, adversarial behavior, MITRE ↗
Dynamic probabilistic risk assessment and game theory for cyber security risk analysis in nuclear power plants
Nuclear Power Plants and energy systems have become more prone to cyber-attacks with their digitalization and the increased use of smart equipment. Hence, it is important to quantify the risk associated with cyber-attacks in such systems. Dynamic Probabilistic Risk Assessment which involves studying the evolution of a system due to random events and operator and attacker actions during a cyber-attack by employing a physics-based model of the system is a suitable framework to quantify cybersecurity risk in nuclear power plants. In addition to the plant dynamics, it is also important to model the strategies of the attackers and plant operators for an effective cybersecurity risk assessment. Game theory provides a set of necessary tools to model such strategic interactions. In this research, a framework that integrates dynamic probabilistic risk assessment with game theory for cybersecurity risk analysis in nuclear power plants is presented. The mathematical formulation is derived based on the theory of continuous event trees. We propose a game theory based action model, that utilizes physics-based rewards to define the strategies of attackers and operators at every decision epoch. As a case study, the risk associated with cyber-attacks on the digital components in the secondary side of a pressurized water reactor is studied using a reduced order model. A set of attacker actions and a set of operator actions are defined for the system. The operator and attacker interactions were modelled using simultaneous game, their action policies were computed using the concept of mixed strategy Nash equilibrium and the evolution of the system was studied.
97 MATHEMATICS AND COMPUTING↗
Cyber-Informed Engineering Implementation Guide: Version 1.0 [Slides]
This Implementation Guide describes the principles of Cyber-Informed Engineering (CIE) and outlines questions that engineering teams should consider during each phase of a system's lifecycle to effectively employ these principles. It describes what it means to engineer systems in a cyber-informed way, rather than offering a comprehensive, step-by-step process or procedure for CIE implementation. This guide complements - but does not replace - the application of cybersecurity standards or practices currently in place within an organization. Engineers and technicians that design critical energy infrastructure installations can use this Implementation Guide to integrate the 12 principles of CIE into each phase of the engineering lifecycle, from concept to retirement. The guide is aimed at system or design engineers, rather than software engineers or operational cybersecurity practitioners. The engineers who design, build, operate, and maintain the physical infrastructure are best positioned to leverage a system's engineering design to diminish the severity of cyber attacks or digital technology failures. CIE expands cybersecurity decisions into the engineering space, not by asking engineers to become cyber experts, but by calling on engineers to apply engineering tools and make engineering decisions that improve cybersecurity outcomes. CIE examines the engineering consequences that a sophisticated cyber attacker could achieve and drives engineering changes that may provide deterministic mitigations to limit or eliminate those consequences.
24 POWER TRANSMISSION AND DISTRIBUTION↗
Resilient Operating Constraints for Power Distribution Systems under Setpoint Attacks
Integration and operation of distributed generation (DG) and energy storage (ES) in power distribution systems are enabled by communication networks and embedded sensor and control devices that increase the vulnerability of the systems to cyber-threats, broadening the attack surface and making adversary actions more unpredictable. This paper proposes a methodology that uses ellipsoidal approximations to quantify the potential damage caused by successful attacks that affect, directly or indirectly, the desired operation setpoints and may drive the power distribution operation to unsafe states by violating the limits of voltage or line flows. More specifically, a new methodology is introduced to find the optimal non-symmetric operating constraints that can be imposed to each DG and ES in order to guarantee that the power distribution system is resilient to any malicious setpoints. The proposed method takes as inputs the system topology, DG and ES capabilities, and load limits to solve a convex optimization problem formulated using linear matrix inequalities (LMIs) and the power flow equations. The proposed solution is agnostic to the attacker's action or load profile and it does not require any assumption about the location or means of the attack. The numerical results on a test distribution feeder with several DG and ES illustrate how the proposed resilient operating constraints guarantee the security of the power distribution system under setpoint attacks.
