Search NASA⌕ Search

SEARCH · Search NASA

Results for “detection”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 73 records · Page 4
All sourcesNASA NTRSDOE OSTI
DOE OSTI2025

Rare Earth Element Detection and Quantification in Coal and Rock Mineral Matrices

As global demand for rare earth elements (REEs) increases, maintaining the production and supply chain is critical. Technologies capable of being used in the field and in situ in the subsurface for rapid REE detection and quantification facilitates the efficient mining of known resources and exploration of new and unconventional resources. Laser-induced breakdown spectroscopy (LIBS) is a promising technique for rapid elemental analysis both in the laboratory and in the field. Multiple articles have been published evaluating LIBS for detection and quantification of REEs; however, REEs in their natural deposits have not been adequately studied. In this work, detection and quantification of two REEs, La and Nd, have been studied in both synthetic and natural mineral matrices at concentrations relevant to REE extraction. Measurements were performed on REE-containing rock and coal samples (natural and synthetic) utilizing different LIBS instruments and techniques, specifically a commercial benchtop instrument, a custom benchtop instrument (single- and double-pulse modes), and a custom LIBS probe currently being developed for in situ, subsurface, borehole wall detection and quantification of REEs. Plasma expansion, emission intensity, detection limits, and double-pulse signal enhancement were studied. The limits of detection (LOD) were found to be 10/14 ppm for La and 15/25 ppm for Nd in simulated coal/rock matrices in single-pulse mode. Signal enhancement of 3.5 to 6-fold was obtained with double-pulse mode as compared to single-pulse operation.

La detection↗
DOE OSTI2025

Subspace-Driven Learning for Anomaly Detection in Process Transients

Nuclear power plant (NPP) monitoring and diagnostic centers are actively investigating and implementing automated anomaly detection algorithms to help plants catch anomalies sooner, thereby preventing or reducing the duration of unexpected shutdowns. Current machine learning-based anomaly detection methods are expected to be highly effective during stable, full-power operations because NPPs typically operate as baseload power generators, meaning there are extensive operating data available from plant equipment. However, it is expected that anomaly detection methods will face significant challenges during transient conditions (i.e., when power output falls below full power) because plants only occasionally operate at these lower power levels, generating sparse transient operational data, and resulting in false alarms or missed detections. Here, to address this issue, transfer learning is used, which for this problem leverages knowledge (in the form of learned features) from stable, full-power operations to improve detection accuracy during transient conditions, even with limited data. In this effort, a novel subspace approach is developed to transfer a subset of the data features from full power operation to transients. This approach is validated through experiments using synthetic data and was found to outperform two baseline transfer learning approaches in anomaly detection performance across a range of amounts of transient data used in the training process.

46 - INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AN↗
DOE OSTI2024

Comparison of Sub-Ppm Instrument Response Suggests Higher Detection Limits Could Be Used to Quantify Methane Emissions from Oil and Gas Infrastructure

Quantifying and controlling fugitive methane emissions from oil and gas facilities remains essential for addressing climate goals, but the costs associated with monitoring millions of production sites remain prohibitively expensive. Current thinking, supported by measurement and simple dispersion modelling, assumes single-digit parts-per-million instrumentation is required. To investigate instrument response, the inlets of three trace-methane (sub-ppm) analyzers were collocated on a facility designed to release gas of known composition at known flow rates between 0.4 and 5.2 kg CH 4 h –1 from simulated oil and gas infrastructure. Methane mixing ratios were measured by each instrument at 1 Hertz resolution over nine hours. While mixing ratios reported by a cavity ring-down spectrometer (CRDS)-based instrument were on average 10.0 ppm (range 1.8 to 83 ppm), a mid-infrared laser absorption spectroscopy (MIRA)-based instrument reported short-lived mixing ratios far larger than expected (range 1.8 to 779 ppm) with a similar nine-hour average to the CRDS (10.1 ppm). We suggest the peaks detected by the MIRA are likely caused by a micrometeorological phenomenon, where vortex shedding has resulted in heterogeneous methane plumes which only the MIRA can observe. Further analysis suggests an instrument like the MIRA (an optical-cavity-based instrument with cavity size ≤10 cm3 measuring at ≥2 Hz with air flow rates in the order of ≤0.3 slpm at distances of ≤20 m from the source) but with a higher detection limit (25 ppm) could detect enough of the high-concentration events to generate representative 20 min-average methane mixing ratios. Even though development of a lower-cost, high-precision, high-accuracy instrument with a 25 ppm detection threshold remains a significant problem, this has implications for the use of instrumentation with higher detection thresholds, resulting in the reduction in cost to measure methane emissions and providing a mechanism for the widespread deployment of effective leak detection and repair programs for all oil and gas infrastructure.

