Cyber Threat Modeling and Validation: Port Scanning and Detection.
Abstract not provided.
Vugrin, Eric D.↗
SEARCH · Search NASA
Results for “Threat Detection”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Copper-Based Two-Dimensional Conductive Metal–Organic Framework Thin Films for Ultrasensitive Detection of Perfluoroalkyls in Drinking Water
Perfluoroalkyls (PFAS) continue to emerge as a global health threat making their effective detection and capture extremely important. Though metal–organic frameworks (MOFs) have stood out as a promising class of porous materials for sensing PFAS, detection limits remain insufficient and a fundamental understanding of detection mechanisms warrants further investigation. Here, in this study, we show the use of a 2D conductive MOF film based on copper hexahydroxy triphenylene (Cu-HHTP) to fabricate chemiresistive sensing devices for detecting PFAS in drinking water. We further show ultrasensitive detection using electrochemical impedance spectroscopy. Owing to excellent electrostatic attractions and electrochemical interactions between the copper-based MOF and PFAS, confirmed by high-resolution spectroscopy and theoretical simulations, the MOF-based sensor reported herein exhibits excellent affinity and sensitivity toward perfluorinated acids at concentrations as low as 0.002 ng/L.
2D metal−organic frameworks↗
End-User Perspectives on Using Quantitative Real-Time PCR and Genomic Sequencing in the Field
Quantitative real-time PCR and genomic sequencing have become mainstays for performing molecular detection of biological threat agents in the field. There are notional assessments of the benefits, disadvantages, and challenges that each of these technologies offers according to findings in the literature. However, direct comparison between these two technologies in the context of field-forward operations is lacking. Most market surveys, whether published in print form or provided online, are directed to product manufacturers who can address their respective specifications and operations. One method for comparing these technologies is surveying end-users who are best suited for discussing operational capabilities, as they have hands-on experience with state-of-the-art molecular detection platforms and protocols. These end-users include operators in military defense and first response, as well as various research scientists in the public sector such as government and service laboratories, private sector, and civil society such as academia and nonprofit organizations performing method development and executing these protocols in the field. Our objective was to initiate a survey specific to end-users and their feedback. We developed a questionnaire that asked respondents to (1) determine what technologies they currently use, (2) identify the settings where the technologies are used, whether lab-based or field-forward, and (3) rate the technologies according to a set list of criteria. Of particular interest are assessments of sensitivity, specificity, reproducibility, scalability, portability, and discovery power. This article summarizes the findings from the end-user perspective, highlighting technical and operational challenges.
59 BASIC BIOLOGICAL SCIENCES↗
Satellite Enveloped with STITCHED Engineering Sensors for Detection of Approaching Objects
Today as well as tomorrows spaceborne assets impact almost all areas of national and nuclear security. Spaceborne assets can not only collect and disseminate valuable data, well beyond just the visual, but also track terrestrial-based mobile assets in real-time, and active spaceborne platforms potentially pose serious risk to vulnerable earth-based systems and infrastructures. The capability to defend national spaceborne assets from attack/interference is critical for security interests. This effort supports this mission through the cost-effective preeminent detection of approaching threats to our nation’s vital resources, in order to help secure and trust these high-value assets against the threats of tomorrow. This project develops novel fabrication techniques for conformal, low-profile and lightweight leakywave antenna (LWA) detection/imaging systems, which fuses technical embroidery (TE) and laser ablation (LA) processes with LWA design. Technical embroidery is an emerging field in additive textile manufacturing where flexible materials and functionalized fabrics are created for a wide variety of uses and purposes, while laser ablation is the process of removing material from a solid surface by irradiating it with a laser beam. Here, thin, conformal antenna designs are designed, modeled and fabricated using both TE and LA, to create lightweight, flexible and conformal object detection and imaging radars. This novel development ensures our nation’s ability to field advanced lightweight and conformal technologies to protect spaceborne assets.
