Results for “cyber systems” — Page 37

DOE OSTI2023

Resilient Communication Scheme for Distributed Decision of Interconnecting Networks of Microgrids

Networking of microgrids can provide the operational flexibility needed for the increasing number of DERs deployed at the distribution level and supporting end-use demand when there is loss of the bulk power system. But, networked microgrids are vulnerable to cyber-physical attacks and faults due to the complex interconnections. As such, it is necessary To design resilient control systems to support the operations of networked microgrids in responses to cyber-physical attacks and faults. This paper introduces a resilient communication scheme for interconnecting multiple microgrids to support critical demand, in which the interconnection decision can be made distributedly by each microgrid controller even in the presence of cyberattacks to some communication links or microgrid controllers. This scheme blends a randomized peer-to-peer communication network for exchanging information among controllers and resilient consensus algorithms for achieving reliable interconnection agreement. The network of 6 microgrids divided from a modified 123-node test distribution feeder is used to demonstrate the effectiveness of the proposed resilient communication scheme.

Vu, Thanh Long↗

DOE OSTI2022

Model-Based Diagnostics and Mitigation of Cyber Threats

The report summarizes key tasks performed to develop a toolkit for detecting cyber-attack events in instrumentation and control (I&C) systems of nuclear power plants. The toolkit connects the state-of-the-art GPWR Simulator with the RELAP5 code providing best-estimate nuclear steam supply system (NSSS) analyses, via the application programming interface (API), and allows users to introduce potential cyber-attack scenarios into power plant operational simulation. This summary for the project reflects topical reports submitted during the project as well as a journal paper published in 2022. The focus areas of the summary include: (1) modeling I&C systems for the AP1000 Generation III+ nuclear plant and GPWR simulator, (2) simulation and monitoring of plant response to cyber-attack events, (3) API structure for the toolkit interfacing the GPWR simulator and RELAP5 code, and (4) restructuring of the three-loop NSSS software of GPWR to model the two-loop AP1000 structure. Discussed in some details are (a) the attack tree analysis assessing the susceptibility of the AP1000 I&C system, resulting in reactor trips, in terms of the attack possibility and component sensitivity and (b) realistic estimation of the time to steam generator trip due to cyber-intrusions in the GPWR Simulator. Finally, sample demonstrations of the cyber-security tool kit, in the form of the GPWR-RELAP5 API, are summarized.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

DOE OSTI2020

Why does cyber deterrence fail and when might it succeed? A framework for cyber scenario analysis

Through cyberattacks on information technology and digital communications systems, antagonists have increasingly been able to alter the strategic balance in their favor without provoking serious consequences. Conflict within and through the cyber domain is inherently different from conflict in other domains that house our critical systems. These differences result in new challenges for defending and creating resilient systems, and for deterring those who would wish to disrupt or destroy them. The purpose of this paper is to further examine the question of whether or not deterrence can be an effective strategy in cyber conflict, given our broad and varied interests in cyberspace. We define deterrence broadly as the creation of conditions that dissuade antagonists from taking unwanted actions because they believe that they will incur unacceptably high costs and/or receive insufficient benefits from taking that action. Deterrence may or may not be the most credible or effective strategy for achieving our desired end states in cybersecurity. Regardless of the answer here, however, it is important to consider why deterrence strategies might succeed under certain conditions, and to understand why deterrence is not effective within the myriad contexts that it appears fail. Deterrence remains a key component of U.S. cyber strategy, but there is little detail on how to operationalize or implement this policy, how to bring a whole-of-government and whole-of- private-sector approach to cyber deterrence, which types of antagonists can or should be deterred, and in which contexts. Moreover, discussion about how nations can and should respond to significant cyber incidents largely centers around whether or not the incident constitutes a "use of force," which would justify certain types of responses according to international law. However, we believe the "use of force" threshold is inadequate to describe the myriad interests and objectives of actors in cyberspace, both attackers and defenders. In this paper, we propose an approach to further examine if deterrence is an effective strategy and under which conditions. Our approach includes systematic analysis of cyber incident scenarios using a framework to evaluate the effectiveness of various activities in influencing antagonist behavior. While we only examine a single scenario for this paper, we propose that additional work is needed to more fully understand how various alternative thresholds constrain or unleash options for actors to influence one another's behavior in the cyber domain.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

