Search NASA⌕ Search

SEARCH · Search NASA

Results for “intrusion”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 433 records · Page 24
All sourcesNASA NTRSDOE OSTI
DOE OSTI2023

Why Dissolving Salt in Water Decreases Its Dielectric Permittivity

The dielectric permittivity of salt water decreases on dissolving more salt. For nearly a century, this phenomenon has been explained by invoking saturation in the dielectric response of the solvent water molecules. Herein, we employ an advanced deep neural network (DNN), built using data from density functional theory, to study the dielectric permittivity of sodium chloride solutions. Notably, the decrease in the dielectric permittivity as a function of concentration, computed using the DNN approach, agrees well with experiments. Detailed analysis of the computations reveals that the dominant effect, caused by the intrusion of ionic hydration shells into the solvent hydrogen-bond network, is the disruption of dipolar correlations among water molecules. Accordingly, the observed decrease in the dielectric permittivity is mostly due to increasing suppression of the collective response of solvent waters.

74 ATOMIC AND MOLECULAR PHYSICS↗
DOE OSTI2023

Assessment of the Distributed Ledger Technology for Energy Sector Industrial and Operational Applications Using the MITRE ATT&CK® ICS Matrix

In recent times, Distributed Ledger Technology (DLT) has gained significant attention for its potential application in the energy sector. Utilizing blockchain and DLT has demonstrated the ability to enhance the resilience of the electric infrastructure, which will support a more flexible infrastructure and advance grid modernization. However, the deployment of these technologies increases the overall attack surface. The MITRE ATT&CK® matrices have been developed to document an adversary’s tactics and techniques based on real-world observations. The MITRE ATT&CK® matrices provide a common taxonomy for offense and defense and have become a valuable conceptual tool across multiple cybersecurity disciplines for conveying threat intelligence, performing testing through red teaming or adversary emulation, and enhancing network and system defenses against intrusions. The MITRE ATT&CK® for Industrial Control Systems (ICS) matrix was created to provide knowledge about adversary behavior in the ICS technology domain. This study analyzes the relevance of various tactics and techniques across a seven-layer DLT engineering and cybersecurity stack, known as the DLT stack, designed by the Cybersecurity Taskforce under IEEE P2418.5 - Standard for Blockchain in Energy working group sponsored by Power and Energy Systems - Smart Buildings, Loads and Customer Systems (PES/SBLC) Technical Committee. Additionally, this paper identifies specific mitigation strategies tailored to the energy ICS environment

42 ENGINEERING↗
DOE OSTI2024

Cyber-Secure and Safe Operation of Solar Photovoltaic Power Distribution Systems

Solar photovoltaic (PV)-rich power distribution systems are networked Cyber-Physical Systems (CPS). These are control systems where multiple computing nodes and diverse intelligent agents interact with the physical world in real-time. However, the presence of networked components renders them vulnerable to potential cyber-attacks, cyber-intrusions, and other malicious events. This is because these systems depend on the measurements reported from their heterogeneous sensors. This makes them vulnerable to potential cyber-attacks where malicious agents can compromise the sensors or the communication networks carrying the sensor measurements. This paper proposes a novel methodology for enhancing the cyber-security and cyber-resilient post-attack safe operation of solar PV-rich power distribution systems against potential cyber-attacks through the Dynamic Watermarking (DW), using online system identification. The resiliency of the proposed technique is tested and validated with several attack scenarios on both a lab-scale 3kW grid-connected PV inverter and a Hardware-in-the-Loop (HiL) system. The proposed approach can be applied to other types of power distribution systems to enhance their cyber-secure and cyber-resilient safe operation. This paper thereby contributes to the field of cyber-security of Cyber-Physical Energy Systems (CPES).

