Search NASA⌕ Search

SEARCH · Search NASA

Results for “Cyber Analytics”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 109 records · Page 6
All sourcesNASA NTRSDOE OSTI
DOE OSTI2024

Cyber Resilience and Social Equity: Twin Pillars of a Sustainable Energy Future

This paper examines the intersection of security and accessibility within energy systems amidst the rise of grid modernization and digitization, especially considering the regulatory changes and the imperatives of inclusive energy strategies. It addresses the dual need for secure, resilient infrastructure and a commitment to mitigate energy poverty while maintaining equitable access to energy. Amid escalating cybersecurity and physical threats, the paper advocates for sustainable energy delivery systems that ensure robust defenses without compromising the goals of reducing energy poverty and ensuring energy security. This paper identifies the pressing need for Cyber-Informed Engineering (CIE) and Secure-by-Design (SbD) principles, highlighting how these strategies can protect critical infrastructure and democratize access to secure energy, particularly for disadvantaged communities. The analysis underscores the challenges presented by the expansion of attack surfaces, interoperability requirements, and grid-edge analytics, offering innovative solutions that leverage advanced technologies and data-driven insights. Furthermore, this paper addresses the workforce development gap, emphasizing the necessity for public-private partnerships and vendor engagement in creating a skilled cybersecurity workforce. This paper has a dual focus on both the technological aspect of cybersecurity and the social dimension of equity within the context of sustainable energy development. It suggests a comprehensive examination of how these two critical elements interact and support the overarching goal of a sustainable energy future.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2018

Cyber–Physical Correlation Effects in Defense Games for Large Discrete Infrastructures

In certain critical infrastructures, correlations between cyber and physical components can be exploited to launch strategic attacks, so that disruptions to one component may affect others and possibly the entire infrastructure. Such correlations must be explicitly taken into account in ensuring the survival of the infrastructure. For large discrete infrastructures characterized by the number of cyber and physical components, we characterize the cyber–physical interactions at two levels: (i) the cyber–physical failure correlation function specifies the conditional survival probability of the cyber sub-infrastructure given that of the physical sub-infrastructure (both specified by their marginal probabilities), and (ii) individual survival probabilities of both sub-infrastructures are characterized by first-order differential conditions expressed in terms of their multiplier functions. We formulate an abstract problem of ensuring the survival probability of a cyber–physical infrastructure with discrete components as a game between the provider and attacker, whose utility functions are composed of infrastructure survival probability terms and cost terms, both expressed in terms of the number of components attacked and reinforced. We derive Nash equilibrium conditions and sensitivity functions that highlight the dependence of infrastructure survival probability on cost terms, correlation functions, multiplier functions, and sub-infrastructure survival probabilities. We apply these analytical results to characterize the defense postures of simplified models of metro systems, cloud computing infrastructures, and smart power grids.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2014