03 NATURAL GAS↗
DOE OSTI2026

Deep Learning and Photogrammetric Reconstruction for Automated Crack Detection and Dimensional Measurement in Mining Operations

Surface crack detection and dimensional measurement at active mining sites present significant safety and operational challenges. Manual inspection methods are labor-intensive, spatially incomplete, and expose personnel to hazardous environments, while existing automated approaches have been developed primarily for concrete civil infrastructure and have not been validated on the complex, variable surfaces characteristic of mining environments. This dissertation presents an automated pipeline that integrates deep learning semantic segmentation with Structure-from-Motion photogrammetry to detect surface cracks and measure their aperture, length, and vertical displacement from standard RGB imagery acquired during routine Uncrewed Aerial Vehicle (UAV) survey operations, without requiring additional sensor hardware or manual measurement. The pipeline combines a U-Net architecture with an EfficientNet-B0 encoder, pretrained on the SDNET2018 concrete crack dataset and fine-tuned on a mining-specific dataset spanning laboratory concrete specimens, coal refuse impoundment embankments, and post-blast limestone quarry benches. Photogrammetric reconstruction is performed using COLMAP Structure-from-Motion and Multi-View Stereo, with crack segmentation masks projected into the reconstructed point cloud to enable three-dimensional vertical displacement measurement through local plane fitting and bimodal surface detection. The pipeline was validated across 36 controlled laboratory specimens at three imaging distances and four vertical displacement levels, achieving aperture measurement RMSE of 0.047 cm and R² of 0.954, and vertical displacement RMSE of 0.140 cm and R² of 0.966, against independent caliper measurements. Field application at a coal refuse impoundment in southwestern Pennsylvania detected 71 crack components across the embankment crest, with a dominant longitudinal crack exhibiting aperture values reaching 28 cm and a 95th percentile vertical displacement of 35.53 cm, consistent in magnitude and spatial distribution with simultaneously acquired LiDAR-derived estimates. Application across four post-blast limestone quarry bench datasets in California successfully characterized blast-induced fracture networks at ground sampling distances ranging from 0.59 to 1.23 cm/pixel, with detected crack geometries physically consistent with observable surface conditions at each site. The results demonstrate that deep learning-based crack detection and photogrammetric measurement can be integrated into routine UAV inspection workflows at mining sites, providing repeatable, scalable, and quantitative crack characterization across surface types, crack scales, and displacement magnitudes not previously addressed in the literature. The pipeline requires no dedicated surveying equipment beyond the UAV platforms already deployed at mine sites for survey and monitoring purposes, supporting practical adoption within existing operational workflows.

Crack detection, Dimensional Measurement↗
DOE OSTI2025

Detecting Process Equipment Failures Using Acoustic Data and Machine Learning

Nuclear power plant (NPP) process equipment such as fans, motors, valves, and pumps generate frequent or continuous noise, and deviations from the normal operational sounds made by this equipment can indicate potential issues. These deviations can be identified via automated acoustic anomaly detection, which involves using acoustic sensors (i.e., microphones) alongside detection algorithms to continuously monitor for changes in acoustic signatures. This task is made challenging by the substantial background noise that exists, such as operators opening and closing doors, manipulating valves, and conversing—in addition to typical plant noises. In collaboration with a nuclear power utility partner, this effort assessed the efficacy of acoustic anomaly detection when using a specific acoustic sensor that compresses data into a fixed set of features that are transferable over a standard Internet of Things communication protocol, thereby improving usability but potentially degrading detection performance. Two methods of performing automated acoustic anomaly detection were evaluated: one-class support vector machine (OC-SVM) and isolation forest (iForest). To enable the use of high-quality acoustic data encompassing both normal and anomalous conditions, the study utilized the publicly available Malfunctioning Industrial Machine Investigation and Inspection dataset, which includes real measured acoustic sensor data for a range of equipment types, model numbers, and signal-to-noise ratios (SNRs), along with a benchmark set of detection results. Using this dataset, the methods were tested and then compared against the benchmark results. The results indicated that although the specific acoustic sensor did not enable as rich a feature set extraction, the proposed methods with the limited feature set performed just as well. This provides solid justification for both the methods and the use of the proposed acoustic sensor.

