SEARCH · Search NASA

Results for “threat modeling”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 55 records · Page 3

All sources NASA NTRS DOE OSTI

DOE OSTI2025

Cybersecurity Enhancement in Digital Substations: Hidden Markov Model-Based Smart Cyber Switching and Threat Response

The rising incidence of cyber-attacks on critical infrastructure and power grids poses significant threats to the stability and reliability of electrical substations, with potentially devastating consequences such as extended blackouts. This paper introduces an advanced cybersecurity framework aimed at safeguarding IEC 61850-based substations through the integration of software-defined networking (SDN) and digital twin (DT) technologies. The proposed DT-based framework employs smart cyber switching (SCS) for proactive threat mitigation and concurrent intelligent electronic device (CIED) for swift system restoration, thereby maintaining continuous operational integrity and robust cybersecurity defenses. Central to this framework is the adaptive port controller (APC), which enables dynamic port management to adapt to evolving threats, and an intrusion detection system (IDS) designed to detect and neutralize malicious attacks on IEC 61850-based sampled value (SV) and generic object-oriented substation event (GOOSE) messages within the substation’s communication network. Further, novel predictive intrusion detection and response (PIDR) algorithm is implemented on a digital substation (DS) to predict the best route to be taken by the attacker. The efficacy of these comprehensive cybersecurity frameworks is validated through rigorous simulations and a hardware-in-the-loop (HIL) testbed, showcasing the system’s ability to sustain substation operations amidst cyber-attacks.

Digital substation↗

DOE OSTI2024

Utilizing HYSPLIT for Emergency Response Modeling at SRS

The threat of a disaster happening at the Savannah River Site (SRS) is low, but not zero. When an emergency arises, emergency responders utilize a variety of tools to detect, track, and mitigate the disaster. HYSPLIT is a community atmospheric dispersion model that is highly configurable and has been used operationally to simulate particle, chemical, and radionuclide releases. We have developed a preliminary user interface (UI) that configures HYSPLIT to run for a variety of Emergency Action Level (EAL) scenarios at SRS. Using a hypothetical EAL scenario of an accidental release of Pu-238 in H-area and K-area onsite, an analysis was done to show how a preliminary UI framework allows HYSPLIT to be run on a terminal without the need form an active network connection. The study was successful in multiple aspects. For the preliminary UI, users were able to input certain characteristics of the hypothetical EAL such as hours of emission (how long was Pu-238 being released), curies of release, release start time (when does the model run start), and type of radionuclide directly into the terminal. For HYSPLIT, the model was successful in being able to take the UI input, calculate the results from the inputs and output multiple figures of both total volumetric airborne concentrations and surface deposition. We used the Pu-238 Derived Intervention Level (DIL) deposition thresholds for produce, dairy, and beef for visualization of the surface deposition, showing how a release would impact ingestion pathways.

38 RADIATION CHEMISTRY, RADIOCHEMISTRY, AND NUCLEA↗

DOE OSTI2022

Model-Based Diagnostics and Mitigation of Cyber Threats

The report summarizes key tasks performed to develop a toolkit for detecting cyber-attack events in instrumentation and control (I&C) systems of nuclear power plants. The toolkit connects the state-of-the-art GPWR Simulator with the RELAP5 code providing best-estimate nuclear steam supply system (NSSS) analyses, via the application programming interface (API), and allows users to introduce potential cyber-attack scenarios into power plant operational simulation. This summary for the project reflects topical reports submitted during the project as well as a journal paper published in 2022. The focus areas of the summary include: (1) modeling I&C systems for the AP1000 Generation III+ nuclear plant and GPWR simulator, (2) simulation and monitoring of plant response to cyber-attack events, (3) API structure for the toolkit interfacing the GPWR simulator and RELAP5 code, and (4) restructuring of the three-loop NSSS software of GPWR to model the two-loop AP1000 structure. Discussed in some details are (a) the attack tree analysis assessing the susceptibility of the AP1000 I&C system, resulting in reactor trips, in terms of the attack possibility and component sensitivity and (b) realistic estimation of the time to steam generator trip due to cyber-intrusions in the GPWR Simulator. Finally, sample demonstrations of the cyber-security tool kit, in the form of the GPWR-RELAP5 API, are summarized.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

