Search NASA⌕ Search

SEARCH · Search NASA

Results for “Threat Detection”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 109 records · Page 6
All sourcesNASA NTRSDOE OSTI
DOE OSTI2023

Evaluation of the Feasibility of Utilizing a Low-Cost UWB Radar for Hardware Implant & Counterfeit Device Detection

Hardware implants & counterfeit devices in the US power grid pose a significant national security threat. Asset owners currently have few options for detecting the presence of such devices “in the wild”. The goal of this work is to develop a non-invasive sensing method to solve this problem. In this work we evaluate the feasibility of implementing a nonlinear UWB radar tomography system to differentiate between electronic internals of externally-similar devices using low-cost off-the-shelf hardware.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2025

SURVEILLANCE DETECTION FOR TRANSPORTATION OPERATIONS PERSONNEL TO PREVENT HIJACKING, THEFT, SABOTAGE, AND MALICIOUS SECURITY EVENTS DURING TRANSPORTING NUCLEAR MATERIAL

The secure transportation of high-consequence materials, including nuclear and radiological assets, is a critical global priority in the face of escalating terrorism, security threats, and violent protests targeting these operations. Effective surveillance detection—the ability to identify, assess, and respond to potential threats across a continuum of scenarios—is paramount in addressing these challenges. This paper outlines a phased, multi-tiered training program designed to strengthen the surveillance detection capabilities of organizations responsible for nuclear material transport. The proposed training program adopts a progressive approach, gradually increasing in technical complexity to provide participants with comprehensive knowledge and tools for implementing robust security strategies. It targets a wide spectrum of stakeholders, including competent authorities, regulators, inspectors, shippers, carriers, law enforcement, and emergency response personnel, equipping them to plan, evaluate, and safeguard nuclear material transportation effectively. Each phase of the program emphasizes distinct elements of the surveillance detection continuum and transport security, focusing on critical topics such as threat identification, adversary task timelines, protective methodologies, and attack mitigation strategies. The training framework is anchored in technical exchanges and scenario-driven courses that reflect real-world complexities and challenges. By addressing the surveillance detection continuum comprehensively—from early threat assessment to active countermeasures—the program reinforces global efforts to secure nuclear assets. It aligns with international security objectives and fosters a strong security culture within participating organizations, ensuring personnel are prepared to counter potential threats and maintain the safe, secure movement of these materials. Ultimately, this initiative aims to enhance preparedness, security, and response capabilities, supporting the global mission to safeguard high-consequence materials against evolving threats.

Zineddin, Dr. Z. [ORNL] (ORCID:0009000848740725)↗
DOE OSTI2024

Energy Delivery Systems with Verifiable Trustworthiness (Final Report)

Energy Delivery Systems (EDS) must be verified to be free from intrusive and malicious software. One way of verifying this software is to perform device scans to detect malicious code. Because it is possible to have “fileless” malware that exists only in device (volatile) memory, offline scanning and even many forms of online scanning is insufficient for detection. This project (“Verify”) addresses this need by performing direct sampling of memory during device operation to detect unexpected or modified software while not interfering with device operation. The Verify project provides a proof-of-concept of detection by random sampling combined with remote software- and timing-based attestation methods for robust detection of in-memory threats. An external review of Verify was performed by our partner, General Electric (GE), and a summary of their findings is provided.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

Safe Operations at Roadway Junctions: Intelligent Roadway Infrastructure as Functional Interlocking