Giraldo, Jairo↗
Cyber-attack detection and neutralization
The example embodiments are directed to a system and method for neutralizing abnormal signals in a cyber-physical system. In one example, the method includes receiving input signals comprising time series data associated with an asset and transforming the input signals into feature values in a feature space, detecting one or more abnormal feature values in the feature space based on a predetermined normalcy boundary associated with the asset, and determining an estimated true value for each abnormal feature value, and performing an inverse transform of each estimated true value to generate neutralized signals comprising time series data and outputting the neutralized signals.
97 MATHEMATICS AND COMPUTING↗
Cyber-Informed Engineering Implementation Guide
This Implementation Guide describes the principles of Cyber-Informed Engineering (CIE) and outlines questions that engineering teams should consider during each phase of a system’s lifecycle to effectively employ these principles. It describes what it means to engineer systems in a cyber-informed way, rather than offering a comprehensive, step-by-step process or procedure for CIE implementation. This guide complements—but does not replace—the application of cybersecurity standards or practices currently in place within an organization. Engineers and technicians that design critical energy infrastructure installations can use this Implementation Guide to integrate the 12 principles of CIE into each phase of the engineering lifecycle, from concept to retirement. The guide is aimed at system or design engineers, rather than software engineers or operational cybersecurity practitioners. The engineers who design, build, operate, and maintain the physical infrastructure are best positioned to leverage a system’s engineering design to diminish the severity of cyber attacks or digital technology failures. CIE expands cybersecurity decisions into the engineering space, not by asking engineers to become cyber experts, but by calling on engineers to apply engineering tools and make engineering decisions that improve cybersecurity outcomes. CIE examines the engineering consequences that a sophisticated cyber attacker could achieve and drives engineering changes that may provide deterministic mitigations to limit or eliminate those consequences.
42 ENGINEERING↗
Medium-scale to large-scale implementation of cyber-physical human experiments in live traffic
Autonomous Vehicles (AVs) such as cars and trucks are being developed and tested as Cyber-Physical Human systems while the technology improves. Before these systems can achieve full autonomy, some serve as tools in the form of adaptive cruise control. The CIRCLES Consortium investigates the potential for AVs to increase fuel efficiency of highway traffic by smoothing “stop-and-go” traffic waves that result from normal human driving behavior in congestion. We have performed an experiment to evaluate the real world effects of implementing this strategy. A medium-scale experiment was performed on I-24 near Nashville, TN in August 2021. This was a precursor to a larger experiment that will take place November 2022. We examine how the human part of the experiment will change as we scale up from an 11 vehicle test (four AVs) to 100 AVs. There are many solutions to problems of the medium-scale experiment that would be inconvenient, complicate the experience, or not be practicable. The medium-scale experiment involved 11 cars of which four had a custom control algorithm installed to be engaged by the driver. The large-scale experiment will have 100 cars, all with custom control algorithm installed to act on traffic when the controller is engaged. We examine key choices made for the medium experiment, and how some will be different for the large experiment. Our experience performing the medium-scale experiment has made it clear that repeating our methods from this smaller one are inefficient or impossible if used for the large-scale experiment and will be improved.
McQuade, Sean T.↗
Hybrid Attack Graph Generation with Graph Convolutional Deep-Q Learning
Critical infrastructures such as power grids have become increasingly complex, connected, and vulnerable to adverse scenarios, including cyber and physical attacks and faults. Effective risk mitigation for such cyber-physical energy systems (CPES), requires preemptive knowledge of likely adversarial attack scenarios. Hybrid Attack Graph (HAG) is a structured way to represent an adversarial scenario as an attack sequence using a threat model. However, the scarcity of documented attack sequences hinders analysts and CPES planners’ ability to identify credible attack scenarios for a given CPES. We propose a data-driven Graph Convolutional Deep-Q Network (GCDQ) to address this data challenge through generating HAGs. By leveraging limited real-world observations from the MITRE ATT&CK knowledge base, our GCDQ model synthesizes realistic graphs with the targeted attribute of minimum detectability via reinforcement learning. This generative model is the first step in creating a tool to substantially boost the attack sequence dataset and enhance the performance of CPS defense-related tasks by providing insights into likely attack sequences with given attributes.