46 - INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AN↗
DOE OSTI2025

Hyper Spectral Anomaly Detection

Anomaly detection is a common machine learning (ML) task with growing importance in the fields of imaging, quality assurance, and multiple security related disciplines. Anomaly detection is more difficult than traditional machine learning methods due to the inherent unlabeled nature of the datasets. Existing anomaly detection architectures commonly face challenges with explainability, retaining information related to the relational structure of the data, and false positive rates. Hyperspectral Imaging Anomaly Detection (HSI) is a statistical model that employs vertex and edge weighted graphs to preserve the data’s relationships on different topographical scales. The model is able to generalize from anomaly detection in 2D images to novel datasets related to cyber-security. Furthermore, the use of multi-spectral and other filtering methods results in fewer false positives and increases the explainability of model predictions. When applying HSI to cyber-security datasets, we are able to successfully detect malicious activity with a relatively high degree of accuracy.

97 - MATHEMATICS AND COMPUTING↗
DOE OSTI2025

Spatiotemporal pattern detection, generation, and computation with circuits

Abstract Implementations of neurons, delays, and synapse circuits are presented with simulations. These neural elements are used to create two small spiking neural networks, the Rate-Window and Order-Biased clusters, which are capable of detecting simple two-spike spatiotemporal patterns. A simple pattern detecting network (SPDN) is created by combining the Rate-Window and Order-Biased clusters, where clusters are small spiking neural networks, and its simple pattern detection ability is demonstrated in simulation. The SPDN is used to implement a complex pattern detecting network (CPDN) and its complex pattern detection ability is demonstrated in simulation. Methods for generating arbitrary spatiotemporal patterns are presented. The CPDN and spatiotemporal pattern generation methods are then used to implement a novel spatiotemporal computing paradigm based on detecting and responding to spatiotemporal symbols. A simulation of a spatiotemporal half adder is presented to demonstrate the computing paradigm.

97 - MATHEMATICS AND COMPUTING↗
DOE OSTI2024

Autoencoder-Based Anomaly Detection System for Online Data Quality Monitoring of the CMS Electromagnetic Calorimeter

The CMS detector is a general-purpose apparatus that detects high-energy collisions produced at the LHC. Online data quality monitoring of the CMS electromagnetic calorimeter is a vital operational tool that allows detector experts to quickly identify, localize, and diagnose a broad range of detector issues that could affect the quality of physics data. A real-time autoencoder-based anomaly detection system using semi-supervised machine learning is presented enabling the detection of anomalies in the CMS electromagnetic calorimeter data. A novel method is introduced which maximizes the anomaly detection performance by exploiting the time-dependent evolution of anomalies as well as spatial variations in the detector response. The autoencoder-based system is able to efficiently detect anomalies, while maintaining a very low false discovery rate. The performance of the system is validated with anomalies found in 2018 and 2022 LHC collision data. In addition, the first results from deploying the autoencoder-based system in the CMS online data quality monitoring workflow during the beginning of Run 3 of the LHC are presented, showing its ability to detect issues missed by the existing system.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
DOE OSTI2025

Evaluation of a high-throughput method for processing sponge-stick samples to detect viable, non-spore-forming biothreat agents

After a bioterrorism incident, surface sampling is often used to determine the extent of contamination and exposure, guiding decontamination efforts and decisions for re-occupancy of affected sites. The sponge-stick (SS) is a preferred and commonly used device for sample collection to detect both spore-forming and non-spore-forming biothreat agents from non-porous surfaces. Here, in this study, a recently developed high-throughput method (HTM) for processing SS samples to detect viable Bacillus anthracis spores was adapted for detection of non-spore-forming biothreat agents, Yersinia pestis and Francisella tularensis. The scalable HTM was used to process up to 20 SS samples simultaneously, compared to the current stomacher-based method which processes one SS at a time. Comparisons of the HTM and the stomacher-based method were statistically indistinguishable for most experiments (P > 0.05) with HTM recoveries of 37–60 % for Y. pestis inoculated at 102–103 cells/SS and held 48 h at 4 °C to mimic sample transport/storage. The HTM was integrated with Rapid Viability-Polymerase Chain Reaction (RV-PCR) analysis to detect viable Y. pestis in the presence of particulate contamination (Arizona Test Dust, ATD). This approach detected Y. pestis inoculated at 20 cells/SS and ATD did not impact detection (P > 0.05). F. tularensis showed significantly lower recoveries between no-hold time and 48-h hold time (4 °C, P < 0.05) using the HTM, which further testing showed could be due to toxicity of the neutralizing buffer used for SS pre-wetting. With modifications, this method could enhance throughput capacity while maintaining similar recovery efficiencies to current methods for other non-spore-forming bacterial pathogens.