Kim, Jaewon↗
DOE OSTI2020

Indicator-directed Dynamic Power Management for Iterative Workloads on GPU-Accelerated Systems

Modern high-performance and warehouse computing centers show strong interest in minimizing system power consumption while satisfying customers’ quality of service (QoS). Dynamic voltage and frequency scaling (DVFS) is effective for achieving this goal. Nevertheless, automating the process online and making it transparent to users must address three major challenges: (1) Complexity — today’s hardware components (e.g., CPUs, GPUs, memory, network, etc.) can be configured in several or dozens of frequency/voltage states for satisfying divergent system demands. Given their combination and the emergence of heterogeneity, searching the optimal configuration in the design space online can be timing consuming. (2) QoS guarantee — user-defined objectives such as power constraint and performance target must be monitored, predicted and ensured at the best effort. (3) Adaptability — various known and unknown workloads run on systems. Workloads characteristics should be quickly determined and configurations dynamically adjusted in accord with workloads and QoS. In this work, we focus on applications exhibiting an interesting feature – iterative or periodic, which is common among conventional HPC and emerging machine learning workloads. We propose an online dynamic power-performance (ODPP) management framework to dynamically adjust GPU DVFS configurations to meet performance and power objectives and constraints, without any code annotation or intrusion. Particularly, ODPP extracts the performance and power indicators for applications from their resources utilization profiles in a short episode. It further automatically constructs an accurate model that infers from the indicators how the application's performance and power vary with GPU core and memory frequencies. Aided with the model, for both seen and unseen applications, ODPP can quickly determine the most appropriate DVFS configuration for their execution. We evaluate ODPP on an NVIDIA GPU using multiple exascale computing (ECP) and deep learning applications.

Zou, Pengfei↗
DOE OSTI2026

The Impact of Time-Aware Design Choices in ICS Anomaly Detection

Industrial control systems (ICS) remain vulnerable to increasingly sophisticated cyberattacks, yet evaluating anomaly detection models in these environments is challenging due to temporal dependencies, missing-not-at-random patterns, and extremely imbalanced datasets. These factors make common practices—especially random data splits and na¨ıve imputation— prone to severe temporal leakage, which can inflate reported performance and obscure real-world limitations. In this work, we systematically examine classical machine learning models, temporal deep learning architecture, and tensordecomposition– based methods on a gas-pipeline dataset using a fully temporally separated evaluation pipeline designed to mimic realistic deployment conditions. Our findings show that proper temporal handling and MNAR-aware preprocessing significantly alter the relative performance of popular anomaly-detection methods, providing practical guidance for designing reliable, leakage-resistant ICS intrusion-detection systems.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Autonomous Cyber Defense Against Dynamic Multi-strategy Infrastructural DDoS Attacks

Dynamic Infrastructural Distributed Denial of Service (I-DDoS) attacks constantly change attack vectors to congest core backhaul links and disrupt critical network availability while evading end-system defenses. To effectively counter these highly dynamic attacks, defense mechanisms need to exhibit adaptive decision strategies for real-time mitigation. This paper presents a novel Autonomous DDoS Defense framework that employs model-based reinforcement agents. The framework continuously learns attack strategies, predicts attack actions, and dynamically determines the optimal composition of defense tactics such as filtering, limiting, and rerouting for flow diversion. Our contributions include extending the underlying formulation of the Markov Decision Process (MDP) to address simultaneous DDoS attack and defense behavior, and accounting for environmental uncertainties. We also propose a fine-grained action mitigation approach robust to classification inaccuracies in Intrusion Detection Systems (IDS). Additionally, our reinforcement learning model demonstrates resilience against evasion and deceptive attacks. Evaluation experiments using real-world and simulated DDoS traces demonstrate that our autonomous defense framework ensures the delivery of approximately 96 - 98% of benign traffic despite the diverse range of attack strategies.