DOE OSTI2022

Cybersecurity and Digital Components: Supply Chain Deep Dive Assessment

The report “America’s Strategy to Secure the Supply Chain for a Robust Clean Energy Transition” lays out the challenges and opportunities faced by the United States in the energy supply chain as well as the federal government plans to address these challenges and opportunities. It is accompanied by several issue-specific deep dive assessments, including this one, in response to Executive Order 14017 “America’s Supply Chains,” which directs the Secretary of Energy to submit a report on supply chains for the energy sector industrial base. The Executive Order is helping the federal government to build more secure and diverse U.S. supply chains, including energy supply chains. As the energy sector has become more globalized and increasingly complex, digitized, and even virtualized, its supply chain risk for digital components – the software, virtual platforms and services, and data – in energy systems has evolved and expanded. All digital components in U.S. energy sector systems are vulnerable and may be subject to cyber supply cha in risks stemming from a variety of threats, vulnerabilities, and impacts. This includes digital components in all systems within the ESIB, namely those systems operated by asset owners across different energy subsectors (e.g., electricity, oil and natural gas, and renewables) and the systems operated by a worldwide industrial complex with capabilities to perform research and development and design, produce, operate, and maintain energy sector systems, subsystems, components, or parts to meet U.S. energy requirements. Supply chain risks for digital components including software, virtual platforms and services, and data have grown in recent years as increasingly sophisticated cyber adversaries have targeted exploiting vulnerabilities in these digital assets. Supply chain risks for digital components in energy sector systems will continue to evolve and likely increase as these systems are increasingly interconnected, digitized, and remotely operated.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗

DOE OSTI2021

Emergency Voltage Regulation in Power Systems via Ripple-Type Control

With increasing penetrations of volatile renewable generation and cyber-physical disruptions, ensuring the safe operation of bulk power systems has become unprecedentedly challenging. Because communication and computational costs restrict centralized system dispatch to being called upon every few minutes, and because purely local schemes are shown to be insufficient, distributed controls have been advocated for handling unanticipated system conditions in real time. The applicability of distributed control schemes, however, is fundamentally limited by their need for widespread communication and model cognizance. In this context, we put forth a hybrid, low-communication, saturation-driven protocol for the coordination of control agents that are distributed over a physical system and are allowed to communicate with peers over a "hotline" communication network. Under this protocol, when agents observe a constraint violation based on local measurements, they respond locally until their control resources saturate, in which case they send a beacon for assistance to peer agents. The scheme ensures that minor violations are efficiently mitigated via fast local controls, whereas severe violations can be handled by collaboration among a relatively small set of agents. We evaluate the performance of this scheme via numerical tests on the IEEE 14-bus test feeder, where agents act upon noisy measurements under diverse scenarios of load variations and severe low-/high-voltage events.

collaboration↗

DOE OSTI2019

A Context-Centered Research Approach to Phishing and Operational Technology in Industrial Control Systems

Advanced persistent threats (APT’s) that leverage phishing against operational technology (OT) are cyber-attacks that endanger critical infrastructure assets nationwide. Today phishing, a human focused exploit, constitutes 91% of successful attack vectors against Federal assets. This means Human Introduced Vulnerabilities (HICV’s) are the weakest cyber defense link. The success of these attacks also suggests HICV’s are not well understood nor mitigated. To characterize HICV’s and provide the necessary context in which they exist, this paper introduces a research approach derived from the mature science of Social Ecology. The desired end result of this research is an HICV focused risk assessment framework.

Advanced Persistent Threats↗

DOE OSTI2022

Multilayered Network Models for Security: Enhancing System Security Engineering with Orchestration

Security engineering approaches can often focus on a particular domain—physical security, cyber security, or personnel security, for example. Yet, security systems engineering consistently faces challenges requiring socio-technical solutions to address evolving and dynamic complexity. While some drivers of this complexity stem from complex risk environments, innovative adversaries, and disruptive technologies, other drivers are endogenous and emerge from the interactions across security engineering approaches. In response, INCOSE's Systems Security Working Group identified the need to better coordinate “disparate security solutions [that] operate independently” as one of eleven key concepts in their IS21 FuSE Security Roadmap. From this perspective, this need for “security orchestration” aligns with the perspective that security is a property that emerges from interactions within complex systems. Current efforts at Sandia National Laboratories are developing a systems security engineering approach that describes high consequence facility (HCF) security as a multidomain set of interacting layers. The result is a multilayered network (MLN)-based approach that captures the interactions between infrastructure, physical components, digital components, and humans in nuclear security systems. This article will summarize the MLN-based approach to HCF security and describe two preliminary results demonstrating potential benefits from incorporating interactions across disparate security solutions. Here, leveraging the logical structure of networks, this MLN model-based approach provides an example of how security orchestration provides enhanced systems security engineering solutions.

