Search NASA⌕ Search

SEARCH · Search NASA

Results for “Cybersecurity”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 1,009 records · Page 56

Concepts for Autonomous Operation of Microreactors

Microreactor concepts have seen increasing interest in recent years given their potential use for meeting energy needs in remote and grid-isolated communities. Given the small power outputs of microreactors and the potential for remote siting, there is a need to reduce operational staffing levels to improve their economic viability. A key enabling technology for this purpose is autonomous control that enables autonomous operation of microreactors. While several options for autonomous control exist, the level of human operator involvement in operational decision making needs to be defined as part of the system design process. Once this separation of function is achieved, several options exist for autonomous control ranging from simple automation of some procedures to fully autonomous operational mode decision making and execution.A critical aspect of autonomous decision making is the ability to have as complete an awareness of the system state as possible. In addition to data on temperature, pressure, flow, and neutron flux, measurements of the condition of important components will be necessary. This type of information will allow the autonomous control system to adapt its decision making to any changing conditions within the reactor, thereby not compromising safety while continuing to operate for as long as possible. Several technical advances are needed before widespread use of autonomous control in microreactors. These include sensor and instrumentation technologies that are capable of long term, unattended operation in harsh environments, technologies for inferring the state of the microreactor system or subsystems in an automated fashion, algorithms for predictive decision making that account for the assessed condition of the microreactor subsystems as well as the potential impact on those components of any operational decision, and actuators and control system hardware that are also long-lived in a harsh environment. In addition, given the need to remotely monitor the operations, cybersecurity requirements will likely need to be imposed to ensure secure operations.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗

Why does cyber deterrence fail and when might it succeed? A framework for cyber scenario analysis

Through cyberattacks on information technology and digital communications systems, antagonists have increasingly been able to alter the strategic balance in their favor without provoking serious consequences. Conflict within and through the cyber domain is inherently different from conflict in other domains that house our critical systems. These differences result in new challenges for defending and creating resilient systems, and for deterring those who would wish to disrupt or destroy them. The purpose of this paper is to further examine the question of whether or not deterrence can be an effective strategy in cyber conflict, given our broad and varied interests in cyberspace. We define deterrence broadly as the creation of conditions that dissuade antagonists from taking unwanted actions because they believe that they will incur unacceptably high costs and/or receive insufficient benefits from taking that action. Deterrence may or may not be the most credible or effective strategy for achieving our desired end states in cybersecurity. Regardless of the answer here, however, it is important to consider why deterrence strategies might succeed under certain conditions, and to understand why deterrence is not effective within the myriad contexts that it appears fail. Deterrence remains a key component of U.S. cyber strategy, but there is little detail on how to operationalize or implement this policy, how to bring a whole-of-government and whole-of- private-sector approach to cyber deterrence, which types of antagonists can or should be deterred, and in which contexts. Moreover, discussion about how nations can and should respond to significant cyber incidents largely centers around whether or not the incident constitutes a "use of force," which would justify certain types of responses according to international law. However, we believe the "use of force" threshold is inadequate to describe the myriad interests and objectives of actors in cyberspace, both attackers and defenders. In this paper, we propose an approach to further examine if deterrence is an effective strategy and under which conditions. Our approach includes systematic analysis of cyber incident scenarios using a framework to evaluate the effectiveness of various activities in influencing antagonist behavior. While we only examine a single scenario for this paper, we propose that additional work is needed to more fully understand how various alternative thresholds constrain or unleash options for actors to influence one another's behavior in the cyber domain.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

National-Tribal Critical Infrastructure Protection: Collaboration for Extraordinary National Security Benefit

