On an Information and Control Architecture for Future Electric Energy Systems
Not Available
24 POWER TRANSMISSION AND DISTRIBUTION↗
SEARCH · Search NASA
Results for “cyber systems”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Enhancing Cybersecurity for Industrial Control Systems: Innovations in Protecting PLC-Dependent Industrial Infrastructures
Not Available
97 MATHEMATICS AND COMPUTING↗
CIE Analysis Process for Engineered Systems
"CIE Analysis Process for Engineered Systems" outlines a comprehensive methodology for integrating Cyber-Informed Engineering (CIE) principles into both new and existing engineered systems. Sponsored by the U.S. Department of Energy’s Office of Cybersecurity, Energy Security, and Emergency Response (DOE CESER), the process aims to achieve cyber-informed decisions by producing functional security requirements for new systems and retrofitting existing systems to mitigate digital risks. The document details a step-by-step approach, including mission and function definition, digital asset awareness, consequence analysis, and mitigation analysis. It emphasizes the importance of documenting mechanical, electrical, programmable, and network components to protect system functions and provides examples and considerations for each step. The ultimate goal is to ensure that engineered systems remain resilient against cyber threats, maintaining safety, performance, and reliability.
42 - ENGINEERING↗
Automated Programmable Logic Controller Memory Forensics Using RGB Image Analysis and Deep Learning
The introduction of Industry 4.0 and Internet-based technologies has enhanced industrial control system operations but have inadvertently increased their vulnerabilities to cyber attacks. When an industrial control system is compromised, security analysts need to identify the root cause quickly to start the recovery process and develop mitigation strategies. Memory forensics is critical in the incident analysis process to ascertain what occurred. Approaches for analyzing the persistent memory in industrial control devices are limited and almost nonexistent for volatile memory. This chapter proposes an automated methodology for programmable logic controller memory dump analysis using computer vision and deep learning techniques. The methodology converts the sequences of bytes in a programmable logic controller memory dump to red-green-blue pixels and employs a deep learning model that learns the underlying patterns and features of pre-labeled forensic artifacts in images and segments them into distinct regions. The trained model is employed to automatically segment new memory images and identify forensic artifacts. Evaluation of the methodology on a Schneider Electric Modicon M221 programmable logic controller under code injection and code modification attacks demonstrates its ability to detect attack artifacts in memory dumps.
Asmar Awad, Rima [ORNL] (ORCID:0000000233407742)↗
A Blockchain-Facilitated Secure Sensing Data Processing and Logging System
Not Available
97 MATHEMATICS AND COMPUTING↗
Robust Resilient Signal Reconstruction under Adversarial Attacks
We consider the problem of signal reconstruction for a system under sparse signal corruption by a malicious agent. The reconstruction problem follows the standard error coding problem that has been studied extensively in the literature. We include a new challenge of robust estimation of the attack support. The problem is then cast as a constrained optimization problem merging promising techniques in the area of deep learning and estimation theory. A pruning algorithm is developed to reduce the "false positive" uncertainty of data-driven attack localization results, thereby improving the probability of correct signal reconstruction. Sufficient conditions for the correct reconstruction and the associated reconstruction error bounds are obtained for both exact and inexact attack support estimation. Moreover, a simulation of a water distribution system is presented to validate the proposed techniques.
Robust, Signal reconstruction, Resilient estimator↗
Engineering Against Digital Risk in CIP Applications: Cyber-Informed Engineering Use Cases
Cyber-Informed Engineering (CIE) addresses the reality that cyber attacks on engineered systems can have consequences far beyond data loss or disruption of digital networks. When control systems are compromised, safety, reliability, and performance of the physical process itself may be threatened. This presentation discusses engineered controls of 7 categories and the CIE database of controls that provides clear examples and guidance for defining and applying engineered controls in CIE. It explains what engineered controls are, how they differ from information security measures, and how they are integrated into system design.
99 - GENERAL AND MISCELLANEOUS↗
Load Margin Constrained Moving Target Defense against False Data Injection Attacks
Cyber physical security of power systems with high penetration of renewable generation has attracted attention from researchers. One critical issue is that cyber-physical attacks, disguised as uncertain renewable generation, can target conventional power system state estimation (SE). Moving target defense (MTD) is a promising defense strategy to detect stealthy false data injection (FDI) attacks against SE. However, all existing studies myopically perturb the reactance of transmission lines equipped with distributed flexible AC transmission system (D-FACTS) devices without adequately considering the system voltage stability. Exacerbated by the renewable generation uncertainty, existing MTD may cause voltage instability when the power grid is under stress. To address this issue, we propose a novel MTD framework that explicitly considers system voltage stability by using continuation power flow. We utilize the sensitivity matrix of power injection to line impedance, on which an optimization problem for maximizing load margin is formulated. This framework is validated on the IEEE 14-bus system and the IEEE 118-bus system, in which net load redistribution attacks are launched by sophisticated attackers. Steady-state simulations and dynamic simulations on PSS/E show the effectiveness of the proposed framework in circumventing the voltage instability while maintaining the detection effectiveness of MTD. The impact of the proposed method on attack detection effectiveness is also revealed.