deep learning, artificial intelligence↗
Reinforcement Learning for Distribution Grid Optimization (PyCIGAR) v0.1
PyCIGAR is a python software package that merges off-the-shelf reinforcement learning libraries (RLLib and Ray) with electric power distribution system simulation tools (OpenDSS and a custom power flow solver built by LBL). PyCIGAR enables the training of neural networks to optimize the behavior of different components in the electric distribution grid, such as control systems in photovoltaic rooftop solar inverters and electric battery storage systems. The software package has been used to train neural networks to update settings in photovoltaic rooftop solar inverter control systems to mitigate cyber attacks on other solar photovoltaic rooftop devices.
Arnold, Daniel↗
Distributed Energy Resource Cybersecurity Framework Best Practices
Current cybersecurity challenges for distributed energy resources (DERs) stem from the integration of various systems and the cyber-physical security concerns they bring. Although frameworks exist for industrial control systems and other energy systems, a simple guided tool that can prioritize recommended actions for controls specific to DERs is lacking. Additionally, the novelty of the field has made it difficult to create a standardized procedure for DERs with cybersecurity in mind. In response to this critical need to address cybersecurity risk management, the National Renewable Energy Laboratory (NREL) has developed a framework and accompanying web application known as the Distributed Energy Resources Cybersecurity Framework (DERCF) (Powell, 2019). A brief overview of the DERCF can be found in Section 1.2. This document provides a guide to cybersecurity best practices identified by technical research and site visits where the framework was used to assess the cybersecurity posture of DER systems.
24 POWER TRANSMISSION AND DISTRIBUTION↗
Chess Master Project
This final technical report tracks the accomplishments of the Chess Master Project to the statement of project objects and resulting commercialization of the technology. Objectives for the project include 1) to sustain critical energy delivery functions during a cyber intrusion, control system operators need the ability to automate identification and containment of the affected network areas, and re-route critical information and control flows around; and 2) to effectively isolate impacted network areas and re-route critical flows, control system network operators need a global view of all the communication flows and have a method to proactively determine the whitelisted communications and how to respond to communications when adversarial behavior is detected.
42 ENGINEERING↗
Facility Cybersecurity Framework Best Practices Version 2.0
Federal facilities are increasingly adopting automation and connecting to the Internet creating an energy-internet-of-things environment that converges operational technology (OT) and information technology (IT). Today's buildings increasingly weave together networked sensors and cyber and physical systems that enable data to be collected, aggregated, exchanged, stored and monetized in new ways. Building technological advances have created new energy technology, services, markets and value creation opportunities (e.g. transactive energy, two-way grid communications, machine learning, and increased use of renewable and distributed energy resources). But as larger data sets are being exchanged at faster speeds between an increasing number of OT systems, it becomes more difficult to protect the security of the data lifecycle and the physical equipment it interacts with. These challenges are especially difficult to overcome because the economic and environmental gain (interoperability, big data, social networks and ubiquitous information sharing) are driving these prominent trends in the digital age. Often cybersecurity is an afterthought.
32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗
Facility Cybersecurity Framework Best Practices Version 2.0
Federal facilities are increasingly adopting automation and connecting to the Internet creating an energy-internet-of-things environment that converges operational technology (OT) and information technology (IT). Today's buildings increasingly weave together networked sensors and cyber and physical systems that enable data to be collected, aggregated, exchanged, stored and monetized in new ways. Building technological advances have created new energy technology, services, markets and value creation opportunities (e.g. transactive energy, two-way grid communications, machine learning, and increased use of renewable and distributed energy resources). But as larger data sets are being exchanged at faster speeds between an increasing number of OT systems, it becomes more difficult to protect the security of the data lifecycle and the physical equipment it interacts with. These challenges are especially difficult to overcome because the economic and environmental gain (interoperability, big data, social networks and ubiquitous information sharing) are driving these prominent trends in the digital age. Often cybersecurity is an afterthought.
32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