Dutta, Ashutosh↗
DOE OSTI2020

Vulnerability Detection Methodology for a Digital Signal Processor Micro-Controller at Edge Level Distributed Energy Resource Controller

Integration of renewable energy and energy storage based Distributed Energy Resource (DER) assets to the grid has seen an upsurge over the past few decades. Traditionally, energy would be generated at a thermal or nuclear power plant and then transmitted over long distance through the transmission grid and then supply to the customers at the distribution grid. Modern renewable energy based DER assets have brought energy production at the edge of distribution grid, which has made the grid vulnerable to cyber intrusion as the power flow controllers for such DER assets are now distributed across the grid from distribution level to transmission level. This paper discusses the vulnerability posed by such power flow controllers of DER assets and demonstrates a detection methodology for unauthorized access and manipulation of system configuration for Digital Signal Processor based Microcontrollers. Experimental results proving efficacy of the methodology have been shown in paper.

Bhowmik, Pankaj↗
DOE OSTI2021

Blockchain-Based Man-in-the-Middle (MITM) Attack Detection for Photovoltaic Systems

Cybersecurity of photovoltaic (PV) systems entails a much larger scope than just encryption and firewall of communications. For instance, integrity of data in transit between inverters and a cloud server can be compromised by authorized third-party, devices, and internal network within security perimeter (i.e., man-in-the-middle (MITM) attack). To address this challenge, this paper proposes a blockchain-based MITM attack detection method for a PV system. A breakthrough method includes screening network data, network intrusion detection, and hash comparison of in-transit data using distributed ledgers. Furthermore, the proposed method is implemented in Internet-of-Thing (IoT) security modules as clients of a blockchain network and validated by experiments.

blockchain↗
DOE OSTI2023

Factorization Machine Learning for Disaggregation of Transmission Load Profiles with High Penetration of Behind-the-Meter Solar

The ever-growing high penetration of ubiquitously distributed energy resources, especially behind-the-meter solar (BTM) generations, has significant impacts on nodal load (i.e., net injection) profiles and consequently caused imperative operational challenges to system operators such as regional transmission organizations (RTOs). Illustrated by real-world nodal data and examples at PJM Interconnection, this paper first discusses the application and necessity of effectively extracting daily nodal load profiles in a non-intrusive manner. More importantly, a novel bi-level architecture, including Factorization Machines (FM) learning procedure has been proposed to effectively disaggregate not only one node but every node in an RTO service territory. Specifically, FM leaning is adopted to capture the interconnections between related features to better utilize the correlation between buses in the same region and between a single bus and the zonal load. The proposed bi-level technique is numerically validated using real-world, minute-level, normalized, and anonymized nodal data at PJM service territory.

behind the meter solar, load disaggregation, load ↗
DOE OSTI2023

A Multi-Harmonic System Identification Method for Internal Circuit Element Monitoring

Many critical infrastructures depend on the reliability of electronic circuits, whose health depends on the values of internal circuit elements that degrade over time. It is therefore important to estimate the values of internal circuit elements from external measurements and monitor them for changes. The challenge to doing so is that, typically, the internal voltages and currents are not accessible for measurement. Prior work on internal circuit element monitoring uses data obtained from sensors placed inside the circuit or requires additional circuitry to be added to the given system, both of which are undesirable. We propose a new multi-harmonic frequency-domain based system identification method that is non-intrusive. It exploits the latent non-idealities already present in the system, specifically harmonics in the measured input and output signals. We show how sensitivity analysis can be used to both assess the accuracy of the method as well as to optimize the choice of harmonics to use. We use as a motivation and illustrative example the problem of determining the equivalent series resistance and capacitance in a class of dc-link capacitance circuits in Adjustable Speed Drives. We assess the performance of this method using simulations, and establish its validity by experimental results.

Deshpande, Ankit Vivek↗
DOE OSTI2019

Fingerprinting Anomalous Computation with RNN for GPU-accelerated HPC Machines

This paper presents a workload classification framework that discriminates illicit computation from authorized workloads on GPU-accelerated HPC systems. As such systems become more and more powerful, they are exploited by attackers to run malicious and for-profit programs that typically require extremely high computing ability to be successful. Our classification framework leverages the distinctive signatures between illicit and authorized workloads, and explore machine learning methods to learn the workloads and classify them. The framework uses lightweight, non-intrusive workload profiling to collect model input data, and explores multiple machine learning methods, particularly recurrent neural network (RNN) that is suitable for online anomalous workload detection. Evaluation results on four generations of GPU machines demonstrate that the workload classification framework can tell apart the illicit authorized workloads with a high accuracy of over 95%.