Zhang, Hang↗
Multi-Source Multi-Domain Data Fusion for Cyberattack Detection in Power Systems
Not Available
24 POWER TRANSMISSION AND DISTRIBUTION↗
Voltage Service Limits Smart Contract Using Distributed Ledger Technology for Electrical Utility Grid with Customer-Owned Generator
Modern electrical grids face growing stability risks from customer-owned generators, especially at points of common couplings (PCCs). Disruptive behavior from power-electronic sources can cause protective relays to isolate problematic generators, making measurement integrity critical. This article presents a distributed ledger technology (DLT) approach that uses smart contracts to evaluate PCC voltage measurements and trigger backup breaker operations. The approach is framed as a verifiable, multi-organization attestation and audit layer, not as a real-time control security mechanism. In the proposed architecture, voltage measurements from a hardware protective relay are anchored on a DLT through the Cyber Grid Guard (CGG) system for attestation by both the grid utility and customer-owned generator. A Voltage Service Limits (VSLs) smart contract evaluates the on-chain measurements against allowable phase-voltage limits derived from the ANSI C84.1 standard. The framework is validated in a hardware-relay-in-the-loop test bed under sustained-undervoltage, sustained-overvoltage, and transient line-to-line fault scenarios. The results show that the VSL smart contract can process these measurements and issue backup breaker actions consistent with the defined service-limit criteria, demonstrating the DLT potential as a verifiable audit layer at the PCC that complements primary protection.
cyber security↗
Does practice make perfect? Lessons learned from full-scale power system incident response exercise
While threats to the energy sector occur daily, few utilities get the opportunity to fully test out their detection and response mechanisms to advanced threats in the real world. With the high demand for reliability, few grid operators would allow execution of simulated cyber-attacks on their live systems. The DOE-funded Liberty Eclipse project offers a unique opportunity for small and large utilities and coops to practice their combined IT/OT responses to a live red team executing attacks against an isolated power system on an island in New York. Both cyber teams and power operations teams must work together to detect and respond to attacks, even restoring the power system against extreme impacts. Lessons learned from these exercises reveal key takeaways for understanding what a real attack against the electric sector will look like, gaps in execution of the best-laid plans when the pressure of a real event is bearing down, and how organizations can better prepare for advanced attacks by optimizing participation in exercises. This presentation will discuss successes and opportunities for improvement both in how utilities can prepare for and respond to events, as well as how full-scale IT/OT exercises can be coordinated.
24 POWER TRANSMISSION AND DISTRIBUTION↗
Digital Engineering and Cybersecurity Decision Analysis in Early Phases of SMR-Driven IES Projects
Considerable efforts are underway to ensure cybersecurity is integrated into the systems engineering lifecycle. Cyber-informed engineering and security-by-design frameworks are intended to identify and engineer out cybersecurity risks throughout the lifecycle. While these approaches are valuable for promoting the need to include cybersecurity considerations in early design phases to create more secure systems, they may not consider the entirety of digital risks. Digital risks in a digital instrumentation and control system include adversarial and unintentional risks from internal and external factors, such as human performance errors, design flaws, environmental conditions, and equipment degradation or failure. This report provides a detailed discussion on digital risk prior to describing the background and concept of operations for a small modular reactor-driven integrated energy system connected to industrial applications. The challenges of competing objectives and competing stakeholder requirements are discussed and the impacts on digital engineering, security considerations, and interdependencies are evaluated for mission-level, facility-level, and system-level decisions.
98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗
Cyber Physical Grid-Interactive Distributed Energy Resources Control for VPP Dispatch and Regulation
This paper presents a cyber-physical algorithm for grid-interactive Distributed Energy Resource (DER) control to enable two features of Virtual Power Plants (VPPs) dispatch and grid voltage regulation, considering the communication and security impacts. We first formulate the DER dispatch problem as a real-time, iterative, and grid-interactive DER control problem. Thereafter, we consider a probabilistic traffic model to characterize packet delays and loss in a communication network, and study how the delays enter the process of information exchange among the grid measurement units, local DER controllers and the grid control center that coordinately execute this dispatch algorithm. Finally, a strategy combining delay threshold and modified message update rules is proposed to immune the asynchrony resulting from the communications network traffic and it avoids possible numerical instabilities and sensitivities of the tracking and regulation capabilities of this DER control algorithm. By implementing the proposed cyber-physical algorithm on the modified IEEE 37-node system, our preliminary results exhibit that the uncertainties of the underlying communications infrastructure must be considered for the VPP tracking and regulation capabilities of any DER in a generic Cyber-Physical System (CPS), because the delayed voltage measurements in the uplink/bi-link cases result in the off-track in VPP dispatch and jittery in voltage regulation.