42 ENGINEERING↗
Versatile & Intelligent Biodetection via Environmental Sensing (VIBES)
Reactive health monitoring strategies during events like the COVID-19 pandemic highlighted the need for predictive, threat-agnostic diagnostics that can detect both known diseases and novel chemical or biological threats. To address this, we investigated an optical biosensor as a breath volatile organic compound (VOC) analyzer, aiming to emulate biological olfaction. We assembled and validated the device with thin film metal coated substrate-based sensors. We immobilized small biological recognition elements on the substrates and delivered controlled concentrations of target VOCs. The sensor was irradiated with a visible laser and the sensor signal was recorded. We characterized the laser performance and tested 3 recognition elements for 2 VOCs with varying concentrations (1-100 ppm). We also evaluated enhancement of the signal using nanostructures on the metal film in comparison with planar film substrate. We demonstrated detecting ethanol reliably at concentrations as low as ~2 ppm along with preliminary detection of acetone (<100 ppm). We also found several unexpected factors that influence the sensor behavior that should be addressed to further refine the device’s performance. The nanostructures were, as expected, found to amplify the sensor signals. These findings demonstrate the feasibility of the optical bio-sensing modality for breath VOC monitoring at physiologically relevant levels. This positions LLNL to develop a low-cost, scalable, broad-spectrum health monitoring capability aligned with the Early Detection thrust of the Bioresilience Mission Focus Area and attract external funding.
47 OTHER INSTRUMENTATION↗
A Cybersecurity Threat Profile for a Connected Lighting System
In this paper we analyze a threat profile performed on a fault-detection use case for streetlights. A threat profile establishes security requirements, justifies security measures, yields actionable controls, and effectively communicates risk to stakeholders. This effort provides critical information for making threat-based decisions to increase security at a reasonable cost, and can effectively be used by development teams, software architects, and managers to make cybersecurity a part of their ongoing culture of awareness, training, and prevention. This leads to more secure systems and better-understood security. On-premise, cloud, and hybrid architectures with different authentication mechanisms were modeled and later categorized using the Microsoft STRIDE framework. An analysis of the recommended controls for each threat was performed to determine which controls could and should be put in place by manufacturers or third-party suppliers, and which controls need to be left up the end-user to implement.
97 MATHEMATICS AND COMPUTING↗
A Cybersecurity Threat Profile for a Connected Lighting System
In anticipation of improved energy performance and cost savings, cities and building owners are increasingly considering “smart lighting initiatives” that aim to convert their collection of simple luminaires (i.e., lighting fixtures) into an intelligent connected lighting system (CLS) capable of remotely monitoring energy consumption and fault conditions, and possibly implementing adaptive lighting schemes. The U.S. Department of Energy (DOE) has set an national goal of tripling the energy efficiency and demand flexibility of the buildings sector by 2030, relative to 2020 levels 1. It is forecast that connected lighting systems can contribute to that goal by delivering 125 TWh of annual energy savings by 2035 2, equivalent to the annual output of 50 typical (500 MW) power plants. However, these energy savings and the DOE goal are put at significant risk if connected technologies are not adopted due to real or perceived cybersecurity concerns. Connected IoT devices such as these have historically been rife with vulnerabilities which sometimes put security considerations secondary to functionality and operability. What are the cybersecurity threats that will impact these systems, as formerly banal luminaires transition into intelligent connected devices that collect information about themselves, their surrounding environment, and possibly us? In this paper we analyze a threat profile performed on a fault-detection use case for streetlights. A threat profile establishes security requirements, justifies security measures, yields actionable controls, and effectively communicates risk to stakeholders. This effort provides critical information for making threat-based decisions to increase security at a reasonable cost, and can effectively be used by development teams, software architects, and managers to make cybersecurity a part of their ongoing culture of awareness, training, and prevention. This leads to more secure systems and better-understood security. On-premise, cloud, and hybrid architectures with different authentication mechanisms were modeled and later categorized using the Microsoft STRIDE framework. An analysis of the recommended controls for each threat was performed to determine which controls could and should be put in place by manufacturers or third-party suppliers, and which controls need to be left up the end-user to implement. Fifty-seven threats were identified. Among our key findings: (1) 65% (37/57) of the threats did not involve the luminaires, but rather the other components needed to communicate with and manage them; (2) 63% (36/57) of the threats could have been mitigated through manufacturer-implemented defensive techniques or “controls”; and (3) 23% (13/57) of the threats were dependent on the network configuration. Recommendations based on the results of this work are made to key stakeholder groups. Notably, lighting technology developers are advised to address all threats that can be reasonably controlled with baked-in technology solutions (e.g., encryption or authentication controls), and employ some form of secure supply chain management and tracking where other parts (e.g., sensors, microprocessors) of a luminaire must also be built and manufactured with the proper security controls in place. Developers should also review threats involving assets not developed in-house to understand how connectivity with other devices will affect their product during system operation and determine if a compensating control for a defense-in-depth strategy will be needed. Finally, those interested in deploying CLS should compare the differences between cloud and on-premise models to determine which is more suitable for their needs and the abilities of their security team.