Automated vehicle (AV) technology is quickly maturing, and the corresponding infrastructure systems that evaluate traffic and communicate to vehicles requires sophisticated sensing and perception technologies, referred to as intelligent roadway infrastructure (IRI), to complement emerging AV capabilities. IRI provides signals to vehicles, indicating right-of-way for vehicles and communicating to approaching AVs that no other vehicle is failing to yield. This capability, denoted as safety-affirmative signaling, provides a green light or a green arrow as appropriate and affirms through communication links to connected vehicles when it is safe to proceed. About 36% of collisions occur at intersections, with most occurring upon left turns (22.2%) or crossing over (12.6%), and only a small percentage (1.2%) while turning right at an intersection. Of all intersection crashes about half (52.5%) of those vehicles were traveling through a signalized intersection 2. Safety-affirmative signaling would guarantee safety of AV fleet vehicles, by providing the interlocking principle, a term from automated train control that only allows progression through a railway intersection after affirming no opportunity for a crash exists. IRI through safety-affirmative signaling would bring performance and safety to complex roadway intersections where AV transit fleet service is most needed, as well as safety benefits to traditional, non-automated vehicles and vulnerable road users. The implementation of IRI has functional, programmatic, and technical challenges. Research work performed at the National Renewable Energy Laboratory (NREL) in an integrative approach encapsulating these themes, and termed infrastructure perception and control (IPC) is motivated by improved performance (travel time), improved safety (reduced collisions), and improved energy efficiency (less fuel burned and minimized production of greenhouse gases). IPC is intended not only for roadway and intersection applications but also in extension to inform complementary buildings and grid systems to enable better co-management, as vehicles and their charging needs become increasingly integrated into the built environment. The NREL IPC project presents an open-source framework, architecture, and supporting technology to implement IRI, addressing critical issues such as fusion of data, reliability, standardization of data interfaces, and confidence of detection. The framework is informed by previous experience in U.S. Department of Defense research technology, specifically in the use of radar to detect, identify, and track aerial threats. These principles combined with multi-sensor fusion provides for a complete digital twin with known and measurable confidence and accuracy from which safety-affirmative signaling can be developed and deployed.

ADVANCED PROPULSION SYSTEMS,MATHEMATICS AND COMPUT↗
DOE OSTI2024

A Hybrid Anomaly Detection Approach for Obfuscated Malware

With the rapid evolution of malicious software, cyber threats have become increasingly sophisticated, employing advanced obfuscation techniques to evade traditional detection methods. This study presents a hybrid anomaly detection approach applied to obfuscated malware. Even though there is a large body of research in this field, existing malware detection techniques have some drawbacks, such as requiring large amounts of data, trustworthiness (imprecise results) of algorithms, and advanced obfuscation. To overcome these challenges, there is a need to employ solid and efficient techniques for malware detection. This paper proposes a hybrid approach, combining an autoencoder with traditional machine-learning methods to create an efficient malware detection framework. We used the malware memory dataset (MalMemAnalysis-2022) to evaluate this framework. The results indicate that our proposed approach can detect obfuscated malware when a deep autoencoder used for feature learning is combined with logistic regression, and it is extremely fast with an Accuracy, Detection Rate (DR), Matthew Correlation Coefficient(MCC), and Statistical Parity Difference

malware detection, Hybrid Anomly Detection, Obfusc↗
DOE OSTI2024

Enhancing Network Anomaly Detection Using Graph Neural Networks

In the world of Internet of Things (IoT) networks, where devices are constantly communicating, keeping them secure from cyber threats is critical. This paper introduces a novel approach to detecting unusual and potentially harmful activities in these networks using graph neural networks (GNNs). We combine two specific types of GNNs-GraphSAGE and graph attention networks (GAT)-to create a model that understands and represents the behaviors and interactions in a network. GraphSAGE creates an embedding of network activities by examining local data interactions, while GAT directs the model's focus to the most critical interactions. By integrating these two methods in a single model that considers different types of interactions (both host and flow nodes), we aim to create a system that accurately represents the current state of a network and can also spot anomalies effectively while reducing false positives and negatives. Our innovative approach has demonstrated promising results, achieving an accuracy of 98% on the UNSW-NB15 dataset, significantly outperforming standalone GraphSAGE and GAT models. This underscores its potential as a robust framework for securing IoT networks against cyber threats and anomalies.

Marfo, William↗
DOE OSTI2025

Threat Hunt Guide for BESS Environments

The rapid digitalization of the electric grid - driven by the integration of inverter-based resources (IBRs), battery energy storage systems (BESS), and advanced grid control platforms - has significantly enhanced grid efficiency, visibility, and flexibility. However, this evolution also introduces new cybersecurity risks, particularly through supply chain dependencies and operational blind spots at the grid edge. To address these challenges, Idaho National Laboratory (INL), through the Department of Energy (DOE) Office of Cybersecurity, Energy Security, and Emergency Response (CESER) Rapid Risk initiative, conducted a series of rapid risk assessment engagements with energy organizations across the United States. Drawing on lessons learned from these engagements, INL developed the following threat hunting guide for asset owners and operators (AOOs) to enhance their cybersecurity visibility within BESS and IBR systems. The guide demonstrates how to use passive network monitoring to baseline device behavior, detect adversarial activity, and investigate anomalies without disrupting operations. By implementing these practices, energy sector stakeholders can improve coordination between cybersecurity and operations teams and strengthen the resilience of distributed energy resources (DERs) within the modern power grid. Prior to implementing any network monitoring, packet capture, or threat hunting activity described in this guide, AOOs are strongly advised to review applicable governance frameworks, legal requirements, and organizational policies. This guide is intended for informational and educational purposes only. It does not replace compliance with any federal, state, or local cybersecurity mandates or industry standards. Implementation of described configurations, technologies, or analytic workflows is performed at the discretion and responsibility of the asset owner and operator.

