Search NASA⌕ Search

SEARCH · Search NASA

Results for “Cyber Analytics”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 91 records · Page 5
All sourcesNASA NTRSDOE OSTI
DOE OSTI2023

Flexible visualization of a 3rd party Intrusion Prevention (Security) tool: A use case with the ELK stack

A difficult aspect of cyber security is the ability to achieve automated real time intrusion prevention across various sets of systems. To this extent, several companies are offering comprehensive solutions that leverage an "accuracy of scale" and moving much of the intelligence and detection on the Cloud, relying on an ever-growing set of data and analytics to increase decision accuracy. Often, they provide tools to visualize the decision workflows in attack prevention (as well as tune the algorithm) but those solutions are not always practical as companies see the problem as "global" that is, from a unified Cyber-security standpoint. However, a key to a successful Cyber-security program is transparency and trust: from an experimental team viewpoint, this specifically means having the ability to immediately see what and from where, who has been blocked and being able to inform the community in case of a revoked access without the need for filing a "ticket" (that may eventually be answered) – in other words, rapid response to their user-base is essential but solutions targeting "sub-groups" in an organization are not often available. We have come up with a versatile solution leveraging the ELK stack (Elasticsearch, Logstash, & Kibana) and an IPS (Intrusion Prevention System) based WAF (Web Application Firewall) from Signal Sciences. Signal Science allows the streaming of detailed logs in a Logstash format suitable for custom solutions for visualization. By combining these two tools, we have strengthened our security posture and enabled individual experiments to monitor their own traffic. Specifically, the IPS WAF provides unique data such as country of origin, protocol, response code, source IP, and paths accessed. In this contribution, we will show how we engineered a visualization solution so experiment groups could access a dashboard with predefined graphs but also, where they can create individual customizable dashboards used to display blocked traffic and troubleshoot latency issues. We will discuss the details and procedures for developing and configuring these tools and how it benefits cyber security postures across our scientific based environment.

73 NUCLEAR PHYSICS AND RADIATION PHYSICS↗
DOE OSTI2022

Wintap

Wintap is an extensible, general purpose agent framework for the Windows operating system. It provides an easy-to-use plugin architecture, an integrated streaming analytics engine, and real-time event subscriptions for host-based data. Wintap can support a wide variety of applications across production operations, cyber security operations, and cyber security research.

Frye, DavidJ↗
DOE OSTI2025

InterGraph-CPS: A Graph-Theoretic Approach to Characterize Cross-Domain Cyber-Physical Interdependencies and Uncertainties in Electric Grid Systems for Improved Decision-Making in Operation and Response

Critical infrastructure systems such as the electric grid are increasingly cyber-physical; yet, despite the cyber-physical characteristics of critical infrastructure systems, the physical process system and communication/control network system are traditionally analyzed in siloes. As these systems become more cyber-physical, it is crucial that models and methods are available to assess the cyber physical system (CPS) interdependencies, characteristics, and event propagation for improved planning, operation, and response. Thus, we proposed an integrated structural and temporal CPS interdependency analysis framework, InterGraph-CPS, that provides insight into the CPS function during normal operation as well as disturbances. This integrated structural and temporal interdependency framework is uniquely designed for assessing CPSs by account for the challenges of analyzing cyber and physical data streams together due to data availability, data type, and time scale differences. By leveraging both structural (e.g., graph analysis) and temporal (e.g., data analytics) techniques, different CPS behaviors and configurations can be accounted for.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2024

Portable Parallel Algorithms and Frameworks for Exascale Graph Analytics

Graphs (or networks) are a tool used to model the interactions among various entities. Efficiently processing large graphs has recently attracted significant attention due to the applications of graphs in various domains, such as biology, chemistry, and cyber-security. Analyzing the structure and properties of these graphs is an important component of many scientific computing pipelines. With the explosion in the volume of data, graphs have become very large and can contain hundreds of billions of vertices and trillions of edges. Therefore, it is crucial to develop high-performance methods to enable graph analysis to be done quickly and energy-efficiently. Furthermore, these solutions should be highly parallel in order to take advantage of modern parallel machines. However, designing efficient solutions is not enough. With the wide variety of computing environments available, each with different programmability and performance characteristics, it is necessary to develop solutions that are portable in terms of both performance (i.e., provide theoretical guarantees) and programmability (i.e., provide high level abstractions).