This paper examines national and tribal collaborative opportunities to get ahead of the critical infrastructure insecurity problem. Recommendations are viewed through the lens of the Sandia Labs Tribal Cyber-Energy initiative and national security projects. Recommendations include 1) Collaboratively address national priority and shared challenges to gain faster and better solutions to national priority problems on a smaller yet comprehensive American Indian and Alaskan Native sovereign single-point of authority scale 2) Utilize newer standards-based technologies to provide scalable, capable, and manageable solutions for greatly expanded and connected national critical infrastructures 3) Employ Cyber-Physical-Resilient design preliminary analysis to define concept- to-disposition design requirements for preemptive critical infrastructure risk mitigation and baked-in security; 4) Develop data-centric protection to provide increased information asset protection as data shifts from data-owner operated on-premises infrastructure to virtual service provider data-steward owned and operated off-premises infrastructure; and 5) Balance shared solutions with the National Institute of Science and Technology (NIST) Cybersecurity and Risk Management frameworks, and the System Security Engineering Guidelines. As yet unallocated federal funding would support research, development, the timely application of National-Tribal critical infrastructure protection, and critical infrastructure Cyber disruption response and recovery with extraordinary mutual benefits for the foreseeable future. The Critical Infrastructure Insecurity Problem: Rapid modernization and expansive connectivity are due to advances in Information and Communications Technologies that have sweeping cyber impact across all critical infrastructure sectors. Supervisory Control and Data Acquisition and Industrial Control Systems are particularly impacted as systems long separated from the Internet are now being connected and computerized. Virtualization and mobility create a Data Everywhere-User Anywhere paradigm that has evaporated the enterprise network perimeter. There are multi-front technological challenges at play, where long depended on technologies simply don't scale to current needs resulting in a digital dichotomy of competing old and new standards. New standards-based technologies scale but are not as well-known or as widely deployed, which leaves decision makers, stakeholders, and the workforce in a quandary, caught mid-stream between the technological past and the virtual future. Rapid and expansive cyber threat accompanies disruptive change in connectivity and computational dependencies. A lack of action will exacerbate the problem if new technologies roll out without baked-in security design. The Risk: If National-Tribal CIP collaboration to design in security is not done, then an ongoing state of insufficient bolt-on security and elevated threat exposure will remain for years to come.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗

University of Wisconsin-Madison Campus-Wide Deep Dive

In June 2019, staff members from the Engagement and Performance Operations Center (EPOC) and the University of Wisconsin–Madison Division of Information Technology (UW DoIT) met with researchers for the purpose of a Campus-Wide Deep Dive. The goal of this meeting was to help characterize the requirements for a number of research and educational activities, and to enable cyberinfrastructure support staff to better understand the needs of researchers. Material for this event includes both the written documentation from nine projects, and the campus technology organization, but also a writeup of the discussion that took place in person. The Case Studies highlighted the ongoing challenges that the University of Wisconsin–Madison will face in the coming years to support, encourage, and grow several emerging and established use cases. The University of Wisconsin–Madison received an NSF award to help support upgrading the campus network in 2012, specifically to include a Science DMZ and monitoring equipment. However, there is a currently identified need to refresh equipment and identify and work more closely with current campus researchers. Updates to the state network, as well as the campus, are being planned and were discussed during this event. As part of the overall review, the necessity of working more closely with research teams as they are still in the planning phase was discussed so that DoIT can better understand and adapt to changes in requirements as the research demands grow over time . Additional challenges with securing sensitive data, cybersecurity, and supporting collaborations were also discussed.

97 MATHEMATICS AND COMPUTING↗

Performance Assessments of Demand Flexibility from Grid-Interactive Efficient Buildings: Issues and Considerations

This SEE Action Network report explains basic concepts and fundamental considerations for assessing the actual demand flexibility performance of buildings participating in demand flexibility programs and responding to time-varying retail rates. Demand flexibility is the capability of distributed energy resources (DERs) to adjust a building’s load profile across different timescales. Assessments determine the timing, location, quantity, and quality of grid services provided. The results can be used for financial settlements and to improve performance of demand flexibility, support its consideration in resource potential studies and electricity system planning, and contribute to cost-effectiveness evaluations. While practitioners and regulators regularly find opportunities to improve performance assessments of demand-related services, to a large degree current best practices are sufficient for basic service offerings as demand flexibility is implemented today. However, advances in assessment practices will be required in a future with grid-interactive efficient buildings (GEBs) that provide continuous demand flexibility by integrating multiple DERs and flexibility modes (load shed, load shift, modulate, and generate). Example practices include using new baseline constructs—including whether baselines are even required for certain building flexibility modes or configurations, deploying more advanced metering and analytics, further developing cybersecurity standards, improving communication standards for increased interoperability, and establishing performance metrics and assessment procedures for load modulation as it is more fully defined and implemented. This report provides information on prioritizing and designing performance assessment elements for demand flexibility programs and time-varying retail rates, assessment protocols, and research and development needs. Additional research sponsored by DOE’s Building Technologies Office offers more detailed technical information on assessing performance of demand flexibility, including definition of performance metrics.