25 - ENERGY STORAGE↗
DOE OSTI2021

Supercooled Liquid Water Detection Capabilities from Ka-Band Doppler Profiling Radars: Moment-Based Algorithm Formulation and Assessment

The occurrence of supercooled liquid water in mixed-phase cloud (MPC) affects their cloud microphysical and radiative properties. The prevalence of MPCs in the mid- and high latitudes translates these effects to significant contributions to Earth’s radiative balance and hydrological cycle. The current study develops and assesses a radar-only, moment-based phase partition technique for the demarcation of supercooled liquid water volumes in arctic, MPC conditions. The study utilizes observations from the Ka band profiling radar, the collocated high spectral resolution lidar, and ambient temperature profiles from radio sounding deployments following a statistical analysis of 5.5 years of data (January 2014–May 2019) from the Atmospheric Radiation Measurement observatory at the North Slope of Alaska. The ice/liquid phase partition occurs via a per-pixel, neighborhood-dependent algorithm based on the premise that the partitioning can be deduced by examining the mean values of locally sampled probability distributions of radar-based observables and then compare those against the means of climatologically derived, per-phase probability distributions. Analyzed radar observables include linear depolarization ratio (LDR), spectral width, and vertical gradients of reflectivity factor and radial velocity corrected for vertical air motion. Results highlight that the optimal supercooled liquid water detection skill levels are realized for the radar variable combination of spectral width and reflectivity vertical gradient, suggesting that radar-based polarimetry, in the absence of full LDR spectra, is not as critical as Doppler capabilities. The cloud phase masking technique is proven particularly reliable when applied to cloud tops with an Equitable Threat Score (ETS) of 65%; the detection of embedded supercooled layers remains much more uncertain (ETS = 27%).

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2023

Standoff trace explosives vapor detection at meter distances

Vapor detection is a noncontact sampling method, which is a less invasive means of explosives screening than physical swiping. Explosive vapor detection is a challenge due to the low levels of vapors available for detection. This study demonstrates that the parts-per-quadrillion sensitivity of atmospheric flow tube-mass spectrometry (AFT-MS) combined with a high-volume air sampler enables standoff detection of trace explosives vapor at distances of centimeters to meters. Standoff detection of explosives vapor was possible both upstream and downstream of the vapor source relative to room air currents. RDX vapor from a saturated source was detected at up to 2.5 m. Vapors from RDX residue and nitroglycerin residue were detected at distances up to 0.5 m. The sampling can be optimized by accounting for air movement in the room or environment, which could further extend standoff detection distances. In conclusion, using AFT-MS with a high-volume sampler could also be effective for standoff vapor detection of drugs and additional chemical threats and could be useful for security screening applications such as at mail facilities, border crossings, and security checkpoints.

47 OTHER INSTRUMENTATION↗
DOE OSTI2025

Securing Smart Manufacturing: Detection of Cyber-Physical Attacks in CNC-Based Systems

As Industry 4.0 advances, the integration of computer numerical control (CNC) machines and advanced manufacturing technologies is transforming production into smart manufacturing systems that blend physical and digital processes as cyber-physical systems. However, this increased cyber-physical connectivity exposes manufacturing systems to cyber threats that can cause severe operational and financial disruptions. This paper presents a comparative study on cyber attacks and anomaly detection techniques in manufacturing, focusing on network traffic from CNC machines. The data extracted from network packets includes machine commands and control signals exchanged between the machine's interface and control system, crucial for maintaining operational integrity. We explore two types of cyber attacks, design modification and command injection, which pose substantial risks to CNC machine productivity and system integrity. Our investigation involves experiments on a real CNC system, highlighting the urgent need for effective detection mechanisms. To address these threats, we evaluate three anomaly detection methods: dynamic time warping (DTW), rolling average, and a deep learning, long short-term memory (LSTM) time-series-based autoencoder. Each is assessed for its effectiveness in identifying anomalous behaviors caused by the attacks. Our findings demonstrate the unique strengths and limitations of each detection technique, providing a deeper understanding of their applicability in realworld manufacturing environments. The comparative analysis indicates that while certain methods are highly effective against specific attack types, others offer broader applicability across different attacks. This study contributes to the accurate detection of anomalies in CNC machining processes, thereby enhancing the reliability and security of smart manufacturing systems against diverse cyber threats.