Biological and medical sciences↗
DOE OSTI2024

Summertime Continental Shallow Cumulus Cloud Detection Using GOES‐16 Satellite and Ground‐Based Ceilometer at North Alabama

Abstract Accurate simulations of boundary layer cloud processes remain challenging in Earth system modeling. Observations are essential to evaluate and improve models of such processes. This study introduces a comprehensive validation framework for a satellite‐based detection algorithm of continental shallow cumulus (ShCu) clouds during the daytime, which was initially developed using ground‐based observations of stereo cameras at the Department of Energy Atmospheric Radiation Measurement (ARM) Southern Great Plains site (J. Tian et al., 2021, https://doi.org/10.3390/rs13122309 , 2022, https://doi.org/10.1029/2021gl097070 ). To validate this algorithm, the framework employs ground‐based ceilometer measurements from North Alabama (NA) where ShCu populations are prevalent. This study first generates clear‐sky surface reflectance maps at NA and identifies ShCu pixels with a detection threshold using Geostationary Operational Environmental Satellite (GOES) reflectance data. The obtained cloud fractions (CFs) are then compared against CFs from a ground‐based ceilometer, considering factors such as observed area differences, satellite parallax issue, and systematic biases. We found that with a detection threshold (∆R) of 0.05, the ShCu detection algorithm is effective for NA, enabling the reproduction of hourly ShCu CFs using GOES. Our framework is straightforward and easily repeatable to evaluate the effectiveness of a ∆R threshold for detecting ShCu clouds in various geographic regions where ceilometers are deployed. This satellite detection of ShCu provides a crucial regional context for ground‐based measurements, facilitating the tracking of convection initiation and its coupling with land surface conditions. Integrating localized ground‐based and regional satellite data will enhance our ability to conduct thorough studies of cloud morphology and land‐atmosphere interactions in North Alabama.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2025

Air, surface, and wastewater surveillance of SARS-CoV-2; a multimodal evaluation of COVID-19 detection in a built environment

Environmental surveillance of infectious organisms holds tremendous promise to reduce human-to-human transmission in indoor spaces through early detection. In this study we determined the applicability and limitations of wastewater, indoor high-touch surfaces, in-room air, and rooftop exhaust air sampling methods for detecting SARS-CoV-2 in a real world building occupied by residents recently diagnosed with COVID-19. We concurrently examined the results of three 24-hour environmental surveillance techniques, indoor surface sampling, exhaust air sampling and wastewater surveillance, to the known daily census fluctuations in a COVID-19 isolation dormitory. Additionally, we assessed the ability of aerosol samplers placed in the large volume lobby to detect SARS-CoV-2 multiple times per day. Our research reveals an increase in the number of individuals confirmed positive with COVID-19 as well as their estimated human viral load to be associated with statistically significant increases in viral loads detected in rooftop exhaust aerosol samples (p = 0.0413), wastewater samples (p = 0.0323,), and indoor high-touch surfaces (p < 0.001)). We also report that the viral load detected in lobby aerosol samples was statistically higher in samples collected during presence of occupants whose COVID-19 diagnostic tests were confirmed positive via qPCR compared to periods when the lobby was occupied by either contact-traced (suspected positive) individuals or during unoccupied periods (p = 0.0314 and <2e–16). We conclude that each daily (24h) surveillance method, rooftop exhaust air, indoor high-touch surfaces, and wastewater, provide useful detection signals for building owner/operator(s). Furthermore, we demonstrate that exhaust air sampling can provide spatially resolved signals based upon ventilation exhaust zones. Additionally, we find that indoor lobby air sampling can provide temporally resolved signals useful during short duration sampling periods (e.g., 2-4 hours) even with intermittent occupancy by occupants diagnosed with COVID-19.