24 POWER TRANSMISSION AND DISTRIBUTION↗

Recommendations for Trust and Encryption in DER Interoperability Standards

Recently developed Distributed Energy Resource (DER) interoperability standards include communication and cyber security requirements. In 2018, the US national interconnection standard, IEEE 1547, was revised to require DER to include a Sun Spec Modbus, IEEE 2030.5 (Smart Energy Profile, SEP 2.0), or IEEE 1815 (DNP3) communication interface but does not include any normative overarching cybersecurity requirements. IEEE 2030.5 and associated implementation requirements for California, known as the California Smart Inverter Profile (CSIP), prescribe the greatest security features - including encryption, authentication, and key management requirements. Sun Spec Modbus and IEEE 1815 security requirements are not as comprehensive, leading to implementation questions throughout the industry. Further, while the security features in IEEE 2030.5 are commonly used in computing platforms, there are still questions of how well the technologies will scale in highly-distributed, computationally-limited inverter environments. In this paper, (a) the elements of IEEE 2030.5 encryption, authentication, and key management guidelines are analyzed, (b) potential scalability gaps are identified, and (c) alternative technologies are explored for possible inclusion in DER interoperability or cyber security standards.

42 ENGINEERING↗

Summer Proceedings 2018: The Center for Computing Research at Sandia National Laboratories

The Center for Computing Research (CCR) at Sandia National Laboratories organizes an active and productive summer program each year, in coordination with the Computer Science Research Institute (CSRI) and Cyber Engineering Research Institute (CERI). CERI focuses on open, exploratory research in cyber security in partnership with academia, industry, and government, and provides collaborators an accessible portal to Sandia's cybersecurity experts and facilities. Moreover, CERI provides an environment for visionary, threat-informed research on national cyber challenges. CSRI brings university faculty and students to Sandia National Laboratories for focused collaborative research on DOE computer and computational science problems. CSRI provides a mechanism by which university researchers learn about problems in computer and computational science at DOE Laboratories. Participants conduct leading - edge research, interact with scientists and engineers at the laboratories, and help transfer the results of their research to programs at the labs.

97 MATHEMATICS AND COMPUTING↗

FY 2021 Mid-Year HPC Utilization Report M3UF-21IN0701018

Idaho National Laboratory (INL), supported by the Department of Energy Office of Nuclear Energy (DOE-NE) through the Nuclear Science User Facilities, provides access to supercomputer systems and data storage along with support staff for system management, software installation, cybersecurity and user support to the broader DOE-NE user community. Users include individuals at universities, industry, and government laboratories enabling a wide range of research and development and mission-supporting activities. The availability of high-performance computing (HPC) capabilities is a key foundation of collaboration and innovation in nuclear energy systems research. HPC resources and INL directly support the mission and objectives of DOE-NE. From October 2020 through March 2021, INL HPC capabilities were utilized by a diverse set of computing and applied researchers, for a wide range of research and engineering activities. This report focuses on current INL HPC systems and utilization from October 1, 2020 through March 31, 2021.

99 GENERAL AND MISCELLANEOUS↗

Resilience Framework for Electric Energy Delivery Systems (R.1)

The intent of this document is to provide a Resilience Framework for electrical energy delivery systems which can be applied to Distributed Wind. However, the framework is not limited by application to any resource or system. This framework represents the defined steps to a cyclical process similar in mechanism to both cybersecurity and risk frameworks, while providing a common set of language and process for all stakeholders involved. The need for this Resilience Framework was established in a previous document, “Distributed Wind Resilience Metrics for Electric Energy Delivery Systems.” One important characteristic we see in resilience is the unique needs and perspectives of different systems, geographies, resources, stakeholders, perceived risks, and consequences, which we term the distinctiveness property. This distinctiveness property drives the requirement to have a resilience framework or methodology that can be implemented by different types of organizations and systems. The process or methodology should be cyclic. Recognizing that a system’s resilience is based on finite resources and time, it must continually evolve through this framework’s risk management and capital investment steps at an appropriate pace for its distinctiveness property.