PMU Data Integrity Evaluation through Analytics on a Virtual Test-Bed

Power systems are rapidly becoming populated by phasor measurement units (PMUs) in ever increasing numbers. PMUs are critical components of today s energy management systems, designed to enable near real-time wide area monitoring and control of the electric power system. They are able to measure highly accurate bus voltage phasors as well as branch current phasors incident to the buses at which PMUs are equipped. Synchrophasor data is used for applications varying from state estimation, islanding control, identifying outages, voltage stability detection and correction, disturbance recording, and others. However, PMU-measured readings may suffer from errors due to meter biases or drifts, incorrect configurations, or even cyber-attacks. Furthermore, the testing of early PMUs showed a large disparity between the reported values from PMUs provided by different manufacturers, particularly when frequency was off-nominal, during dynamic events, and when harmonic/inter-harmonic content was present. Detection and identification of PMU gross measurement errors are thus crucial in maintaining highly accurate phasor readings throughout the system. In this paper, we present our work in conducting analytics to determine the trustworthiness and worth of the PMU readings collected across an electric network system. By implementing the IEEE 118 bus test case on a virtual test bed (VTB) , we are able to emulate PMU readings (bus voltage and branch current phasors in addition to bus frequencies) under normal and abnormal conditions using (virtual) PMU sensors deployed across major substations in the network. We emulate a variety of failures such as bus, line, transformer, generator, and/or load failures. Data analytics on the voltage phase angles and frequencies collected from the PMUs show that specious (or compromised) PMU device(s) can be identified through abnormal behaviour by comparing the trend of its frequency and phase angle reading with the ensemble of all other PMU readings in the network. If the reading trend of a particular PMU deviates from the weighted average of the reading trends of other PMUs at nearby substations, then it is likely that the PMU is malfunctioning. We assign a weight to each PMU denoting how electric-topology-wise close it is from where the PMU under consideration is located. The closer a PMU is, the higher the weight it has. To compute the closeness between two nodes in the power network, we employ a form of the resistance distance metric. It computes the electrical distance by taking into consideration the underlying topology as well as the physical laws that govern the electrical connections or flows between the network components. The detection accuracy of erroneous PMUs should be improved by employing this metric. We present results to validate the proposed approach. We also discuss the effectiveness of using an end-to-end VTB approach that allows us to investigate different types of failures and their responses as seen by the ensemble of PMUs. The collected data on certain types of events may be amenable to certain types of analysis (e.g., alerting for sudden changes can be done on a small window of data) and hence determine the data analytics architectures is required to evaluate the streaming PMU data.

and data analytics architecture.↗
DOE OSTI2017

Botnet behaviour analysis: How would a data analytics-based system with minimum a priori information perform?

Botnets, as one of the most aggressive threats, has used different techniques, topologies, and communication protocols in different stages of their lifecycle since 2003. Hence, identifying botnets has become very challenging specifically given that they can upgrade their methodology at any time. Various detection approaches have been proposed by the cyber-security researchers, focusing on different aspects of these threats. In this work, 5 different botnet detection approaches are investigated. These systems are selected based on the technique used and type of data used where 2 are public rule–based systems (BotHunter and Snort) and the other 3 use machine learning algorithm with different feature extraction methods (packet payload based and traffic flow based). On the other hand, 4 of these systems are based on a priori knowledge while one is using minimum a priori information. The objective here is to evaluate the effectiveness of these approaches under different scenarios (eg, multi-botnet and single-botnet classifications) as well as exploring how a system with minimum a priori information would perform. The goal is to investigate if a system with minimum a priori information could result in a competitive performance compared to systems using a priori knowledge. The evaluation is shown on 24 publicly available botnet data sets. Results indicate that a machine learning–based system with minimum a priori information not only achieves a very high performance but also generalizes much better than the other systems evaluated on a wide range of botnet structures (from centralized to decentralized botnets).

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2018

Stream-Processing Architecture for Real-time Cyber-physical Security (SPARCS) v0.9

The Stream-Processing Architecture for Real-time Cyber-physical Security is a generalized framework for extracting power-related sensor information from sensors, optionally analyzing that data on computing platforms local to the sensors, transmitting that information to a central location, storing that information, running centralized analytics on the information, and providing both API and visual access to that information.

Mcparland, Charles McparlandP↗
DOE OSTI2026

Quantifying the Operational Impacts of Cyber Events on Enterprise Network Environments

The "Quantifying the Operational Impacts of Cyber Events on Enterprise Network Environments" Feasibility Study addressed the question: Can an existing (novel) class of network characterization and change detection algorithms previously developed at LLNL for internal enterprise datasets, be effectively applied to assess and measure the analytic value of features derived from datasets composed of passively collected RF and wireless network data?

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

Network Slicing for Federated Learning in Operational Technology Environment

Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) environments are essential to modern infrastructure, facing challenges in ensuring low-latency, high-throughput communication while mitigating cyber threats. This paper presents a framework integrating Federated Learning (FL) and network slicing with Quality of Service (QoS) to enable real-time monitoring without disrupting OT operations. Leveraging digital twin technology and Network Function Virtualization (NFV), the architecture supports predictive analytics and Industry 4.0 requirements. FL facilitates decentralized model training, preserving data privacy and scalability, though it introduces potential throughput constraints. Network slicing addresses this by creating dedicated virtualized segments optimized for performance and security. Advanced fault tolerance at the container and instance levels enhances system reliability. The proposed architecture ensures high throughput, low latency, and secure orchestration for real-time anomaly detection in OT networks. Performance evaluations validate its efficiency in throughput, deployment, and learning accuracy, providing a robust foundation for future ICS automation and data-driven decision-making.