60 APPLIED LIFE SCIENCES↗
DOE OSTI2026

Detection and imaging of chemicals and hidden explosives using terahertz time-domain spectroscopy and deep learning

Detecting concealed chemicals and explosives remains a critical challenge in global security. Terahertz time-domain spectroscopy (THz-TDS) offers a promising non-invasive and stand-off detection technique owing to its ability to penetrate optically opaque materials without causing ionization damage. While many chemicals exhibit distinct spectral features in the terahertz range, conventional terahertz-based detection methods often struggle in real-world environments, where variations in sample geometry, thickness, and packaging can lead to inconsistent spectral responses. In this study, we present a chemical imaging system that integrates THz-TDS with deep learning to enable accurate pixel-level identification and classification of different explosives. Operating in reflection mode and enhanced with plasmonic nanoantenna arrays, our THz-TDS system achieves a peak dynamic range of 96 dB and a detection bandwidth of 4.5 THz, supporting practical, stand-off operation. By analyzing individual time-domain pulses with deep neural networks, the system exhibits strong resilience to environmental variations and sample inconsistencies. Blind testing across eight chemicals—including pharmaceutical excipients and explosive compounds—resulted in an average classification accuracy of 99.42% at the pixel level. Notably, the system maintained an average accuracy of 88.83% when detecting explosives concealed under opaque paper coverings, demonstrating its robust generalization capability. These results highlight the potential of combining advanced terahertz spectroscopy with neural networks for highly sensitive and specific chemical and explosive detection in diverse and operationally relevant scenarios.

Imaging and sensing↗
DOE OSTI2024

Automatic detection of methane emissions in multispectral satellite imagery using a vision transformer

Curbing methane emissions is among the most effective actions that can be taken to slow down global warming. However, monitoring emissions remains challenging, as detection methods have a limited quantification completeness due to trade-offs that have to be made between coverage, resolution and detection accuracy. Here we show that deep learning can overcome the trade-off in terms of spectral resolution that comes with multi-spectral satellite data, resulting in a methane detection tool with global coverage and high temporal and spatial resolution. We compare our detections with airborne methane measurement campaigns, which suggests that our method can detect methane point sources in Sentinel-2 data down to plumes of 0.01 km 2 , corresponding to 200 to 300 kg CH 4 /h -1 sources. Our model shows an order of magnitude improvement over the state-of-the-art, providing a significant step towards the automated, high resolution detection of methane emissions at a global scale, every few days.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2024

A portable and reusable sensor system based on graphene for real-time and sensitive detection of lead ions in water

Long-term exposure to Pb 2+ can cause irreversible damage to the nervous, cardiovascular, and reproductive systems. Therefore, developing a fast and sensitive detection system capable of monitoring minuscule concentrations of Pb 2+ is essential. In this study, we demonstrated a fully portable sensor system enabling rapid, sensitive, and real-time monitoring of Pb 2+ . The sensor system adopted the remote-gate field-effect transistor (RGFET) detection scheme and was easy to operate, even for non-experts. The sensor system comprised two printed circuit boards (PCBs): a sensor PCB with a remote-gate electrode and an analyzer PCB with a metal-oxide-semiconductor field-effect transistor (MOSFET) transducer and peripheral electronics to manage sensor signals. To achieve a high sensitivity for Pb 2+ , we utilized graphene ink drop-casted on the sensor PCB as a sensing membrane. The graphene film was easy to deposit and remove, enabling the sensor PCB to be reused multiple times. The sensor system was further linked to a smartphone application that instantly monitors the sensor response, allowing for rapid point-of-use detection. The sensor exhibited a high sensitivity of 21.7% when the limit of detection (LOD) value of 1 nM (∼0.2 ppb) was detected, and the typical detection time for each sample was approximately 60 seconds. This portable sensor system advances sensing technologies and could potentially supplement expensive, laborious conventional sensing equipment.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2024

Electron cyclotron emission detection of neoclassical tearing modes for control for ITER

Successful operation of ITER requires control of magnetic instabilities including neoclassical tearing modes (NTMs) that can degrade confinement and lead to disruption. Low latency detection by electron cyclotron emission (ECE) diagnostics has been demonstrated in a few current experiments. Using a synthetic diagnostic, we demonstrate low latency NTM detection for ITER with plasmas described by ITER IMAS database scenarios and with realistic limitations imposed on the instrumentation by these high temperature scenarios. 2/1 NTMs are detected 430 ms after magnetic island seeding and before island locking. The radiometer configuration was optimized using simulation, and the smallest detectable island size was explored. Island sizes of ∼3 cm are detectable at the 2/1 surface. The simulated signals incorporate recent physics models for island growth and rotation, which show early locking and continued island growth after locking and before disruption. This work determines limits for ITER ECE spatial resolution imposed by relativistic broadening of channels, which informs hardware design. Real-time detection is demonstrated in hardware that is required by ITER, including on an NI PXI-7853R FPGA system. Development of a synthetic diagnostic and details of the hardware will be discussed.