17 WIND ENERGY↗

SAGE Intrusion Detection System: Sensitivity Analysis Guided Explainability for Machine Learning.

This report details the results of a three-fold investigation of sensitivity analysis (SA) for machine learning (ML) explainability (MLE): (1) the mathematical assessment of the fidelity of an explanation with respect to a learned ML model, (2) quantifying the trustworthiness of a prediction, and (3) the impact of MLE on the efficiency of end-users through multiple users studies. We focused on the cybersecurity domain as the data is inherently non-intuitive. As ML is being using in an increasing number of domains, including domains where being wrong can elicit high consequences, MLE has been proposed as a means of generating trust in a learned ML models by end users. However, little analysis has been performed to determine if the explanations accurately represent the target model and they themselves should be trusted beyond subjective inspection. Current state-of-the-art MLE techniques only provide a list of important features based on heuristic measures and/or make certain assumptions about the data and the model which are not representative of the real-world data and models. Further, most are designed without considering the usefulness by an end-user in a broader context. To address these issues, we present a notion of explanation fidelity based on Shapley values from cooperative game theory. We find that all of the investigated MLE explainability methods produce explanations that are incongruent with the ML model that is being explained. This is because they make critical assumptions about feature independence and linear feature interactions for computational reasons. We also find that in deployed, explanations are rarely used due to a variety of reason including that there are several other tools which are trusted more than the explanations and there is little incentive to use the explanations. In the cases when the explanations are used, we found that there is the danger that explanations persuade the end users to wrongly accept false positives and false negatives. However, ML model developers and maintainers find the explanations more useful to help ensure that the ML model does not have obvious biases. In light of these findings, we suggest a number of future directions including developing MLE methods that directly model non-linear model interactions and including design principles that take into account the usefulness of explanations to the end user. We also augment explanations with a set of trustworthiness measures that measure geometric aspects of the data to determine if the model output should be trusted.

97 MATHEMATICS AND COMPUTING↗

Development of an Assessment Methodology That Enables the Nuclear Industry to Evaluate Adoption of Advanced Automation

Nuclear power has a crucial role in providing safe, reliable, and economical carbon-free electricity for today and the future. For continued operation, many of the existing United States nuclear power plants will begin the subsequent license renewal process for extending their operating license periods. As plants extend their expected operating lifetimes, there is a significant opportunity to modernize. These plants have a much stronger business case with these extended mission periods to modernize and significantly enhance their economic viability in current and future energy markets by implementing digital technologies that support innovation, efficiency gains, and business-model transformation. Ensuring continued safety and reliability is crucial. Transformative digital technologies—including automation—that fundamentally change the concept of operation for the nuclear power plant operating model requires a critical focus on the human and technology integration element. Further, the nuclear industry has historically been reluctant to modernize due to having a risk adverse culture and lack of clarity for a transformative new state vision (Joe & Remer, 2019; Thomas et al., 2020). Common barriers include (1) the perceived value and return on investment (ROI) of digital technology, (2) the perceived risk associated with licensing, regulatory, and cybersecurity, and (3) insufficient guidance for performing digital modifications to power generation systems. This work presents a methodology to address these barriers and support the industry in adopting advanced automation and digital technology through developing a transformative vision and implementation strategy that will address the human and technology integration element. This research leverages previous LWRS Program and industry results. It draws specifically on previous LWRS Program research in the areas of advanced alarm systems, computer-based procedures, model informed decision support, and advanced human-system interface displays (e.g., overviews and task-based). The modernization methodology can be used to guide transformative thinking when integrating a set of vendor-specific capabilities to support a new concept of operations and a utility’s end-state vision. The results of this research are organized into six major sections: - Section 1 introduces the need for supporting large-scale digital modifications that will renew the technology base for extended operating life beyond 60 years - Section 2 describes the challenges that the nuclear industry is enduring with modernizing. - Section 3 summarizes the primary standards and guidance. - Section 4 presents earlier work from the LWRS Program regarding the development of a transformative conceptual design for an advanced control room of a hybrid plants. - Section 5 presents a methodology that is designed at addressing the challenges in the industry today in achieving a transformative new state vision and concept of operations. - Conclusions and next steps of this research are provided in Section 6.