Zou, Pengfei↗
DOE OSTI2026

FitCache: A Transparent Drop-In Framework for Multi-Tier Caching to Accelerate Distributed Deep Learning Workloads

Training in Deep learning (DL) remains highly compute- and data-intensive, with I/O becoming a critical bottleneck as models and datasets scale. Recent studies report that data loading can dominate training time, especially on large-scale HPC systems with shared parallel file systems (PFS). Existing caching approaches either rely on single-tier designs or require intrusive modifications to training pipelines, limiting their portability and effectiveness. In this work, we present FitCache, a transparent drop-in framework for multi-tier caching to accelerate distributed DL training by coordinating fast local memory (e.g., DRAM, Persistent Memory (PMem)) and NVMe as hierarchical caches atop PFS. Our design adapts to hardware diversity, i.e., if NVMe is missing, memory transparently acts as a caching tier, ensuring stable performance. FitCache transparently intercepts I/O requests and issues concurrent fetches across all tiers, returning data from the fastest responder without centralized metadata or static redirection paths. FitCache adapts to dynamic workloads and heterogeneous clusters while maintaining POSIX compatibility. Experiments on Frontier (2048 GPUs) and smaller research clusters show that FitCache reduces training time by up to 40% and per-batch I/O latency by up to 71.6% compared to Lustre Orion PFS, offering a drop-in solution for scalable DL training.

Hu, Guangxing [ORNL] (ORCID:0009000283203614)↗
DOE OSTI2020

Sensing Service Transformer Secondary Currents using Planar Magnetic Pick-up Coils

The rapid deployment of distributed energy resources (DERs) is creating stresses on utility assets in the distribution networks. The service transformer, which is the most commonly used utility asset is often not monitored, since the cost of available sensing solutions is as high as the transformer itself. This paper presents a method to use an array of printed circuit board coils to intelligently monitor North American pole top service transformers. The approach, uses a novel, self-calibrating algorithm to infer the fixed geometry of the installation, by recording data over an extended period of time. The proposed method can enable rapid installation of a non-intrusive sensor that can be used to monitor loading levels of the distribution transformer. Furthermore, these sensors can help in planning, prognostics and advanced situational awareness for utilities.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2020

Verifying Deep Reductions in the Nuclear Arsenals: Development and Demonstration of a Motion-detection Subsystem for a “Buddy Tag” Using Non-export Controlled Accelerometers

Future nuclear arms-control agreements may place numerical limits on items that are difficult to monitor with national technical means, even when complemented with onsite inspections. Such items could include small objects and mobile assets, such as non-deployed nuclear warheads and mobile missile launchers. Typically, this verification task can be addressed with unique identifiers, but standard tagging techniques may be unacceptable in this case due to host concerns about safety and intrusiveness. First proposed in the late 1980s and partially developed by Sandia National Laboratories in the early 1990s, the “Proximity Tag” or “Buddy Tag” concept seeks to overcome these concerns by separating the tag from the treaty accountable item itself. A buddy tag has two key elements: a tamper-indicating enclosure and a motion-detection system designed to detect illicit movements in a stand-down period. As part of this project, we have built a buddy-tag prototype for demonstration and evaluation purposes. This paper reviews the design choices and functionalities of the tag’s motion-detection subsystem.We pursue a modular approach for the tag’s hardware, built around an Arduino-class microcontroller and a non-export-controlled low-noise accelerometer, and use open-source algorithms for the motion-detection software. Finally, we discuss the results of an extensive experimental campaign involving both indoor and outdoor measurements assessing the performance of the tag under real-world environmental conditions.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗
DOE OSTI2021