DOE OSTI2025

Enhancing Security and Resiliency in Operational Technology Environments Through Network Slicing and Federated Learning

The growing convergence of Information Technology (IT) and Operational Technology (OT) within Industry 4.0 environments has introduced new demands on industrial network infrastructure. As cyber-physical systems become increasingly interconnected, ensuring the secure, timely, and efficient exchange of critical data is essential. This thesis explores how network slicing, a method of creating isolated virtual network segments, can be applied within OT environments to address challenges such as latency, security, and resource allocation. The first research question addressed in this thesis is: How can OT networks take advantage of NFV and SDN technology to become cyber resilient? This study examines the operational, security, and architectural implications of introducing network slicing into traditionally static OT infrastructures such as Industrial Control Systems (ICS) and SCADA. Through simulated deployments and case studies, the research demonstrates how slicing enables better isolation between critical and non-critical services, thereby improving response time, throughput, and security in sensitive environments. The second question considers: How to dynamically implement network slicing and take advantage of network resources towards integrating decentralized machine learning? In response, this thesis proposes a framework that combines Software-Defined Networking (SDN), Network Function Virtualization (NFV), and Federated Learning (FL) to enable real-time analytics while maintaining data locality. The proposed approach reduces the burden on centralized infrastructure and minimizes privacy risks by supporting on-site training of models across distributed OT nodes, coordinated through dynamically allocated network slices. The third focus explores: How slicing helps to increase the resiliency of OT networks through the orchestration of a dynamic DMZ? To answer this, the thesis presents a method for creating and managing Dynamic Demilitarized Zones (DMZs) using network slicing. This enables flexible and automated isolation of sensitive subsystems during threat scenarios or high-risk operations. Coupled with intelligent orchestration and containerized security services, the dynamic DMZ significantly enhances the system's ability to respond to cyber incidents without halting production. Ultimately, this thesis contributes a comprehensive architecture that blends network slicing with machine learning, secure segmentation, and automation, paving the way for resilient, adaptive, and intelligent OT environments. Performance evaluations across multiple scenarios show improvements in system reliability, threat response time, model accuracy, and resource utilization, providing a strong foundation for future industrial automation systems.

Rodiles Delgado, Brian G↗

DOE OSTI2022

Exploring acute weather resilience: Meeting resilience and renewable goals

We report the United States is affected by an average of almost seven severe weather events a year, often resulting in billions of dollars in physical and economic damages, a subset of which are related to grid outages. There is a need for power and energy system stakeholders to better understand and implement the strategies that help reduce net-economic and societal consequences associated with grid outages by improving the resilience of their systems. In addition, there are incentives to reduce emissions and meet climate goals, several pathways of which include resilient technologies. Including resilience constraints and metrics in energy system planning models may help inform the design of more resilient systems that are also more renewable and sustainable. This paper reviews qualitative definitions of resilience, quantitative approaches to resilience, recent examples of the inclusion of resilience in energy system models with respect to acute climatological threats, and the gaps in fully articulating resilience in current modeling tools. We then outline steps to effectively improve resilience considerations against such threats into energy sector modeling tools. Based on the findings, the authors propose a novel framework for energy system resilience assessment and future areas of research to bridge the current modeling gaps.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗

DOE OSTI2021

Cyber-Vulnerability Analysis for Real-Time Power Market Operation

Not provided.

Engineering↗

DOE OSTI2023

Transferable Graph Neural Fingerprint Models for Quick Response to Future Bio-Threats

Explore the source record for details and available documents.