42 ENGINEERING↗

DOE OSTI2021

A Cyber Threat Mitigation Approach For Wide Area Control of SVCs using Stability Monitoring

We propose a stability monitoring approach for the mitigation of cyber threats directed at the wide area control (WAC) system used for coordinated control of Flexible AC Transmission Systems (FACTS) used for power oscillation damping (POD) of active power flow on inter-area tie lines. The approach involves monitoring the modes of the active power oscillation on an inter-area tie line using the Matrix Pencil (MP) method. We use the stability characteristics of the observed modes as a proxy for the presence of destabilizing cyber threats. We monitor the system modes to determine whether any destabilizing modes appear after the WAC system engages to control the POD. If the WAC signal exacerbates the POD performance, the FACTS falls back to POD using local measurements. The proposed approach does not require an expansive system-wide view of the network. We simulate replay, control integrity, and timing attacks for a test system and present results that demonstrate the performance of the SM approach for mitigation.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2022

Cyber Infrastructure for the Smart Electric Grid

As electric power systems undergo a transformative upgrade with the integration of advanced technologies to enable the smarter electric grid, professionals who work in the area require a new understanding of the evolving complexity of the grid. Cyber Infrastructure for the Smart Electric Grid delivers a comprehensive overview of the fundamental principles of smart grid operation and control, smart grid technologies, including sensors, communication networks, computation, data management, and cyber security, and the interdependencies between the component technologies on which a smart grid's security depends. The book offers readers the opportunity to critically analyze the smart grid infrastructure needed to sense, communicate, compute, and control in a secure way.

communication networks↗

DOE OSTI2020

Quantized Constant-Q Gabor Atoms for Sparse Binary Representations of Cyber-Physical Signatures

Increased data acquisition by uncalibrated, heterogeneous digital sensor systems such as smartphones present new challenges. Binary metrics are proposed for the quantification of cyber-physical signal characteristics and features, and a standardized constant-Q variation of the Gabor atom is developed for use with wavelet transforms. Two different continuous wavelet transform (CWT) reconstruction formulas are presented and tested under different signal to noise ratio (SNR) conditions. A sparse superposition of Nth order Gabor atoms worked well against a synthetic blast transient using the wavelet entropy and an entropy-like parametrization of the SNR as the CWT coefficient-weighting functions. The proposed methods should be well suited for sparse feature extraction and dictionary-based machine learning across multiple sensor modalities.

46 - INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AN↗

NASA NTRS1984

Research in computer science

Several short summaries of the work performed during this reporting period are presented. Topics discussed in this document include: (1) resilient seeded errors via simple techniques; (2) knowledge representation for engineering design; (3) analysis of faults in a multiversion software experiment; (4) implementation of parallel programming environment; (5) symbolic execution of concurrent programs; (6) two computer graphics systems for visualization of pressure distribution and convective density particles; (7) design of a source code management system; (8) vectorizing incomplete conjugate gradient on the Cyber 203/205; (9) extensions of domain testing theory and; (10) performance analyzer for the pisces system.

Ortega, J. M.↗

DOE OSTI2024

Anomaly Detection and Mitigation for Dynamic Frequency Regulation in Hydropower-Battery Systems

Hydropower operators and energy storage providers are increasingly interested in participating in frequency regulation services, driven by the incentives offered by independent system operators, such as the PJM Interconnection. This transition, however, unfolds against the backdrop of a modernizing and rapidly digitizing power grid, exposing the integrated legacy infrastructure to a multitude of cybersecurity threats. This work presents an approach for developing an anomaly detection and mitigation system to address cybersecurity challenges during the participation of a hydropower-integrated battery energy storage system (BESS) in a frequency regulation market. The applied anomaly detector utilizes machine learning algorithms to provide detailed classification of cyber-physical events. Later, the applied mitigation system triggers predefined corrective actions to minimize the impact of data integrity attacks on the regulation market and system stability. We evaluated the proposed approach on a hydropower-integrated BESS topology, specifically analyzing the slow regulation signal (Reg A) coming from the PJM market. Our simulation results demonstrate that the proposed approach performs well in detecting data integrity attacks within the allocated time frame and also minimizes the system's transient instability during the participation of hydropower and BESS in the regulation market.