Comparison of Surface Phenomena Created by Underground Chemical Explosions in Dry Alluvium and Granite Geology From Fully Polarimetric VideoSAR Data

Phase I of the Source Physics Experiment (SPE) series involved six underground chemical explosions, all of which were conducted at the same experimental pad. Research from the sixth explosion of the series (SPE-6) demonstrated that polarimetric synthetic aperture radar (PolSAR) is a viable technology for monitoring an underground chemical explosion when the geologic structure is Cretaceous granitic intrusive. It was shown that a durable signal is measurable by the H/A/α polarimetric decomposition parameters. After the SPE-6 experiment, the SPE program moved to the Phase II location, which is composed of dry alluvium geology (DAG). The loss of wavefront energy is greater through dry alluvium than through granite. In this article, we compare the SPE-6 analysis to the second DAG (DAG-2) experiment. We hypothesize that despite the geology at the DAG site being more challenging than at the Phase I location, combined with the DAG-2 experiment having a 3.37 times deeper scaled depth of burial than the SPE-6, a durable nonprompt signal is still measurable by a PolSAR sensor. We compare the PolSAR time-series measures from videoSAR frames, from the SPE-6 and DAG-2 experiments, with accelerometer data. We show which PolSAR measures are invariant to the two types of geology and which are geology dependent. We compare a coherent change detection (CCD) map from the DAG-2 experiment with the data from a fiber-optic distributed acoustic sensor to show the connection between the spatial extent of coherence loss in CCD maps and spallation caused by the explosion. Finally, we also analyze the spatial extent of the PolSAR measures from both explosions.

42 ENGINEERING↗
DOE OSTI2026

SDN-Based Dynamic Cybersecurity Framework of IEC-61850 Communications in Smart Grid

In recent years, critical infrastructure and power grids have experienced a series of cyber-attacks, leading to temporary, widespread blackouts of considerable magnitude. Since most substations are unmanned and have limited physical security protection, cyber breaches into power grid substations present a risk. Nowadays, the susceptibility of SDN architecture to cyber-attacks has exhibited a notable increase in recent years, as indicated by research findings. This suggests a growing concern regarding the potential for cybersecurity breaches within the SDN framework. In this paper, we propose a hybrid intrusion detection system (IDS)-integrated SDN architecture for detecting and preventing the injection of malicious IEC 61850-based generic object-oriented system event (GOOSE) messages in a digital substation. Additionally, this program locates the fault’s location and, as a form of mitigation, disables a certain port. Furthermore, implementation examples are demonstrated and verified using a hardware-in-the-loop (HIL) testbed that mimics the functioning of a digital substation.

Liu, Chen-Ching [Virginia Tech] (ORCID:00000002894↗
DOE OSTI2026

SDN-Based Smart Cyber Switching (SCS) for Cyber Restoration of a Digital Substation

In recent years, critical infrastructure and power grids have increasingly been targets of cyber-attacks, causing widespread and extended blackouts. Digital substations are particularly vulnerable to such cyber incursions, jeopardizing grid stability. This paper addresses these risks by proposing a cybersecurity framework that leverages software-defined networking (SDN) to bolster the resilience of substations based on the IEC- 61850 standard. The research introduces a strategy involving smart cyber switching (SCS) for mitigation and concurrent intelligent electronic device (CIED) for restoration, ensuring ongoing operational integrity and cybersecurity within a substation. The SCS framework improves the physical network’s behavior (i.e., leveraging commercial SDN capabilities) by incorporating an adaptive port controller (APC) module for dynamic port management and an intrusion detection system (IDS) to detect and counteract malicious IEC-61850-based sampled value (SV) and generic object-oriented system event (GOOSE) messages within the substation’s communication network. The framework’s effectiveness is validated through comprehensive simulations and a hardware-in-the-loop (HIL) testbed, demonstrating its ability to sustain substation operations during cyber-attacks and significantly improve the overall resilience of the power grid.

Liu, Chen-Ching (ORCID:0000000289417958)↗