59 BASIC BIOLOGICAL SCIENCES↗

DOE OSTI2024

The trailing edge is everywhere: tree rings reveal the transient risk of extinction hidden inside climate envelope forecasts

Given the importance of climate in shaping species’ geographic distributions, climate change poses an existential threat to biodiversity. Climate envelope modeling, the predominant approach used to quantify this threat, presumes that individuals in populations respond to climate variability and change according to species-level responses inferred from spatial occurrence data—such that individuals at the cool edge of a species’ distribution should benefit from warming (the “leading edge”), whereas individuals at the warm edge should suffer (the “trailing edge”). Using 1,558 tree-ring time series of an aridland pine (Pinus edulis) collected at 977 locations across the species’ distribution, we found that trees everywhere grow less in warmer-than-average and drier-than-average years. Ubiquitous negative temperature sensitivity indicates that individuals across the entire distribution should suffer with warming—the entire distribution is a trailing edge. Species-level responses to spatial climate variation are opposite in sign to individual-scale responses to time-varying climate for approximately half the species’ distribution with respect to temperature and the majority of the species’ distribution with respect to precipitation. These findings, added to evidence from the literature for scale-dependent climate responses in hundreds of species, suggest that correlative, equilibrium-based range forecasts may fail to accurately represent how individuals in populations will be impacted by changing climate. A scale-dependent view of the impact of climate change on biodiversity highlights the transient risk of extinction hidden inside climate envelope forecasts and the importance of evolution in rescuing species from extinction whenever local climate variability and change exceeds individual-scale climate tolerances.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2024

Tree rings reveal the transient risk of extinction hidden inside climate envelope forecasts

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2023

Modeling, testing, and mitigation of electromagnetic pulse on PV systems

Electromagnetic Pulse (EMP) poses a significant threat to the normal operation of power systems, especially with the increasing penetration of renewable energy. Without adequate protection, EMP can severely damage equipment or result in circuit breakdowns or short circuits. Solar photovoltaic (PV) facilities are particularly susceptible to EMP since PV systems are outdoors and exposed to EMP radiation. To assess and mitigate this threat, this paper summarizes various models and tests used to study the effects of EMP on PV systems, assesses the nature of the threat, and identifies measures to mitigate it. The paper provides a comprehensive review by categorizing analytical methods based on their pros and cons, introducing and describing EMP-related events, and providing a taxonomy of analytical methods for studying EMP. This paper compares the processes of modeling, testing, and mitigating EMP at both the component and system levels of PV systems. Furthermore, it also presents a case study that reveals the vulnerability of solar inverters to EMP using the pulse current injection method. Finally, the paper discusses some of the remaining challenges that should be considered in future solar PV system design and deployment.

14 SOLAR ENERGY↗

DOE OSTI2022

Dynamics Informed Optimization for Resilient Energy Systems

Optimal mitigation planning for highly disruptive contingencies to a transmission-level power system requires optimization with dynamic power system constraints, due to the key role of dynamics in system stability to major perturbations. We formulate a generalized disjunctive program to determine optimal grid component hardening choices for protecting against major failures, with differential algebraic constraints representing system dynamics (specifically, differential equations representing generator and load behavior and algebraic equations representing instantaneous power balance over the transmission system). We optionally allow stochastic optimal pre-positioning across all considered failure scenarios, and optimal emergency control within each scenario. This novel formulation allows, for the first time, analyzing the resilience interdependencies of mitigation planning, preventive control, and emergency control. Using all three strategies in concert is particularly effective at maintaining robust power system operation under severe contingencies, as we demonstrate on the Western System Coordinating Council (WSCC) 9-bus test system using synthetic multi-device outage scenarios. Towards integrating our modeling framework with real threats and more realistic power systems, we explore applying hybrid dynamics to power systems. Our work is applied to basic RL circuits with the ultimate goal of using the methodology to model protective tripping schemes in the grid. Finally, we survey mitigation techniques for HEMP threats and describe a GIS application developed to create threat scenarios in a grid with geographic detail.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2025