battery energy storage system↗

DOE OSTI2021

Companion Assisted Software Based Remote Attestation in SCADA Networks

Critical infrastructure such as power generation and water distribution systems have become a priority target in cyber warfare because of their recent computerization and introduction to the internet. As a result, Supervisory Control and Data Acquisition (SCADA) system security has become a hot topic in academic and industrial research. Among these topics, Remote Attestation is a security method intended to detect the presence of fileless malware in remote devices as they continue to operate. This allows for the detection of malware in the absence of long-term storage artifacts before symptoms of compromise begin to appear. In general, a trusted device (the verifier) makes a request for evidence of innocence from the untrusted device (the prover). In software-based schemes, the verifier can then measure the delay between its request and the prover’s response. If this delay is greater than the known computational time of the evidence gathering algorithm performed by the prover, then evidence may have been forged. Multi-hop networks often introduce too much network jitter to allow accurate measurement of prover response time, which limits the effectiveness of software based Remote Attestation in a real-world setting. In this work, we introduce a companion device that the verifier can trust to perform a subset of attestation, thereby removing any network jitter. This device is a Field Programmable Gate Array (FPGA) that is physically connected to the prover. We provide a communication protocol between the verifier, prover, and companion. To evaluate our scheme, we simulate it in a common SCADA network environment under normal and heavy traffic loads. Our simulations are performed in the discrete event network simulator NS-3, and we perform statistical analysis over our results to show that our scheme allows for tight timing constraints to be placed on the prover such that the verifier can more easily determine the validity of the evidence that it receives.

Johnson, William A.↗

DOE OSTI2020

HIDES: Hybrid Intrusion Detector for Energy Systems

The establishment of a resilient electric grid accompanied by a secure communications network is an ongoing battle as advanced persistent threats continue to exploit existing vulnerabilities in legacy supervisory control and data acquisition system (SCADA) infrastructure. Traditional intrusion detection systems (IDSs) lack consistent performance because of the continuously evolving attack surface of SCADA systems. These shortcomings can be overcome by integrating logical system behavior, protocol-specific knowledge, and data-based learning to develop a comprehensive IDS solution. In this paper, we present a Hybrid Intrusion Detector for Energy Systems by integrating a network-based IDS, state-of-the-art machine learning-based IDS, and model-based IDS to detect unknown and stealthy cyberattacks targeting the SCADA networks. The proposed IDS uses synchrophasor measurements and cyber logs to learn patterns of different scenarios based on spatiotemporal behaviors of power systems. As a proof of concept, we implement and validate the proposed IDS by leveraging resources available at the National Renewable Energy Laboratory's Energy Systems Integration Facility test bed. Experimental results show promising performance in detecting cyberattacks while providing realtime visualization of power system measurements and cyber logs.

machine-learning intrusion detection system↗

NASA NTRS2022

Application Table: A Bridge Connecting the Designing “With-The-Material” and “The-Material” Paradigms

Over the last few decades, advances in high-performance computing, new material characterization methods, and, more recently, an emphasis on integrated computational materials engineering (ICME) have been a catalyst for multiscale modeling and simulation-based design of materials and structures in the aerospace industry. In 2016 NASA sponsored a 2040 Vision study (which appeared in 2018) to define the potential 25-year future state required for integrated multiscale modeling of materials and systems (e.g., load-bearing structures) to accelerate the pace and reduce the expense of innovation in future aerospace and aeronautical systems. The study envisions a cyber-physical-social ecosystem comprised of experimentally verified and validated (V & V) computational models, tools, and techniques, along with the associated digital tapestry, that impacts the entire supply chain to enable cost-effective, rapid, and revolutionary design of “fit-for-purpose” materials, components, and systems. Consequently, the development of a robust information management system that incorporates (across the full life cycle) both experimental (real data) and virtual data resulting from the application of various simulation tools (at single or multiple length scales), therefore enabling the virtual design and optimization of materials throughout their processing – internal structure – property – performance envelope, has become critical. This need is also fueled by the demands for higher efficiency in material testing; consistency, quality, and traceability of data; product design; engineering analysis; as well as control of access to proprietary or sensitive information. This is particularly true when attempting to merge ICME practices with recent additive manufacturing technology which will enable production of the resulting 2040 Vision material and structural designs. At NASA Glenn Research Center we are exploring the future of material science through the use of novel characterization methodologies, high performance computing, and recently an emphasis on integrated computational materials engineering (ICME). Herein, recent efforts to incorporate an Application Table within NASA Glenn Research Center’s ICME Granta MI database is presented. The goal is to provide a place where material and structural application information/requirements can be linked so as to marry the “design the-material” and the “design-with-material” paradigms and thereby enable application-driven design and optimization of materials and structures by providing a central location that links material processing at various length scales to the application’s performance requirements. This paper discusses the specifics of this Application Table as well as best practices and key principles for the development of a robust materials information management system to enable the 2040 Vision integrated materials and structures ecosystem. Furthermore, it presents the intended role of the Application Table in the future of ICME design of “fit-for-purpose” materials, showing the need for a well-established framework that can successfully bridge the gap between the design “the material” and design “with-the-material” paradigms.