Williams, Bethanie [Tennessee Technological Univer↗
DOE OSTI2025

Reversible parts-per-trillion-level detection of perfluorooctane sulfonic acid in tap water using field-effect transistor sensors

Widespread, persistent and toxic per- and polyfluoroalkyl substances (PFAS) pose a major threat to water systems and human health. Current detection methods are relatively expensive, slow and complex, underscoring the need for more accessible alternatives to meet increasingly stringent PFAS regulations. Here, in this study, we present an ultrasensitive sensing platform for perfluorooctane sulfonic acid detection in tap water with a reporting limit ( ~ 250 parts per quadrillion) lower than the US Environmental Protection Agency’s regulatory standard (4 parts per trillion), using a remote gate field-effect transistor featuring β-cyclodextrin (β-CD)-modified reduced graphene oxide as the sensing membrane. The sensor exhibits excellent selectivity against common inorganic ions, natural organic matter and select organic pollutants in tap water. The reversible and rapid response ( < 2 min) indicates the potential of remote gate field-effect transistor for continuous in-line monitoring. Mechanistic studies using quartz crystal microbalance and molecular dynamics simulations reveal key roles of analyte adsorption and charge properties in sensing performance and offer insights for designing more selective PFAS capture probes.

Wang, Yuqin [University of Chicago, IL (United Sta↗
DOE OSTI2022

Ransomware Attack Modeling and Artificial Intelligence-Based Ransomware Detection for Digital Substations

Ransomware has become a serious threat to the current computing world, requiring immediate attention to prevent it. Ransomware attacks can also have disruptive impacts on operation of smart grids including digital substations. This paper provides a ransomware attack modeling method targeting disruptive operation of a digital substation and investigates an artificial intelligence (AI)-based ransomware detection approach. The proposed ransomware file detection model is designed by a convolutional neural network (CNN) using 2-D grayscale image files converted from binary files. Here, the experimental results show that the proposed method achieves 96.22% of ransomware detection accuracy.

artificial intelligence↗
DOE OSTI2019

Demonstration of the Cybersecurity Framework through Real-world Cyber Attack

The Cybersecurity Framework (CSF) developed by the National Institute of Standards and Technology Cybersecurity, provides five concurrent and continuous functions to Identify, Protect, Detect, Respond, and Recover from cyber threats and vulnerabilities to buildings. Based on the core architecture and security best practices defined in the CSF guidelines, we developed the CSF webtools. The CSF webtools provide actionable functions that can be easily adopted by a facility operator to enhance their critical infrastructure security. The essence is captured in a set of “how-to” instructions for the facility operators to adopt, adapt, and apply to their critical infrastructure facilities. When considered together, these functions provide a high-level, strategic view of the lifecycle of an organization’s cybersecurity risk management. The CSF webtools provide an easy to follow set of cybersecurity best practices, policies, and procedures to improve the cybersecurity posture of our nation’s buildings and other critical infrastructures. The CSF webtools are also designed to facilitate communication of cybersecurity activities and outcomes across the organization from the executive to operations levels. Finally, the CSF webtools allow the critical infrastructure operators to assess the overall cybersecurity maturity and posture. The goal of this paper is to demonstrate the capabilities of the CSF webtools through an illustrative cyber-attack based on a real-world scenario.

cybersecurity framework, maturity model, critical ↗
DOE OSTI2023

Sensor and Actuator Attacks on Hierarchical Control Systems with Domain-Aware Operator Theory