PSA 2025 DPRA for Cyber Optimization

Cyberattacks can have many different attack paths, durations, and goals. There are also many different mitigation options involving hardware, software, and/or humans. Evaluating defense options should include quantitative evaluation of overall effectiveness to make cost and risk-informed decisions. Typical cyberattack modeling methods only provide a qualitative evaluation and have difficulty with time dependent scenarios. The main areas of cybersecurity are confidentiality, integrity, and availability. For companies with cyber-physical systems such as advanced nuclear reactors, cyber-related integrity is a requirement set by the U.S. Nuclear Regulatory Commission. But companies are also concerned about availability or reliability as a business case. As cyber threats are evolving to a business-for-hire structure, more attacks focus on disrupting business success and reliability, causing financial and economic stability risk. Companies want reliability analysis while optimizing cost, which requires more than safety modeling methods. Dynamic-state-based and Markov-based modeling provides a method for better cyber scenario modeling with timing and conditional features not found in other numerical evaluation methods. EMRALD (Event Modeling Risk Assessment using Lined Diagrams) is a dynamic risk analysis modeling and simulation tool and has features that reduce modeling issues such as state-base explosion found in Markov-based tools. It has been used to model different time-dependent events including plant behavior and operator procedures. As a general modeling tool, EMRALD can also be used to model cyberattack scenarios with varying mitigation options and quantify effectiveness, producing numerical data for risk-informed decisions. This paper uses EMRALD to demonstrate that dynamic risk analysis can be used for cyber threat modeling to provide insights for design decision-making and optimize defense strategies.

97 - MATHEMATICS AND COMPUTING↗

DOE OSTI2024

Linking Threat Agents to Targeted Organizations: A Pipeline for Enhanced Cybersecurity Risk Metrics

In this study, we present a methodology leveraging Large Language Models (LLMs) to transform Cybersecurity Threat Intelligence (CTI) narratives into actionable insights for individual organizations. Our approach automates the extraction of machine-readable adversary SKRAM (Skills, Knowledge, Resources, Authorities, and Motivation) attributes from open-source reports, extending LLM utility beyond typical interactions. This innovation enables precise, automated assessments of cybersecurity risks posed by various adversaries. Using a chain-of-thought and multi-shot prompting strategy, our methodology advances the automation of cybersecurity feature extraction for new machine-learning models that predict the risk of adversary targeting. This approach is refined using a substantial dataset of over 150 analyst-validated threat reports and synthetic organizational data from 900 companies. Here, by bootstrapping the training data with a rule-based heuristic over synthetic data, we have developed a high-accuracy machine-learning model that allows entities to dynamically prioritize threats and defensive actions.

Cyber Threat Intelligence↗

DOE OSTI2021

Evaluation of the Large-Scale and Regional Climatic Response Across North Africa to Natural Variability in Oceanic Modes and Terrestrial Vegetation Among the CMIP5 Models