32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗
Resolving Lipid Structures for Threat-Agnostic Signatures
Development of threat-agnostic biosignatures is critical for the detection of and response to biological threats that go beyond the historical list-based approach. Lipids are a class of structurally diverse biomolecules that hold great promise as relevant threat-agnostic biosignatures, yet the fundamental challenge of resolving and decoding structural differences among lipids remains an obstacle in the pursuit of signature development. Structural analysis of complex lipids remains stymied due to spectral complexity and the inability to resolve low abundance lipids. To address these challenges, we integrated ozonolysis with ion mobility mass spectrometry (IMS-MS) analysis to determine the structural information for complex lipid species and (2) reduced lipid sample complexity prior to introduction into the IMS-MS using normal phase high pressure liquid chromatography (HPLC) to enable the ozonolysis of low abundance lipids. We applied these new capabilities to define the lipid structures in antimicrobial resistant (AMR) and antimicrobial susceptible (AMS) biothreat organism Yersinia pestis and cells infected with Severe Acute Respiratory Syndrome coronavirus 2 (SARS-CoV-2) variants.
59 BASIC BIOLOGICAL SCIENCES↗
MicroResonators for Compacts Optical Sensors (μRCOS)
As the demand for continuous, in-situ surveillance of health of systems and environments rapidly increases, miniaturized sensors with fast responses are sought. Optical dielectric resonators supporting Whispering Gallery Modes (WGMs) have exceptional properties, like very high-power density, very narrow spectral linewidth, and extremely small mode volume. As the footprint of these sensors is drastically reduced, measurements of microvolumes samples with dramatic reduction in analysis time are possible, enabling large numbers of parallel analyses using microarrays. The high sensitivity and speed of WGM resonators combined with the ability to detect molecules in their native state have great future potential for basic and applied research such as reliable single molecule, trace-gas detection, environmental monitoring, chemical threat sensing, and biodefense Such appealing peculiarities motivated us developing WMG resonators (WGMRs) for Cavity Enhanced Absorption Spectroscopy (CEAS) for chem-bio detection. Specifically, we designed and batch-fabricated microspheres and fiber tapers for resonances excitation. We successfully detected gases (N 2 and CO 2 ) in customized environmental chambers, and bio-organisms (Inf. A and E. Coli) with integrated microfluidic systems. Background calibration and environmental isolation were always accounted for in proving the performances.
36 MATERIALS SCIENCE↗
MicroResonators for Compacts Optical Sensors (μRCOS)
As the demand for continuous, in-situ surveillance of health of systems and environments rapidly increases, miniaturized sensors with fast responses are sought. Optical dielectric resonators supporting Whispering Gallery Modes (WGMs) have exceptional properties, like very high-power density, very narrow spectral linewidth, and extremely small mode volume. As the footprint of these sensors is drastically reduced, measurements of microvolumes samples with dramatic reduction in analysis time are possible, enabling large numbers of parallel analyses using microarrays. The high sensitivity and speed of WGM resonators combined with the ability to detect molecules in their native state have great future potential for basic and applied research such as reliable single molecule, trace-gas detection, environmental monitoring, chemical threat sensing, and biodefense Such appealing peculiarities motivated us developing WMG resonators (WGMRs) for Cavity Enhanced Absorption Spectroscopy (CEAS) for chem-bio detection. Specifically, we designed and batch-fabricated microspheres and fiber tapers for resonances excitation. We successfully detected gases (N 2 and CO 2 ) in customized environmental chambers, and bio-organisms (Inf. A and E. Coli) with integrated microfluidic systems. Background calibration and environmental isolation were always accounted for in proving the performances.