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2021

Critical Roles of Information, Analysis, Research, and Operations in the Cyber Realm

PNNL has developed an adaptive cyber integration framework (ACIF) to facilitate the timely sharing of cyber threat information along with the advancement of situational awareness tools to enhance protection against and respond to critical infrastructure cybersecurity threats. The ACIF comprises components implemented iteratively to achieve research and mission goals. The ACIF components include data generation technologies, analytic tools development and maturation, data enrichment and fusion, trust building with stakeholders, investigative research, analytic rigor, production, and dissemination. Each component, its importance to the ACIF, and how they can be adopted and applied across other information-sharing sectors and domains are discussed in this paper.

Cyber Threat Intelligence, Cyber Security, Data En↗
DOE OSTI2022

WISP: Watching grid Infrastructure Stealthily through Proxies (Final Technical Report)

The complex interdependencies of cyber systems (sensors and communications), physical grids and associated electricity market operations make protecting electric power grids a significant challenge. The energy sector is constantly under new, targeted, advanced and dangerous cyber-attacks that have the potential to result in the loss of human life. These threats are further exacerbated by our need to modernize the grid. One focus of cyber security research in smart grids is the securing of the SCADA system through advanced intrusion detection systems (IDS) and bad data detection algorithms in state estimation. These methods either require full knowledge of the system topology and parameters or fail to understand the physical behaviors under attack. WISP (Watching grid Infrastructure Stealthily through Proxies) is designed to provide additional protection to the power grid using only publicly available data. In particular, WISP exploits the spatio-temporal nature of the real time locational marginal prices (LMPs), in conjunction with other information such as bids, weather, outages and load data to analyze anomalous power pricing behaviors and then correlate those observations to localize regions of interest and identify potential cyber events. WISP is non-intrusive as the tool is deployed as a service in the Cloud or on premise and provides reliable information to system operators for enhanced situational awareness, without impeding energy delivery functions. The WISP technology comprises three modules: the data-driven anomaly detection core, the vulnerability and risk analysis and the root cause analysis. The data-driven anomaly detection core performs the tasks of feature selection, anomaly detection and attack region localization. The vulnerability and risk analysis module provides system level information of the vulnerable variables and times, assisting the operators in selecting monitoring and protection nodes. The root cause analysis module takes the detection results and identifies potential operational conditions that contribute to the detected anomalies. In Phase I, we have demonstrated the feasibility and effectiveness of WISP. We developed a realistic electricity market simulator capable of generating normal and attack market data under various operational conditions. We developed a series of cyber-attack detection and analysis algorithms and evaluated them under multiple data sources. Finally, we integrated all modules into an end-to-end software, providing functions for data management, data analytics and visualization. Specifically, we have achieved: (i) real-time data acceptance from external utility interfaces with >99% acceptance rate; (ii) high performance anomaly detection algorithms with >98% detection accuracy and <0.1% false alarm rate; and (iii) ultra-low computing delay <50 milliseconds. Additionally, our team developed algorithms to identify the vulnerable variables in electricity market operations and root cause analysis functions to identify major contributors to the price spikes. These ancillary modules are necessary when deploying WISP in real world industry environment. In Phase II, we have demonstrated the effectiveness of WISP software on realistic largescale power systems. We performed red team testing for the Phase I WISP software and identified software vulnerabilities and implemented corresponding mitigation solutions. We adapted the electricity market simulator for the Texas synthetic 2000-bus system and generated datasets for the false data injection attacks. We created database and visualization interfaces for the Texas system and the ISO New England system. We performed software optimization in terms of operation efficiency, computing speed and detection accuracy. Finally, we tested the software on the Texas system and the ISO New England system and evaluated the detection performance. Overall, we achieved above 89% detection rate, below 3% false alarm rate and below 37 seconds of end-to-end detection delay.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2017

Real-Time Cyber-Physical False Data Attack Detection in Smart Grids Using Neural Networks

Attacks on cyber-physical systems have recently increased in frequency, impact, and publicity. In this paper, a cyber-physical false data attack detection mechanism is proposed to protect the operation of power transmission and distribution systems by automatically inferring underlying physical relationships using cross-sensor analytics in order to detect sensor failures, replay attacks, and other data integrity issues in real-time. We investigate a neural network based mechanism acting on voltage and current readings resulting from a wide variety of load conditions on the IEEE 30-bus power system standard and compare its performance with a support vector machine based mechanism. Experiments showed that 99% detection accuracy of replay attacks was achieved using the proposed neural network mechanism. More importantly, we showed that the best approach was to not create physics-based features using what we knew about the system, but rather to use a neural network to automatically learn the laws, and then use the outputs of that to build a classifier to identify whether and where data spoofing occurs. Thus, it is preferable to infer and exploit the physics using a single machine learning solution