Hydrologic variability is a serious threat to the poverty-stricken regions of North Africa. Meanwhile, the scientific community struggles to attribute these extreme climatic episodes to specific oceanic and land drivers. Prior modeling studies have not assessed simulated feedbacks over North Africa against an established observational benchmark, so their results are considered as untested, model-specific findings. The Coupled Model Intercomparison Project Phase Five (CMIP5) archive represents the state-of-the-art in climate projections, with most CMIP5 models now containing interactive vegetation phenology; however, there have been no studies to date of their simulated vegetation feedbacks. The capability of CMIP5 models at accurately simulating the forcing of both sea-surface temperature (SST) and regional leaf area index (LAI) anomalies on North African climate needs to be a key consideration in assessing the models’ overall credibility and determining appropriate model weighting for developing climate projections. The Generalized Equilibrium Feedback Assessment (GEFA) is a promising statistical method, which can be applied to either model output or observations, for isolating the local and remote impacts of individual oceanic or terrestrial forcings on regional climate. We performed a combined observational and modeling assessment of land-ocean-atmosphere interactions across the distinct ecological and moisture gradients of North Africa. We evaluated and demonstrated the reliability of the GEFA statistical method over North Africa using the Community Earth System Model (CESM), applied GEFA to observational data to quantify the observed forcing of ocean basin SST anomalies and regional LAI anomalies on North African climate, evaluated the CMIP5 models’ performance in terms of representing these key observed feedbacks, and formulated CMIP5 feedback performance metrics for weighting North African climate projections. Our study represented the first attempt to separate the observed roles of oceanic and vegetation feedbacks across North Africa, the first systematic assessment and intercomparison of land-ocean-atmosphere feedbacks in CMIP5, and the first exploration of vegetation feedbacks among CMIP5 models. The following work was accomplished. (1) The team generated 14 scientific publications and 30 presentations based on the DOE-funded research. (2) A stepwise version of the GEFA statistical method was developed in which unimportant forcings were dropped to increase the reliability of the results. (3) SGEFA was successfully validated through experiments with CESM in terms of its ability to isolate the atmospheric responses to individual oceanic or land forcings. (4) Observational evidence was revealed for the Sahel’s positive vegetation-rainfall feedback on the seasonal to interannual time scale, and it was attributed to a moisture recycling mechanism rather than an albedo mechanism. (5) An approach with SGEFA was developed in which the individual contributions of soil moisture versus vegetation forcings could be separated, revealing that the former forcing outweighed the latter for sub-Saharan Africa. (6) Tropical ocean temperatures were found to be key regulators of pan-tropical vegetation variability, especially for arid and semi-arid regions, including sub-Saharan Africa. (7) The CMIP5 models largely underestimated the importance of land feedbacks across the Sahel. (8) The general consensus among CMIP5 models indicates, for the late 21st century, a diminished seasonal predictability of sub-Saharan African regional climate and an elevated role of the land surface compared to oceanic drivers in regulating regional climate variability. (9) Land-ocean-atmosphere interactions were demonstrated to be key contributors to the seasonal predictability of African wildfire activity. (10) The El Djouf was determined to be of greater importance than the Bodélé depression in terms of providing trans-Atlantic dust transport to the Americas.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2022

Threat by marine heatwaves to adaptive large marine ecosystems in an eddy-resolving model

Marine heatwaves (MHWs), episodic periods of abnormally high sea surface temperature, severely affect marine ecosystems. Large marine ecosystems (LMEs) cover ~22% of the global ocean but account for 95% of global fisheries catches. Yet how climate change affects MHWs over LMEs remains unknown because such LMEs are confined to the coast where low-resolution climate models are known to have biases. Here, using a high-resolution Earth system model and applying a ‘future threshold’ that considers MHWs as anomalous warming above the long-term mean warming of sea surface temperatures, we find that future intensity and annual days of MHWs over the majority of the LMEs remain higher than in the present-day climate. Better resolution of ocean mesoscale eddies enables simulation of more realistic MHWs than low-resolution models. These increases in MHWs under global warming pose a serious threat to LMEs, even if resident organisms could adapt fully to the long-term mean warming.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2025

Detecting Unclassified Electromagnetic Signals for Secure Wireless Communication Using Open Set Recognition

We developed multiple machine learning methods for the detection and classification of new wireless communication waveforms, which is critical for targeted attacks in wireless networks and electronic warfare. Our machine learning models are capable of dynamically detecting security threats in near real time through our advanced open set recognition (OSR) approach. This model has demonstrated significant improvements in the detection of unknown waveforms, thereby enhancing the security and reliability of mission critical communications. Our approach to detecting uncertain security threats is novel; we advanced OSR techniques by incorporating domain knowledge of wireless signals. Specifically, we combined time and frequency domain model features to enhance the model’s performance. Utilizing an OSR approach eliminates the need for training data to be distributed similarly to the deployment environment and removes the requirement for the training set to contains all possible threat classes. This is crucial because it is often infeasible to determine and characterize all potential security threats in advance. Our model were trained on simulated data, generated in partnership with the University at Albany, State of New York. The data set contained a diverse array of wireless signals, including those with additive white Gaussian noise and multipath signals, with and without line of sight. This comprehensive training set allowed us to optimize our models to detect unknown waveforms under various challenging scenarios, such as low signal-to-noise ratios. By training on various waveforms, varying signal-to-noise ratio, and different sample sizes under normal conditions, our models were fine tuned to perform effectively in challenging environments.