Delgado, Brian G. Rodiles [University of Texas at ↗
NASA NTRS1981

Studies of compressible shear flows and turbulent drag reduction

Compressible shear flows and drag reduction were examined and three methods are addressed: (1) the analytical and numerical aspects of conformal mapping were summarized and a new method for computation of these maps is presented; (2) the computer code SPECFD for solution of the three dimensional time dependent Navier-Stokes equations for compressible flow on the CYBER 203 computer is described; (3) results of two equation turbulence modeling of turbulent flow over wavy walls are presented. A modified Jones-Launder model is used in two dimensional spectral code for flow in general wavy geometries.

Orszag, S. A.↗
DOE OSTI2024

MFANS 2024 - Formally Proving Characteristics of Cyber-Physical Systems

Cyber-physical systems (CPS) are engineered systems that rely on the smooth integration of computational algorithms and physical elements. This integration presents new challenges for verifying that systems will behave as expected. The goal of this presentation is to present current challenges and potential solutions for the formal verification of cyber-physical systems. For cyber systems, formal methods refer to systematically rigorous mathematical techniques employed in the specification, development, analysis, and verification of both software and hardware systems. Recent advancements in computer science have yielded sophisticated tools specifically designed to address challenges associated with formal methods in complex systems. These tools leverage various foundational concepts such as logic, formal languages, program semantics, type systems, type theory, and automata theory. A notable achievement in the application of formal methods is the seL4 microkernel, claimed to be the first general-purpose operating-system kernel to be verified. Its proof implies the absence of bugs and guarantees that the kernel meets specifications. For physical systems, dynamic and control theory has a history of using rigorous analytic techniques to prove functional correctness. Lyapunov, optimal, classical, modern, and robust control theories all provide rigorous mathematical methods both to analyze system performance and to design controller that can be guaranteed to meet certain objectives. Recent computational techniques like level set theory and reachability analysis provide assertions that a system's state will avoid unsafe regions. Even though success has been independently achieved for cyber systems and physical systems, the integration of such systems creates new challenges. In particular, there is an obvious discrepancy between finite-state machines and infinite-state systems, resulting in different approaches for modeling and analyzing these system. While it is possible to simulate hybrid systems, this provides only a demonstration of a performance and not proof. For hybrid systems, current formal methods and system analysis approaches typically require a workarounds to work on hybrid systems like CPS. This paper will outline the state of the art and limits of current practice for formally verifying CPS and will identify possible research directions that require attention.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

Enhancing grid reliability and resilience through novel DER control, total situational awareness and integrated distribution-transmission representation

High penetration of distributed energy resources (DERs) can lead to overvoltage and thermal violations, miscoordination of protection devices and potential adverse control interactions. The challenges are exacerbated by a lack of operator situational awareness of behind-the-meter DERs, and T&D interactions. Furthermore, the large attack surface of a DER environment creates significant cyber security challenges. The motivation is to address these barriers. The main goal is to enable extreme levels of DERs in distribution systems while simultaneously enhancing their reliability and resiliency. This is achieved by a data-driven approach for operation, planning and control of distribution systems with total situational awareness and real-time DER control enabled by a network of edge intelligent devices, a cloud-based analytical platform, and secure communications.

14 SOLAR ENERGY↗
DOE OSTI2015

Defense of Cyber Infrastructures Against Cyber-Physical Attacks Using Game-Theoretic Models