99 GENERAL AND MISCELLANEOUS↗

Bridge Seismic Screening Tool (BSST), Version 2.0

The Regional Resiliency Assessment Program (RRAP) is a cooperative assessment of specific critical infrastructure within a designated geographic area and a regional analysis of the surrounding infrastructure that addresses a range of infrastructure resilience issues that could have regionally and nationally significant consequences. In 2018, DHS’s Cybersecurity and Infrastructure Security Agency (CISA) sponsored the Oregon Transportation Systems RRAP project in coordination with the Office of the Governor (under the oversight of the state resilience officer), the Oregon Office of Emergency Management (OEM), the Oregon Department of Transportation (ODOT), and other regional stakeholders (CISA 2021). This project focuses on assessing the impacts of a Cascadia Subduction Zone (CSZ) earthquake on state transportation systems and, in particular, how those impacts may affect the ability of emergency response efforts to move supplies into the region. The intended outcome of this analysis is the prioritization of transportation routes and modes for additional planning, investment, hardening, or other activities to enhance their resilience—and therefore, to enhance their ability to support response and recovery efforts following a CSZ earthquake. An important part of this transportation system-level assessment has been to assess the seismic vulnerability of the state highway system. In doing so, the RRAP project team used the Bridge Seismic Screening Tool (BSST) to assess, at a system-level, the potential impacts that a CSZ earthquake could have on state highway bridges (Bergerson et al. 2019).1 Argonne National Laboratory (Argonne), in collaboration with the Washington State Department of Transportation (WSDOT), originally developed the BSST as part of the 2017 Washington State Transportation Systems RRAP project, a sister project to the 2018 Oregon Transportation Systems RRAP project. Argonne updated the BSST during this more recent project in Oregon based on feedback from stakeholders and subject matter experts (SMEs) on the original version of the tool. The first step in the BSST is to assess the seismic vulnerability of roadway bridges following a CSZ earthquake to determine a projected or potential damage state. Damage states then help determine approximate reopening times for bridge crossings.2 This document provides details on the BSST methodology, the implementation of that tool to analyze the projected damage incurred in a CSZ earthquake scenario, and the determination of corresponding reopening times of interstate, state highway, and local bridges following such an event.

58 GEOSCIENCES↗

Recommendations for Distributed Energy Resource Patching

While computer systems, software applications, and operational technology (OT)/Industrial Control System (ICS) devices are regularly updated through automated and manual processes, there are several unique challenges associated with distributed energy resource (DER) patching. Millions of DER devices from dozens of vendors have been deployed in home, corporate, and utility network environments that may or may not be internet-connected. These devices make up a growing portion of the electric power critical infrastructure system and are expected to operate for decades. During that operational period, it is anticipated that critical and noncritical firmware patches will be regularly created to improve DER functional capabilities or repair security deficiencies in the equipment. The SunSpec/Sandia DER Cybersecurity Workgroup created a Patching Subgroup to investigate appropriate recommendations for the DER patching, holding fortnightly meetings for more than nine months. The group focused on DER equipment, but the observations and recommendations contained in this report also apply to DERMS tools and other OT equipment used in the end-to-end DER communication environment. The group found there were many standards and guides that discuss firmware lifecycles, patch and asset management, and code-signing implementations, but did not singularly cover the needs of the DER industry. This report collates best practices from these standards organizations and establishes a set of best practices that may be used as a basis for future national or international patching guides or standards.

97 MATHEMATICS AND COMPUTING↗

Power Over Ethernet Investigation Report

This report provides insight into collaboration between Savannah River National Laboratory’s (SRNL) Global Security Directorate, Augusta University (AU) and the Georgia Cyber Center (GCC) team with regards to device analysis, investigation, and R&D efforts. Most recently, the GCC/AU team approached SRNL to receive cybersecurity expertise in a joint effort to identify differences between a potentially questionable PoE injector recovered by Columbia County and an identical one purchased by the GCC. The questionable device was installed at a fire station operated in Columbia County, shown in the figure 1-1 below.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

Keyless Infrastructure Security Solution (KISS): VOLTTRON™ KSI ® Blockchain Design and Specification