99 - GENERAL AND MISCELLANEOUS↗

DOE OSTI2026

Cyote-attack Chain Estimator

Attack Chain Estimator (ACE) Application Overview The Attack Chain Estimator (ACE) Application is a sophisticated tool designed for the ingestion, classification, sequencing, and enrichment of cybersecurity threat reports. This application leverages advanced machine learning models and extensive historical data to provide comprehensive insights into cyber threats, specifically targeting Industrial Control Systems (ICS). Purpose The primary functions of the ACE Application include: Ingestion of Cybersecurity Threat Reporting: Capable of ingesting text-based threat reports in markdown or text file format. Supports ingestion of structured data from other sources in STIX/JSON format. Classification of Report’s Text-Based Events: Utilizes a DeBERTa classifier, specifically trained on cybersecurity data, to map the events to MITRE ATT&CK for ICS Tactics and Techniques. Classification is performed using multiple Jupyter notebooks and machine learning workflows hosted as FastAPI microservices: regex_data deberta_base_35_train_hft_classifier_mlflow.ipynb hft_regex_classifier_mlflow.ipynb param_train_hft_classifier_mlflow.ipynb regex_tactic_tech.ipynb Ordering of Tactics, Techniques, and Observable Events: Sequences the identified tactics, techniques, and events to form a coherent attack chain. Enrichment with Historical Attack Chain Details: Enhances the attack chain with details from historical attacks using a Markov model developed from CyOTE Precursor Analysis Report data. The Markov model is available as a FastAPI endpoint for seamless integration. Enrichment with Adversary Emulation Capabilities Data: Integrates adversary emulation capabilities data using MITRE Caldera for OT adversary abilities UUIDs. Export of Output Files: Provides options to export the enriched attack chain in JSON or CSV formats. Routing of Output to Other Applications: Facilitates routing of output to various platforms and applications, including: Threat Intelligence Platforms COREII Scout for Threat Intelligence Analysis COREII Modeling and Simulation for Adversary Emulation Technical Description The ACE Application is an advanced cybersecurity tool designed to provide detailed threat analysis and sequence generation. It is built on a robust architecture that integrates natural language processing, machine learning, and historical data modeling. Key Components: Data Ingestion Module: Handles the input of threat reports and data from various formats, ensuring flexibility in data sources. Classification Engine: Employs DeBERTa-based classifiers hosted as FastAPI microservices to analyze and classify threat report events in accordance with the MITRE ATT&CK framework for ICS. Sequence Generator: Orders the classified events into a logical attack chain, providing clear insight into the sequence of tactics and techniques used in the threat. Enrichment Engine: Integrates historical data and adversary emulation capabilities to enhance the attack chain with valuable context and additional details. The historical data enrichment is powered by a Markov model, which is available as a FastAPI endpoint. Export and Routing Module: Facilitates the export of the enriched attack chain in multiple formats and routes the output to designated applications for further analysis or emulation.

Paul, Tony [Idaho National Laboratory (INL), Idaho↗

DOE OSTI2024

Physical & Cyber Security Modeling Interfacing Through Dante and ARCADE

Physical security is increasingly facing new threats from cyber attackers, for which there is little research in the way of characterizing this threat. This report discusses the efforts to combine cyber and physical security modeling tools to investigate this novel combinatorial threat space. To accomplish this, the Dante force-on-force modeling and simulation software and the Advanced Reactor Cyber Analysis and Development Environment (ARCADE) were integrated. Dante provides a 3D environment which models the physical world, while ARCADE provides the cyber and control systems world.

42 ENGINEERING↗