Cyber-Physical Systems (CPSs) provide opportunities for cyber attacks to have physical impacts. Advanced Persistent Threats (APTs) are a subclass of cyber threats that act stealthily to avoid detection and enable long-term attacks. Here, we build on our past work in APT modelling to combine deception-based sensor bias attacks and direct actuator manipulations in attacks against a hierarchical control system. That past work used the Koopman operator to develop a data-driven, domain-aware, optimization-based attacker model. Using an expansion of this model, we compute several different attacks, including multiple simultaneous attacks, against a high-fidelity commercial building emulator and compare the impacts of those attacks to each other. One next step of interest is to construct a defender system, built on the same modelling approach, designed to detect and mitigate such attacks.

koopman operator, Cyber-Physical Security, machine↗
DOE OSTI2020

SEDONA: SpEctroscopic Detection of Nerve Agents

Los Alamos National Laboratory developed the only portable screener to accurately detect the chemical nerve agents, providing results in seconds. Current airport detection system cannot scan for the threat of organophosphorus nerve agents and insecticides. Small quantities of these toxic chemicals can very quickly cause widespread exposure and severe symptoms. SEDONA screens through an unopened bottle using the principles of nuclear magnetic resonance spectroscopy. The system could be deployed and operated with minimal training. SEDONA dramatically reduces the likelihood of a successful nerve agent attack at airports, government buildings, embassies, sporting events, concerts, and political rallies.

47 OTHER INSTRUMENTATION↗
DOE OSTI2023

MCNP ® Code V.6.3.0 Release Notes

The Monte Carlo N-Particle ® (MCNP ® ) code is a general-purpose, continuous-energy, generalized geometry, time-dependent, radiation transport code developed by the MCNP development team. The MCNP calculations provide predictive capabilities that can replace expensive or impossible-to perform experiments. Specific application problems include simulations of experimental diagnostics, intrinsic radiation, radiation detection and measurement, criticality safety, nuclear threat reduction and response, radiation health protection, nuclear weapons effects, and nuclear forensics. This MCNP code, version 6.3.0, follows the MCNP6.2.0 version. Since the release of MCNP6.2.0, many changes have been made to the MCNP code. These changes include new or improved features, a new build system, code enhancement and modernization, and bug fixes. The MCNP code, version 6.3.0, theory and user input information is documented in MCNP ® Code Version 6.3.0 Theory & User Manual, the build guidance for various platforms is documented in MCNP ® Code Version 6.3.0 Build Guide, and the verification and validation testing for various application benchmark test suites is documented in MCNP ® Code Version 6.3.0 Verification & Validation Testing.

73 NUCLEAR PHYSICS AND RADIATION PHYSICS↗
DOE OSTI2025

MCNP® Code Version 6.3.1 Release Notes

The Monte Carlo N-Particle® (MCNP® ) code is a general-purpose, continuous-energy, generalized-geometry, time-dependent, radiation transport code developed by the MCNP development team. MCNP calculations provide predictive capabilities that can replace expensive or impossible-to-perform experiments. Specific application problems include simulations of experimental diagnostics, intrinsic radiation, radiation detection and measurement, criticality safety, nuclear threat reduction and response, radiation health protection, nuclear weapons effects, and nuclear forensics. This MCNP code, version 6.3.1, follows the MCNP6.3.0 version. Since the release of MCNP6.3.0, a variety of bug fixes and code enhancements have been completed for MCNP6.3.1. A few new features have also been added to this release to support both ongoing research and the release of the latest ENDF/B-VIII.1 nuclear data library. The MCNP code, version 6.3.1, theory and user input information is documented in MCNP® Code Version 6.3.1 Theory & User Manual, the build guidance for various platforms is documented in MCNP® Code Version 6.3.1 Build Guide, and the verification and validation testing for various application benchmark test suites is documented in MCNP® Code Version 6.3.1 Verification & Validation Testing.

73 NUCLEAR PHYSICS AND RADIATION PHYSICS↗
DOE OSTI2022

Using Structured Intelligence Graph (STIG) to protect our critical infrastructure against cyber attacks [Poster]

STIG is a revolutionary cybersecurity tool developed by researchers at the U. S. Department of Energy's Idaho National Laboratory and it is a software that allows utility owners and operators to easily visualize, create, and edit cyberthreat intelligence information. STIG uses Structured Threat Information eXpression (STIX) and converts complex data on cybersecurity vulnerabilities into a visualization that is easy to understand and act on. With STIG, utility owners and operators have a common system for sharing threat intelligence information, thus increasing the chances of detecting and mitigating cyber exploits before they lead to a cyberattack.

24 POWER TRANSMISSION AND DISTRIBUTION↗