Cyclotron radiation↗
DOE OSTI2024

On the detectability of the moving lens signal in CMB experiments

Abstract Upcoming cosmic microwave background (CMB) experiments are expected to detect new signals probing interaction of CMB photons with intervening large-scale structure. Among these the moving-lens effect, the CMB temperature anisotropy induced by cosmological structures moving transverse to our line of sight, is anticipated to be measured to high significance in the near future. In this paper, we investigate two possible strategies for the detection of this signal: pairwise transverse-velocity estimation and oriented stacking. We expand on previous studies by including in the analysis realistic simulations of competing signals and foregrounds. We confirm that the moving lens effect can be detected at ≥ 10σlevel by a combination of CMB-S4 and LSST surveys. We show that the limiting factors in the detection depend on the strategy: for the stacking analysis, correlated extragalactic foregrounds, namely the cosmic infrared background and thermal Sunyaev Zel'dovich effect, play the most important role. The addition of foregrounds make the signal-to-noise ratio be most influenced by large and nearby objects. As for the pairwise detection, halo lensing and pair number counts are the main issues. In light of our findings, we elaborate on possible strategies to improve the analysis approach for the moving lens detection with upcoming experiments. We also deliver to the community all the simulations and tools we developed for this study.

Astronomy & Astrophysics↗
DOE OSTI2025

Reducing Communication Overhead in Federated Learning for Network Anomaly Detection with Adaptive Client Selection

Communication overhead in federated learning (FL) poses a significant challenge for network anomaly detection systems, where the myriad of client configurations and network conditions can severely impact system efficiency and detection accuracy. While existing approaches attempt to address this through individual optimization techniques, they often fail to maintain the delicate balance between reduced overhead and detection performance. This paper presents an adaptive FL framework that dynamically combines batch size optimization, client selection, and asynchronous updates to achieve efficient anomaly detection. Through extensive profiling and experimental analysis on two distinct datasets-UNSW-NBIS for general network traffic and ROAD for automotive networks-our framework reduces communication overhead by 97.6%; (from 700.0s to 16.8s) compared to synchronous baseline approaches while maintaining comparable detection accuracy (95.10%; vs. 95.12%;). Statistical validation using Mann-Whitney U test confirms significant improvements (p < 0.05) over existing FL approaches across both datasets, demonstrating the framework's adaptability to different network security contexts. Detailed profiling analysis reveals the efficiency gains through dramatic reductions in GPU operations and memory transfers while maintaining robust detection performance under varying client conditions.

Marfo, William [University of Texas at El Paso]↗
DOE OSTI2025

Detecting Masquerade Attacks in Controller Area Networks Using Graph Machine Learning

Modern vehicles rely on a myriad of electronic control units (ECUs) interconnected via controller area networks (CANs) for critical operations. Despite their ubiquitous use and reliability, CANs are susceptible to sophisticated cyberattacks, particularly masquerade attacks, which inject false data that mimic legitimate messages at the expected frequency. These attacks pose severe risks such as unintended acceleration, brake deactivation, and rogue steering. Traditional intrusion detection systems (IDS) often struggle to detect these subtle intrusions due to their seamless integration into normal traffic. This paper introduces a novel framework for detecting masquerade attacks in the CAN bus using graph machine learning (ML). We hypothesize that the integration of shallow graph embeddings with time series features derived from CAN frames enhances the detection of masquerade attacks. We show that by representing CAN bus frames as message sequence graphs (MSGs) and enriching each node with contextual statistical attributes from time series, we can enhance detection capabilities across various attack patterns compared to using graph-based features only. Our method ensures a comprehensive and dynamic analysis of CAN frame interactions, improving robustness and efficiency. Extensive experiments on the ROAD dataset validate the effectiveness of our approach, demonstrating statistically significant improvements in the detection rates of masquerade attacks compared to a baseline that uses graph-based features only as confirmed by Mann-Whitney U and Kolmogorov-Smirnov tests (p < 0.05) .

Marfo, William [Univ. of Texas, El Paso, TX (Unite↗