This document provides the technical design specifications that are required for Keyless Infrastructure Security Solution (KISS) development, including, definitions and roles of the new KISS-related products—GridAware and LinkLite—an overview of the DNP3 communications the VOLTTRON™ DNP3 agent is using for distribution control, data flow, historian processing, setup, and installation. These technical specifications provide step-by-step instructions for configuration, implementation, and deployment of the KISS subsystem, docket creation, and verification using the GridAware dashboard. Based on this document and the KISS specification requirements and device risk assessment documents, KISS will be developed by integrating keyless signature infrastructure (KSI) blockchain to increase the cybersecurity, integrity, and trustworthiness of critical energy delivery systems (EDSs). The KISS architecture consists of a VOLTTRON™ agent-based distribution control system platform and GridAware (KSI blockchain capability) for secure energy exchanges in a decentralized electrical network.

42 ENGINEERING↗

Phasor-Measurement-Unit-Based Data Analytics Using Digital Twin and PhasorAnalytics Software

A major objective of this project was to apply GE’s commercial machine learning and data analytics toolsets to large-scale, real-world, anonymized Phasor Measurement Unit (PMU) datasets in order to extract signatures, correlated and/or causal factors, and precursor patterns associated with significant power system phenomena. The project had a particular emphasis on extraction of insights relevant to asset health monitoring, real-time load modeling and cybersecurity monitoring. Additionally, the team was directed to undertake a comprehensive data quality analysis for the provided datasets and encouraged to estimate the ‘machine-learning readiness’ of the datasets by documenting any major obstacles to the application of commercial machine learning algorithms. To accomplish the aforementioned objectives, the project team’s work centered around the identification of key event signatures and application of the identified event signatures for event detection and event classification. The industry-validated, semi-supervised machine learning strategy employed for event signature identification involved several major tasks, including data-preprocessing, generation of an overabundance of features, normal data identification, normality modeling, and event signature identification through a methodical, quantitative ranking of features in order of relevance to each studied event type. Throughout the project, data quality issues and mitigation techniques were investigated. In this report, insights are provided regarding the readiness of the provided synchrophasor datasets for application of machine learning and data analytics. The methodologies employed for this technical strategy are summarized in this report. With regards to data preprocessing and feature generation, the provided Training and Test Datasets were ingested into GE’s big data environment. Subsequently, the team applied bad data cleansing and data imputation scripts, event detection scripts, and application programming interfaces (APIs) to the datasets for convenient data access. The project team completed development and validation of dozens of physics-based, statistics-based and transformation-based feature functions used for the extraction of over 60 synchrophasor features. Using a new parallel feature generation technology developed on this project, over 60 features have been rapidly generated for the full two years’ worth of Training and Test Dataset data associated with both the Eastern and Western interconnects. Even accommodating for temporal down-sampling inherent to the feature extraction procedure, this parallel feature generation activity resulted in a massive feature set with a storage requirement approximately equal to that of the raw training dataset itself. With regards to normal data identification and normality modeling, a normality model was built using the feature data extracted from the Training Dataset and iteratively refined subsequent to incremental adjustments and expansions of the Training Dataset feature data. With respect to event characterization and signature identification, an event signature identification pipeline was developed and used in conjunction with the normality model to identify over 15 event signatures for key event categories within the Training Dataset. The identified event signatures were used to characterize hundreds of key events in terms of relative severity, duration, and location of the event. An investigation was undertaken to identify correlated and causal factors involved in transformer events. A separate investigation into temporal trends in ring-down analysis results was undertaken to determine possible associations between system dynamics and various other factors such as loading, season or year. To validate the identified event signatures, additional work was undertaken to develop signature-based anomaly detection and classification tools suitable for convenient application to the synchrophasor datasets. The anomaly detection and classification tools, suitable for online application, were then applied to the entirety of the Eastern Interconnect Training and Test Datasets. Performance of the event detection and classification tools was evaluated upon receipt of the Test Dataset event logs (i.e., the labels for events contained in the Test Dataset), and promising results were obtained despite several challenges (documented herein) associated with application of supervised or semi-supervised machine learning methods to large-scale, anonymized datasets. Finally, the detection and classification tools were used to detect, classify, and characterize thousands of new events not included in the original event logs provided by the DOE within both the Training and Test Datasets.

24 POWER TRANSMISSION AND DISTRIBUTION↗