cyber-physical algorithm↗
Skyfall: Signal Fusion from a Smartphone Falling from the Stratosphere
A smartphone plummeted from a stratospheric height of 36 km, providing a near-real-time record of its rapid descent and ground impact. An app recorded and streamed useful internal multi-sensor data at high sample rates. Signal fusion with external and internal sensor systems permitted a more detailed reconstruction of the Skyfall chronology, including its descent speed, rotation rate, and impact deceleration. Our results reinforce the potential of smartphones as an agile and versatile geophysical data collection system for environmental and disaster monitoring IoT applications. We discuss mobile environmental sensing capabilities and present a flexible data model to record and stream signals of interest. The Skyfall case study can be used as a guide to smartphone signal processing methods that are transportable to other hardware platforms and operating systems.
47 OTHER INSTRUMENTATION↗
Mission Assurance Modeling and Simulation: A Cyber Security Roadmap
This paper proposes a cyber security modeling and simulation roadmap to enhance mission assurance governance and establish risk reduction processes within constrained budgets. The term mission assurance stems from risk management work by Carnegie Mellon's Software Engineering Institute in the late 19905. By 2010, the Defense Information Systems Agency revised its cyber strategy and established the Program Executive Officer-Mission Assurance. This highlights a shift from simply protecting data to balancing risk and begins a necessary dialogue to establish a cyber security roadmap. The Military Operations Research Society has recommended a cyber community of practice, recognizing there are too few professionals having both cyber and analytic experience. The authors characterize the limited body of knowledge in this symbiotic relationship. This paper identifies operational and research requirements for mission assurance M&S supporting defense and homeland security. M&S techniques are needed for enterprise oversight of cyber investments, test and evaluation, policy, training, and analysis.
Gendron, Gerald↗
Securing Ground Data System Applications for Space Operations
The increasing prevalence and sophistication of cyber attacks has prompted the Multimission Ground Systems and Services (MGSS) Program Office at Jet Propulsion Laboratory (JPL) to initiate the Common Access Manager (CAM) effort to protect software applications used in Ground Data Systems (GDSs) at JPL and other NASA Centers. The CAM software provides centralized services and software components used by GDS subsystems to meet access control requirements and ensure data integrity, confidentiality, and availability. In this paper we describe the CAM software; examples of its integration with spacecraft commanding software applications and an information management service; and measurements of its performance and reliability.
Security↗
Smart Contracts for Power Grid Applications Using the Advanced DLT Cyber Grid Guard Testbed
In this study is presented two power system applications with distributed ledger technology (DLT) and smart contracts (SC) that were assessed in a Cyber-Grid-Guard System (CGGS) advanced testbed, with protective relays, power meters, communication devices, DLT devices, synchronized time source, clock displays and real time simulator. This CGGS testbed was set in the Advanced Protection Lab, 252 lab space of the Grid Research Integration and Deployment Center (GRID- C), at Oak Ridge National Laboratory. In power grids, customer-owned distributed energy resources (DERs) are more frequent than in the past, and the numbers of points of interconnection (POI) with customer-owned DERs have increased. Disruptive operation from DERs presents a risk to grid operations, and protective relays located at the POI are used to isolate out-of-tolerance or poorly behaving of DERs. Ensuring the integrity of data from the relays at the POI, and DLT could enhance the security of the power grids. The first application is a SC to define and control the allowable total power factor (TPF) of the DER (wind farm) output, and the terms of the SC are implemented using DLT with a CGGS for a customer-owned DER. The TPF SC was implemented by the CGGS using DLT. The experimental model was performed with a real-time simulator using a CGGS and relay in-the-loop. The data collected from the CGGS were used to execute the TPF SC. The TPF limits were between +0.9 and +1.0, and the breakers’ operation in the POI was controlled by the relay using the SC. The events were collected from the real-time simulator, CGGS, and SEL 700GT relay to validate a successful application of the TPF SC using DLT. The second application is a SC to measure and control the allowable voltage service limits (VSL) by the CGGS using DLT. The tests were performed by using a real-time simulator, CGGS and relay in-the-loop. The data was collected from the CGGS that executed the SC. The main constraints were defined based on ANSI C84.1 service voltage limits, and the operation of the breakers in the POI. The events were collected from the CGGS, and SEL 700GT relay to assess a successful operation of the VSL SC using DLT.
24 POWER TRANSMISSION AND DISTRIBUTION↗
Neighborhood Keeper
Neighborhood Keeper is a collective defense and community-wide visibility solution that provides a more effective industrial cyber defense by sharing threat intelligence at machine-speed across industries and geographic regions.
99 GENERAL AND MISCELLANEOUS↗