Ferragut, Erik M.↗
DOE OSTI2018

Forming IDEAS: Interactive Data Exploration & Analysis System

Modern cyber security operations collect an enormous amount of logging and alerting data. While analysts have the ability to query and compute simple statistics and plots from their data, current analytical tools are too simple to admit deep understanding. To detect advanced and novel attacks, analysts turn to manual investigations. While commonplace, current investigations are time-consuming, intuition-based, and proving insufficient. Our hypothesis is that arming the analyst with easy-to-use data science tools will increase their work efficiency, provide them with the ability to resolve hypotheses with scientific inquiry of their data, and support their decisions with evidence over intuition. To this end, we present our work to build IDEAS (Interactive Data Exploration and Analysis System). We present three real-world use-cases that drive the system design from the algorithmic capabilities to the user interface. Finally, a modular and scalable software architecture is discussed along with plans for our pilot deployment with a security operation command.

Bridges, Robert↗
DOE OSTI2022

Smart sensor for online situational awareness in power grids

Waveforms in power grids typically reveal a certain pattern with specific features and peculiarities driven by the system operating conditions, internal and external uncertainties, etc. This prompts an observation of different types of waveforms at the measurement points (substations). An innovative next-generation smart sensor technology includes a measurement unit embedded with sophisticated analytics for power grid online surveillance and situational awareness. The smart sensor brings additional levels of smartness into the existing phasor measurement units (PMUs) and intelligent electronic devices (IEDs). It unlocks the full potential of advanced signal processing and machine learning for online power grid monitoring in a distributed paradigm. Within the smart sensor are several interconnected units for signal acquisition, feature extraction, machine learning-based event detection, and a suite of multiple measurement algorithms where the best-fit algorithm is selected in real-time based on the detected operating condition. Embedding such analytics within the sensors and closer to where the data is generated, the distributed intelligence mechanism mitigates the potential risks to communication failures and latencies, as well as malicious cyber threats, which would otherwise compromise the trustworthiness of the end-use applications in distant control centers. The smart sensor achieves a promising classification accuracy on multiple classes of prevailing conditions in the power grid and accordingly improves the measurement quality across the power grid.

Dehghanian, Payman↗
DOE OSTI2015

Sampling and analysis of cyber media to determine whether it meets the definition of a hazardous waste - 15208

Sandia National Laboratories, New Mexico (SNL/NM) was tasked to support The Department of Energy (DOE) in the disposal of classified cyber media. Certain cyber media have lead and silver. Various cyber media types were identified because they may have a hazardous waste characteristic. The overall objective of this sampling effort is to obtain representative samples of specific types of cyber media and analyze those samples to collect data to determine definitively if the cyber media are hazardous waste. Ten different samples were obtained from the unclassified waste stream and shredded to meet the sampling criteria. The samples were shipped to an offsite analytical laboratory with a Chain of Custody. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗
DOE OSTI2012

Proactive Defense for Evolving Cyber Threats

There is great interest to develop proactive methods of cyber defense, in which future attack strategies are anticipated and these insights are incorporated into defense designs; however, little has been done to place this ambitious objective on a sound scientific foundation. Indeed, even fundamental issues associated with how the “arms race” between attackers and defenders actually leads to predictability in attacker activity, or how to effectively and scalably detect this predictability in the relational/temporal data streams generated by attacker/defender adaptation, haven’t been resolved. This LDRD project addressed many of these challenges and the results are briefly summarized here. We have characterized the predictability of attacker/defender coevolution and have leveraged our findings to create a framework for designing proactive defenses for large (organizational) networks. More specifically, this project applied rigorous predictability-based analytics to two central and complementary aspects of the network defense problem – attack strategies of the adversaries and vulnerabilities of the defenders’ systems – and used the results to develop a scientifically-grounded, practically-implementable methodology for designing proactive cyber defense systems. Briefly, predictive analysis of attack strategies involved first conducting predictability assessments to characterize attacker adaptation patterns in given domains, and then used these patterns to “train” adaptive defense systems capable of providing robust performance against both current and (near) future threats. The problem of identifying and prioritizing defender system vulnerabilities was addressed using statistical and machine learning to analyze a broad range of data (e.g., cyber, social media) on recently detected system vulnerabilities to “learn” classifiers that predict how likely it is that, and how soon, new vulnerabilities will be exploited. A variety of cyber threat case studies were developed and investigated throughout the project, one selected from the cyber security research community and one that is more comprehensive and of higher priority to SNL and to external national security partners. A sample of research results and application of this methodology are included in this report (as a series of peer-reviewed publications). For ease of reference the title and SAND number are included below.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2018