The operation of cyber infrastructures relies on both cyber and physical components, which are subject to incidental and intentional degradations of different kinds. Within the context of network and computing infrastructures, we study the strategic interactions between an attacker and a defender using game-theoretic models that take into account both cyber and physical components. The attacker and defender optimize their individual utilities expressed as sums of cost and system terms. First, we consider a Boolean attack-defense model, wherein the cyber and physical sub-infrastructures may be attacked and reinforced as individual units. Second, we consider a component attack-defense model wherein their components may be attacked and defended, and the infrastructure requires minimum numbers of both to function. We show that the Nash equilibrium under uniform costs in both cases is computable in polynomial time, and it provides high-level deterministic conditions for the infrastructure survival. When probabilities of successful attack and defense, and of incidental failures are incorporated into the models, the results favor the attacker but otherwise remain qualitatively similar. This approach has been motivated and validated by our experiences with UltraScience Net infrastructure, which was built to support high-performance network experiments. In conclusion, the analytical results, however, are more general, and we apply them to simplified models of cloud and high-performance computing infrastructures.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Modeling Gray Zone Tactics Used Against Green Energy Supply Chains

This report documents a project demonstrating capabilities within Lawrence Livermore National Laboratory’s Cyber and Infrastructure Resilience program to place newly developed numeric simulations into the current, larger geopolitical context. The emergence of state-backed gray zone threats introduces an unprecedented challenge because they fall short of armed conflict and involve ambiguous tactics, requiring a fresh analytical approach to understanding their potential impact and countering them. In the context of our project, we analyze how China might use gray zone tactics to degrade the power of the United States, including our influence over global efforts to combat climate change.

25 ENERGY STORAGE↗
DOE OSTI2013

Data-Intensive Visual Analysis for Cyber Security

Protecting communications networks against attacks where the aim is to steal information, disrupt order, or harm critical infrastructure can require the collection and analysis of staggering amounts of data. The ability to detect and respond to threats quickly is a paramount concern across sectors, and especially for critical government, utility and financial networks. Yet detecting emerging or incipient threats in immense volumes of network traffic requires new computational and analytic approaches. Network security increasingly requires cooperation between human analysts able to spot suspicious events through means such as data visualization and automated systems that process streaming network data in near real-time to triage events so that human analysts are best able to focus their work.

Pike, William A.↗
NASA NTRS1980

Aircraft equilibrium spin characteristics

Program provides analytic solutions to nonlinear equations of motion describing spin conditions. Stability characteristics also are determined. Program can be used to study effects of aerodynamic and inertial parameters on spin and could be modified to compute equilibrium conditions for steady maneuvers. Program is written in FORTRAN IV for batch execution on CYBER 173.

Adams, W. M., Jr.↗
DOE OSTI2020

A PROVEN APPROACH FOR EFFECTIVE COMPUTER SECURITY SELF-ASSESSMENTS AT NUCLEAR FACILITIES

A proven method for conducting cybersecurity self-assessments at nuclear power plants is now available for international use. This method was originally developed by Pacific Northwest National Laboratory, under the sponsorship of the U.S. Nuclear Regulatory Commission (NRC), for use at U.S. nuclear power plants. The “Method,” described in NUREG/CR-6847 “Cyber Security Self-Assessment Method for U.S. Nuclear Power Plants,” was originally a limited release document that was withheld from public disclosure but is now publicly available. The Method provides a systematic, phased, and risk-informed approach to help decision makers and security specialists understand their relative cybersecurity posture. Completed Method assessments may be used to support or validate selection of computer security controls to mitigate cyber threats as well as demonstrate compliance with regulations or statutes enacted by competent authorities. The Method assesses the cybersecurity posture of key systems at a nuclear facility with a focus on protection of design base functions. It considers both physical and digital elements of system vulnerabilities and the resulting potential consequences from exploitation. It is well-suited for addressing blended cyberattacks. A semi-quantitative analytical approach is used in the evaluation of potential vulnerabilities, consequences, and risks and provides a technical basis for the selection of security controls to mitigate cyberattacks. The Method’s application at U.S. nuclear power plants has been very encouraging. The only nuclear plant in the United States that did not have adverse findings during its initial NRC computer security inspection prepared for inspection through the diligent application of this self-assessment method and the implementation of recommendations that came out of that self-assessment. Nuclear facilities around the world might find application of the Method extremely helpful for making cost-effective, risk-based decisions regarding computer security and for preparing to pass computer security inspections by their competent authorities.