36 MATERIALS SCIENCE↗
MetaPoL: Immersive VR based Indoor Patterns of Life (PoL) and Anomalies Data Generation for Insider Threat Modeling in Nuclear Security
Insider threats are perhaps the most serious challenges that nuclear and radiological security systems face. Insiders pose such a great threat due to their access, authority, and knowledge, granting them opportunities to bypass dedicated nuclear and radiological security elements. For example, in one of the latest major insider threat incidents to nuclear security, the Doel-4 nuclear powerplant in Belgium suffered a shutdown, the threat of nuclear materials diversion, and long-term loss of tens of millions of dollars. Seven years of investigation concluded that it was an inside job and attempted sabotage. In this regard, there is an immediate need for R&D and technology integration in the domain of modeling indoor Patterns-of-Life (PoL) and anomaly detection. This can be achieved by using datasets of facility users’ mobility and activity, which can support the design of algorithms for insider threat modeling and detection. However, due to classification, privacy, sensitivity, and safety protocols, such datasets from real physical nuclear reactor facilities are not only hard to share, but also not always feasible to deploy and collect. Aiming to find an alternate solution, our proposed demonstration work - MetaPoL, is the first-ever (for the application space) immersive VR (virtual reality) environment of a real-world secure facility and allows users to move-and-stay through the designed indoor physical layout and also encounter NPCs (non-player characters) that emulate other facility users. In the MetaPoL an interactive user performs realistic spatio-temporal movement, dwelling and activities using a Meta Quest Pro VR headset, and that generates high-frequency (in time) high-resolution (in space) indoor spatial-temporal datasets that are valuable for PoL modeling and anomaly detection research specifically for insider threat modeling and detection mission. Such generated realistic, rich in context, and mission specific datasets can boost AI/Machine Learning based research for modeling and detecting insider threats in nuclear security and nonproliferation.
Gunaratne, Chathika↗
Towards Secure Autonomous Vehicles: An Integrated Edge and Multi-Modal Machine Learning Framework for Intrusion Detection
Autonomous vehicles (AVs) are vulnerable to cyberattacks targeting both internal communication networks and external perception sensors. While edge-based intrusion de- tection for Controller Area Network (CAN) buses offers real-time protection, it cannot detect cross-modal threats. Conversely, multi-modal fusion approaches improve coverage but often lack efficiency for in-vehicle deployment. This thesis integrates two complemen- tary solutions: (1) a lightweight, edge-deployable machine learning framework for CAN bus intrusion detection, and (2) a late-fusion system combining CAN FD and LiDAR data. Together, they form a hierarchical defense capable of handling single-modality and coordi- nated attacks. Simulations show that CAN-only models reach 93% accuracy on simulated DoS, spoofing, replay, and fuzzy attacks, while the fusion system achieves 0.87 AUC and 0.82 F1-score at 2 ms latency. This unified framework establishes a scalable, explainable, and field-ready strategy for AV cybersecurity.
97 MATHEMATICS AND COMPUTING↗
Cybersecurity Enhancement in Digital Substations: Hidden Markov Model-Based Smart Cyber Switching and Threat Response
The rising incidence of cyber-attacks on critical infrastructure and power grids poses significant threats to the stability and reliability of electrical substations, with potentially devastating consequences such as extended blackouts. This paper introduces an advanced cybersecurity framework aimed at safeguarding IEC 61850-based substations through the integration of software-defined networking (SDN) and digital twin (DT) technologies. The proposed DT-based framework employs smart cyber switching (SCS) for proactive threat mitigation and concurrent intelligent electronic device (CIED) for swift system restoration, thereby maintaining continuous operational integrity and robust cybersecurity defenses. Central to this framework is the adaptive port controller (APC), which enables dynamic port management to adapt to evolving threats, and an intrusion detection system (IDS) designed to detect and neutralize malicious attacks on IEC 61850-based sampled value (SV) and generic object-oriented substation event (GOOSE) messages within the substation’s communication network. Further, novel predictive intrusion detection and response (PIDR) algorithm is implemented on a digital substation (DS) to predict the best route to be taken by the attacker. The efficacy of these comprehensive cybersecurity frameworks is validated through rigorous simulations and a hardware-in-the-loop (HIL) testbed, showcasing the system’s ability to sustain substation operations amidst cyber-attacks.
Digital substation↗
ByzSec — A Multi-layered Byzantine Resilient Architecture for Bulk Power System Protective Relays
Reliability, selectivity, and sensitivity are the fundamental attributes of any protection system, acting as the main drivers in the selection of schemes, and equipment. In high-voltage systems, microprocessor-based relays represent the industry’s preferred solution, providing engineers with a vast array of benefits. However, they remain vulnerable to cybersecurity events that may compromise their functionality. To help mitigate against potential cybersecurity risks, this paper presents a fault-tolerant, Byzantine Resilient (BR) architecture that significantly increases the cybersecurity attributes of a protection system while minimizing the amount of performance impacts and integration overheads introduced. The solution relies on an array of independent relays that utilize robust consensus methods (based on Spire [1], [2]) to ensure correct system behavior is achieved even when a relay has been compromised. Furthermore, the solution has been complemented with a custom-built Situational Awareness engine that can be used to detect and identify potential threats. The implemented solution has been developed in consultation with three hardware vendors and has been tested to comply with the performance requirements of a 345kV differential protection scheme (87T). The results indicate that the proposed architecture is a comprehensive solution that: supports the strict correctness and performance requirements of the bulk power grid while providing a cost-effective alternative that offers a seamless, long-term solution.