Defining a Metric Space of Host Logs and Operational Use Cases

Host logs, in particular, Windows Event Logs, are a valuable source of information often collected by security operation centers (SOCs). The semi-structured nature of host logs inhibits automated analytics, and while manual analysis is common, the sheer volume makes manual inspection of all logs impossible. Although many powerful algorithms for analyzing time-series and sequential data exist, utilization of such algorithms for most cyber security applications is either infeasible or requires tailored, research-intensive preparations. In particular, basic mathematic and algorithmic developments for providing a generalized, meaningful similarity metric on system logs is needed to bridge the gap between many existing sequential data mining methods and this currently available but under-utilized data source. In this paper, we provide a rigorous definition of a metric product space on Windows Event Logs, providing an embedding that allows for the application of established machine learning and time-series analysis methods. We then demonstrate the utility and flexibility of this embedding with multiple use-cases on real data: (1) comparing known infected to new host log streams for attack detection and forensics, (2) collapsing similar streams of logs into semantically-meaningful groups (by user, by role), thereby reducing the quantity of data but not the content, (3) clustering logs as well as short sequences of logs to identify and visualize user behaviors and background processes over time. Overall, we provide a metric space framework for general host logs and log sequences that respects semantic similarity and facilitates a wide variety of data science analytics to these logs without data-specific preparations for each.

Verma, Miki↗
DOE OSTI2014

Pathways to Identity. Using Visualization to Aid Law Enforcement in Identification Tasks

The nature of identity has changed dramatically in recent years and has grown in complexity. Identities are defined in multiple domains: biological and psychological elements strongly contribute, but biographical and cyber elements also are necessary to complete the picture. Law enforcement is beginning to adjust to these changes, recognizing identity’s importance in criminal justice. The SuperIdentity project seeks to aid law enforcement officials in their identification tasks through research of techniques for discovering identity traits, generation of statistical models of identity and analysis of identity traits through visualization. We present use cases compiled through user interviews in multiple fields, including law enforcement, and describe the modeling and visualization tools design to aid in those use cases.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2018

Design of Distributed Cyber-Physical Systems for Connected and Automated Vehicles with Implementing Methodologies

With the development of communication and control technology, intelligent transportation systems have received increasing attention from both industry and academia. Intelligent transportation systems are supported by the Internet of Things, Cyber-Physical System, Artificial Intelligence, Cloud Computing and many other technologies, which supply fundamental information for connected and automated vehicles. Although plenty of studies have provided different formulations for intelligent transportation systems, many of them depend on Master Control Center. However, a centralized control mode requires a huge amount of data transmission and high level of hardware configuration and may cause communication delay and privacy leak. Some distributed architectures have been proposed to overcome the above problems but systematized technologies to collect and exchange information, process large amounts of data, model the dynamics of vehicles, and safely control the connected and automated vehicles are not explored in detail. In this paper, we proposed a novel distributed cyber-physical system for connected and automated vehicles in which every vehicle is modeled as a double-integrator using edge computing to analyze information collected from its nearest neighbors. The vehicles are supposed to travel along a desired trajectory and to maintain a rigid formation geometry. Related methodologies for the proposed system are illustrated and experiments are conducted showing that the performance of the connected and automated vehicles matches very well with analytic predictions. Some design guidelines and open questions are provided for the future study.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2012

Shopping For Danger: E-commerce techniques applied to collaboration in cyber security

Collaboration among cyber security analysts is essential to a successful protection strategy on the Internet today, but it is uncommonly practiced or encouraged in operating environments. Barriers to productive collaboration often include data sensitivity, time and effort to communicate, institutional policy, and protection of domain knowledge. We propose an ambient collaboration framework, Vulcan, designed to remove the barriers of time and effort and mitigate the others. Vulcan automated data collection, collaborative filtering, and asynchronous dissemination, eliminating the effort implied by explicit collaboration among peers. We instrumented two analytic applications and performed a mock analysis session to build a dataset and test the output of the system.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2017