Materials↗

NASA NTRSDate not supplied

Application Table: A Bridge Connecting the Designing “With-the-Material” and “the-Material”

Over the last few decades, advances in high-performance computing, new material characterization methods, and, more recently, an emphasis on integrated computational materials engineering (ICME) have been a catalyst for multiscale modeling and simulation-based design of materials and structures in the aerospace industry. In 2016 NASA sponsored a 2040 Vision study (which appeared in 2018) to define the potential 25-year future state required for integrated multiscale modeling of materials and systems (e.g., load-bearing structures) to accelerate the pace and reduce the expense of innovation in future aerospace and aeronautical systems. The study envisions a cyber-physical-social ecosystem comprised of experimentally verified and validated (V & V) computational models, tools, and techniques, along with the associated digital tapestry, that impacts the entire supply chain to enable cost-effective, rapid, and revolutionary design of “fit-for-purpose” materials, components, and systems. Consequently, the development of a robust information management system that incorporates (across the full life cycle) both experimental (real data) and virtual data resulting from the application of various simulation tools (at single or multiple length scales), therefore enabling the virtual design and optimization of materials throughout their processing – internal structure – property – performance envelope, has become critical. This need is also fueled by the demands for higher efficiency in material testing; consistency, quality, and traceability of data; product design; engineering analysis; as well as control of access to proprietary or sensitive information. This is particularly true when attempting to merge ICME practices with recent additive manufacturing technology which will enable production of the resulting 2040 Vision material and structural designs. At NASA Glenn Research Center we are exploring the future of material science through the use of novel characterization methodologies, high performance computing, and recently an emphasis on integrated computational materials engineering (ICME). Herein, recent efforts to incorporate an Application Table within NASA Glenn Research Center’s ICME Granta MI database is presented. The goal is to provide a place where material and structural application information/requirements can be linked so as to marry the “design the-material” and the “design-with-material” paradigms and thereby enable application-driven design and optimization of materials and structures by providing a central location that links material processing at various length scales to the application’s performance requirements. This paper discusses the specifics of this Application Table as well as best practices and key principles for the development of a robust materials information management system to enable the 2040 Vision integrated materials and structures ecosystem. Furthermore, it presents the intended role of the Application Table in the future of ICME design of “fit-for-purpose” materials, showing the need for a well-established framework that can successfully bridge the gap between the design “the material” and design “with-the-material” paradigms.

Materials↗

NASA NTRS1983

ADAM: An Axisymmetric Duct Aeroacoustic Modeling system

An interconnected system of computer programs for analyzing the propagation and attenuation of sound in aeroengine ducts containing realistic compressible subsonic mean flows, ADAM was developed primarily for research directed towards the reduction of noise emitted from turbofan aircraft engines. The two basic components are a streamtube curvature program for determination of the mean flow, and a finite element code for solution of the acoustic propagation problem. The system, which has been specifically tailored for ease of use, is presently installed at NASA Langley Reseach Center on a Control Data Cyber 175 Computer under the NOS Operating system employing a Tektronix terminal for interactive graphics. The scope and organization of the ADAM system is described. A users guide, examples of input data, and results for selected cases are included.

Abrahamson, A. L.↗

DOE OSTI2024

Component Criticality in BESS for Cybersecurity

Battery energy storage systems (BESS), inverters, and associated digital equipment are integral pieces of interdependent energy delivery systems. When considering the supply chain security of such systems, there is often a misplaced focus on the origin of energy generation and storage materials like battery cells, overlooking the more significant cyber risks that stem from digital power electronics control systems. Part of this misplaced focus is due to the relative costs of these components, with more attention given to expensive raw materials rather than the impactful digital elements themselves. The Idaho National Laboratory (INL) is addressing this gap in supply chain security through a systems-of-systems approach that considers the impact various components in digital energy systems can have should misoperation occur. Therefore, INL assigns a cyber criticality score based on quantitative analysis, which enables informed prioritization of mitigations and allows operators to reduce risk in light of the prevalence of a BESS and associated systems foreign supply chain.

25 ENERGY STORAGE↗