byzantine security, Fault Tolerant Application Sof↗
Automated Threat Recognition For Aviation Security Applications
We have developed a framework for automated threat recognition (ATR) of explosive threat materials for both single-energy and dual-energy X-ray CT systems. Under this framework, two different types of ATR have been developed. The first type of ATR employs supervised machine learning with statistical characterization of target materials for threat identification training. The reliance only on statistical characterization information for threat training uniquely enables this style of ATR to adapt quickly to evolving threats. The second type of ATR employs deep learning through convolutional neural networks. Convolutional neural networks are attractive due to their human-like capacity for learning and strong ability to identify trends and patterns. Although this method is more powerful than the first type, it requires large amounts of training data and therefore is less agile. Each ATR performs threat characterization at the voxel neighborhood level. This approach avoids the use of threat shape as a detection criterion, which is prohibited by DHS and TSA guidelines.
97 MATHEMATICS AND COMPUTING↗
Challenges and Solutions for Leave-One-Out Biosensor Design in the Context of a Rugged Fitness Landscape
The leave-one-out (LOO) green fluorescent protein (GFP) approach to biosensor design combines computational protein design with split protein reconstitution. LOO-GFPs reversibly fold and gain fluorescence upon encountering the target peptide, which can be redefined by computational design of the LOO site. Such an approach can be used to create reusable biosensors for the early detection of emerging biological threats. Enlightening biophysical inferences for nine LOO-GFP biosensor libraries are presented, with target sequences from dengue, influenza, or HIV, replacing beta strands 7, 8, or 11. An initially low hit rate was traced to components of the energy function, manifesting in the over-rewarding of over-tight side chain packing. Also, screening by colony picking required a low library complexity, but designing a biosensor against a peptide of at least 12 residues requires a high-complexity library. This double-bind was solved using a “piecemeal” iterative design strategy. Also, designed LOO-GFPs fluoresced in the unbound state due to unwanted dimerization, but this was solved by fusing a fully functional prototype LOO-GFP to a fiber-forming protein, Drosophila ultrabithorax, creating a biosensor fiber. One influenza hemagglutinin biosensor is characterized here in detail, showing a shifted excitation/emission spectrum, a micromolar affinity for the target peptide, and an unexpected photo-switching ability.
Chemistry↗
Anomaly Detection in Power System State Estimation: Review and New Directions
Foundational and state-of-the-art anomaly-detection methods through power system state estimation are reviewed. Traditional components for bad data detection, such as chi-square testing, residual-based methods, and hypothesis testing, are discussed to explain the motivations for recent anomaly-detection methods given the increasing complexity of power grids, energy management systems, and cyber-threats. In particular, state estimation anomaly detection based on data-driven quickest-change detection and artificial intelligence are discussed, and directions for research are suggested with particular emphasis on considerations of the future smart grid.
42 ENGINEERING↗
Does practice make perfect? Lessons learned from full-scale power system incident response exercise
While threats to the energy sector occur daily, few utilities get the opportunity to fully test out their detection and response mechanisms to advanced threats in the real world. With the high demand for reliability, few grid operators would allow execution of simulated cyber-attacks on their live systems. The DOE-funded Liberty Eclipse project offers a unique opportunity for small and large utilities and coops to practice their combined IT/OT responses to a live red team executing attacks against an isolated power system on an island in New York. Both cyber teams and power operations teams must work together to detect and respond to attacks, even restoring the power system against extreme impacts. Lessons learned from these exercises reveal key takeaways for understanding what a real attack against the electric sector will look like, gaps in execution of the best-laid plans when the pressure of a real event is bearing down, and how organizations can better prepare for advanced attacks by optimizing participation in exercises. This presentation will discuss successes and opportunities for improvement both in how utilities can prepare for and respond to events, as well as how full-scale IT/OT exercises can be coordinated.
24 POWER TRANSMISSION AND DISTRIBUTION↗