From Dr. Steven Ashby, Director of PNNL

Powered by the creativity and imagination of more than 4,000 exceptional scientists, engineers and support professionals, at PNNL we advance the frontiers of science and address some of the most challenging problems in energy, the environment and national security. As DOE’s premier chemistry, environmental sciences and data analytics laboratory, we provide national leadership in four areas: deepening our understanding of climate science; inventing the future power grid; preventing nuclear proliferation; and speeding environmental remediation. Other areas where we make important contributions include energy storage, microbial biology and cyber security. PNNL also is home to EMSL (the Environmental Molecular Sciences Laboratory), one of DOE’s scientific user facilities. We apply these science strengths to address both national and international problems in complex adaptive systems that are too difficult for one institution to tackle alone. Take earth systems, for instance. The earth is a complex adaptive system because it involves everything from climate and microbial communities in the soil to emissions from cars and coal-powered industrial plants. All of these factors and others ultimately influence not only our environment and overall quality of life, but cause the earth to adapt in ways that must be further addressed. PNNL researchers are playing a vital role in finding solutions across every area of this complex adaptive system.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2020

Advanced Sensors and Instrumentation (ASI) Program Plan. Nuclear Energy Enabling Technologies (NEET)

The U.S. Department of Energy Office of Nuclear Energy (DOE-NE) sponsors a crosscutting technology development (CTD) program addressing common instrumentation & controls (I&C) needs in all DOE-NE sponsored programs. In 2012, DOE-NE initiated the Nuclear Energy Enabling Technology (NEET) Program to conduct research, development, and demonstration (RD&D) in crosscutting technologies that directly support and enable the development of existing, new and advanced reactor designs, and fuel cycle technologies. These technologies will advance the state of nuclear technology, improve its competitiveness, and promote continued contribution to meeting our Nation’s energy and environmental challenges. The NEET Program has spurred innovation in the field of sensors and instrumentation, advanced methods for manufacturing, and cyber security. The Advanced Sensors and Instrumentation (ASI) program is one element of the NEET CTD that has spurred innovation in the measurement science field by funding research on sensors, instrumentation and controls, communication, and advanced analytics that measure system parameters, gauge component control input, and provide power plant owners and operators critical awareness so they can plan and safely manage operational evolutions. The NEET ASI Program has carried out research and development (R&D) required to develop and deploy innovative and advanced sensors, and instrumentation and control capabilities for current and future nuclear energy systems, and to enable the advanced technologies essential to NE’s R&D efforts needed to realize mission goals. The concept of technology readiness assessment is helpful for the classification of instrumentation technology as part of the program strategy. A technology readiness assessment evaluates technology maturity using the Technology Readiness Level (TRL) scale and was pioneered by the National Aeronautics and Space Administration in the 1980s for space technology. It has recently been adopted to advance fuels and materials. The NEET ASI program objective is to mature instruments technology to TRL 6, which is “demonstration of the technology in relevant environment.” While there may be instances in which a different strategy is justified, the aim of the program is to respond to DOE program and stakeholder needs for nuclear instrumentation then hand off the technology after demonstration for integration in a more complex system, for example an irradiation test, experimental loop or a plant component such as the core, primary system or heat exchanger. A mechanism to continue some level of support from NEET ASI during and after the adoption (for example, to maintain fabrication and calibration capabilities) will be defined as the first example of technology hand off comes to fruition. In addition, several paths exist within DOE to complement NEET ASI activities to extend the maturity beyond TRL, for example through GAIN, technology commercialization funding, and small-business programs. Role of NEET ASI CINR projects in the TRL space, and integration with direct funded demonstration.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
DOE OSTI2023

Attack Surface Analysis of the Digital Twins interface with Advanced Sensor and Instrumentation Interfaces: Cyber Threat Assessment and Attack Demonstration for Digital Twins in Advanced Reactor Architectures

A digital twin is a virtual representation of a physical system or object using real-time data that can predict and analyze how the system or object performs. This relatively new technology can be applied to the field of nuclear power generation, to aid in the design and development of new nuclear power plants and reduce operation costs using predictive maintenance and other data analytical methods. While there are already companies utilizing simulation software to train operators and technicians in the nuclear industry, some are now transitioning to utilizing their existing technology, software, and methods to develop digital twin solutions for the next generation of nuclear power plants, offering their services to utilities and government organizations around the world.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