Cyber security, Nuclear security, Self-assessment↗
DOE OSTI2019

Grid Data Crossing Platform (GriD-Xing)

This project is to develop a data management and analytics platform called Grid Data Crossing (GriD-Xing) that integrates data processing, storage, analysis, and visualization functionalities for users at industry (e.g., EMS and DMS) and universities. It intends to increase the applicability of large set of multi-source data (e.g., SCADA, PMU, μPMU, AMI, inverter, load/DER forecasting, and cyber data) and eventually improve the resilience, reliability, and security of critical energy infrastructure. GriD-Xing also intends to be a research platform to identify the usefulness of large multi-source data via case studies of interest to industry (e.g., 2011 southwest cold weather and 2016 Blue Cut fire events). In the first year, the team focused on the development and demonstration of large multi-source data (e.g., PMU, μPMU, SCADA, AMI, and cyber data) processing, storage, and analysis. Specifically, the team designed GriD-Xing framework in functional and structural aspects, developed GriD-Xing algorithms for large multi-source grid data processing, storage, and analysis, and finally demonstrated GriD-Xing prototype algorithms performance through a series of tests and case studies using real-world and simulation data.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2023

Function-based Taxonomy Implementation

Function-based taxonomies are relational mapping tools used to clearly illustrate how an organization delivers Critical Functions by using various people, processes, technologies, information, and infrastructure (PPTII). Critical Functions are the actions or activities that make up the organization’s primary purpose. Enabling Functions are the combination of PPTII used by the organization to deliver their Critical Functions. A function-based taxonomy provides a framework to categorize information and related artifacts that document an organization’s unique implementation of PPTII for Critical Function delivery. The ideal state of a function-based taxonomy is to organize the existing knowledge the organization already has throughout their numerous systems, policies, people, procedures, and configurations. A well-organized taxonomy helps organizations to effectively leverage their knowledge by clearly identifying dependencies and connections. This document is the result of combined engineering and analytical experience and describes a repeatable method for producing function-based taxonomies.

42 ENGINEERING↗
DOE OSTI2025

Enhancing Security and Resiliency in Operational Technology Environments Through Network Slicing and Federated Learning

The growing convergence of Information Technology (IT) and Operational Technology (OT) within Industry 4.0 environments has introduced new demands on industrial network infrastructure. As cyber-physical systems become increasingly interconnected, ensuring the secure, timely, and efficient exchange of critical data is essential. This thesis explores how network slicing, a method of creating isolated virtual network segments, can be applied within OT environments to address challenges such as latency, security, and resource allocation. The first research question addressed in this thesis is: How can OT networks take advantage of NFV and SDN technology to become cyber resilient? This study examines the operational, security, and architectural implications of introducing network slicing into traditionally static OT infrastructures such as Industrial Control Systems (ICS) and SCADA. Through simulated deployments and case studies, the research demonstrates how slicing enables better isolation between critical and non-critical services, thereby improving response time, throughput, and security in sensitive environments. The second question considers: How to dynamically implement network slicing and take advantage of network resources towards integrating decentralized machine learning? In response, this thesis proposes a framework that combines Software-Defined Networking (SDN), Network Function Virtualization (NFV), and Federated Learning (FL) to enable real-time analytics while maintaining data locality. The proposed approach reduces the burden on centralized infrastructure and minimizes privacy risks by supporting on-site training of models across distributed OT nodes, coordinated through dynamically allocated network slices. The third focus explores: How slicing helps to increase the resiliency of OT networks through the orchestration of a dynamic DMZ? To answer this, the thesis presents a method for creating and managing Dynamic Demilitarized Zones (DMZs) using network slicing. This enables flexible and automated isolation of sensitive subsystems during threat scenarios or high-risk operations. Coupled with intelligent orchestration and containerized security services, the dynamic DMZ significantly enhances the system's ability to respond to cyber incidents without halting production. Ultimately, this thesis contributes a comprehensive architecture that blends network slicing with machine learning, secure segmentation, and automation, paving the way for resilient, adaptive, and intelligent OT environments. Performance evaluations across multiple scenarios show improvements in system reliability, threat response time, model accuracy, and resource utilization, providing a strong foundation for future industrial automation systems.

Rodiles Delgado, Brian G↗