SEARCH · Search NASA
Results for “cyber systems”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Cyber-Physical System Test Bed Data Sources, Communications and Controls Formulation
This is a report that provides the test bed design for the DOE-SETO SolarSTARTS project as a milestone.
Defensive Islanding to Enhance the Resilience of Distribution Systems Against Cyber-Induced Failures
The extensive integration of communication, computation, and control technologies into cyber-physical power systems (CPPSs) has increased the vulnerabilities of CPPSs to cyberattacks. This calls for developing solutions that assess and reduce the impacts of cyber-induced failures on CPPSs. This paper proposes a defensive islanding strategy to isolate impacted parts of the CPPS and form self-sufficient islanded grids with an objective of minimum load curtailment. The defensive islanding aims to split a power system into smaller grids to improve its resilience against a potential extreme event. A clustering approach that leverages the hierarchical spectral clustering method is utilized for the optimal defensive islanding. The proposed approach captures the fragility behavior and loading conditions of power system components due to cyber-induced failures. A graphical-based coupling framework is used to map the impacts of cyber failures into operation of power system components. The proposed method is demonstrated on a modified 33-node distribution feeder system integrated with distributed energy resources. The amount of load curtailment and radiality constraints have been used to evaluate the performance of the proposed clustering strategies. The results show the capability of the proposed algorithm to create islands considering the cyber-induced failures for enhanced resilience.
CPES-QSM: A Quantitative Method Towards the Secure Operation of Cyber-Physical Energy Systems
Power systems are evolving into cyber-physical energy systems (CPES) mainly due to the integration of modern communication and Internet-of-Things (IoT) devices. CPES security evaluation is challenging since the physical and cyber layers are often not considered holistically. Existing literature focuses on only optimizing the operation of either the physical or cyber layer while ignoring the interactions between them. This paper proposes a metric, the Cyber-Physical Energy System Quantitative Security Metric (CPES-QSM), that quantifies the interaction between the cyber and physical layers across three domains: electrical, cyber-risk, and network topology. A method for incorporating the proposed cyber-metric into operational decisions is also proposed by formulating a cyber-constrained AC optimal power flow (C-ACOPF) that considers the status of all the CPES layers. The C-ACOPF considers the vulnerabilities of physical and cyber networks by incorporating factors such as voltage stability, contingencies, graph-theory, and IoT cyber risks, while using a multi-criteria decision-making technique. We note that simulation studies are conducted using standard IEEE test systems to evaluate the effectiveness of the proposed metric and the C-ACOPF formulation.
A graph embedding‐based approach for automatic cyber‐physical power system risk assessment to prevent and mitigate threats at scale
Abstract Power systems are facing an increasing number of cyber incidents, potentially leading to damaging consequences to both physical and cyber aspects. However, the development of analytical methods for the study of large‐scale power infrastructures as cyber‐physical systems is still in its early stages. Drawing inspiration from machine‐learning techniques, the authors introduce a method inspired by the principles of graph embedding that is tailored for quantitative risk assessment and the exploration of possible mitigation strategies of large‐scale cyber‐physical power systems. The primary advantage of the graph embedding approach lies in its ability to generate numerous random walks on a graph, simulating potential access paths. Meanwhile, it enables capturing high‐dimensional structures in low‐dimensional spaces, facilitating advanced machine‐learning applications, and ensuring scalability and adaptability for comprehensive network analysis. By employing this graph embedding‐based approach, the authors present a structured and methodical framework for risk assessment in cyber‐physical systems. The proposed graph embedding‐based risk analysis framework aims to provide a more insightful perspective on cyber‐physical risk assessment and situation awareness for power systems. To validate and demonstrate its applicability, the method has been tested on two cyber‐physical power system models: the Western System Coordinating Council (WSCC) 9‐Bus System and the Illinois 200‐Bus System , thereby showing its advantages in enhancing the accuracy of risk analysis and comprehensiveness of situational awareness.
SECURED: Simulator-Enhanced Control and Understanding of Reactor systems for cyber-Event Defense
The study discusses a learning approach for analyzing cyber-events in reactor systems using integrated hardware and personal computer simulator models. Key points include the rise in cyber-attacks and their sophistication in industrial control systems (ICS), the necessity for awareness, understanding, resource allocation, and preparation to combat these threats, and the digital transformation of old and new nuclear plants, increasing their exposure to cyber threats. It highlights the cyber vulnerabilities of advanced reactor systems, which rely on digital instrumentation and control for operations and safety functions, making them susceptible to cyber-attacks. The approach involves demonstrating reactor system plant ICS cyber-attacks under various operational conditions utilizing tools like simulator models and hardware-based kits. A strategic solution approach tailored to critical infrastructure is emphasized, along with community engagement for public and government support, adopting effective learning approaches, and the preparation for anticipated future challenges. The presentation concludes with a call to action to address challenges, leverage opportunities, and advance through lesson learning in cybersecurity for nuclear energy systems.
Role of reinforcement learning for risk-based robust control of cyber-physical energy systems
Critical infrastructures such as cyber-physical energy systems (CPS-E) integrate information flow and physical operations that are vulnerable to natural and targeted failures. Safe, secure, and reliable operation and control of CPS-E is critical to ensure societal well-being and economic prosperity. Automated control is key for real-time operations and may be mathematically cast as a sequential decision-making problem under uncertainty. Emergence of data-driven techniques for decision making under uncertainty, such as reinforcement learning (RL), have led to promising advances for addressing sequential decision-making problems for risk-based robust CPS-E control. However, existing research challenges include understanding the applicability of RL methods across diverse CPS-E applications, addressing the effect of risk preferences across multiple RL methods, and development of open-source domain-aware simulation environments for RL experimentation within a CPS-E context. This article systematically analyzes the applicability of four types of RL methods (model-free, model-based, hybrid model-free and model-based, and hierarchical) for risk-based robust CPS-E control. Problem features and solution stability for the RL methods are also discussed. We demonstrate and compare the performance of multiple RL methods under different risk specifications (risk-averse, risk-neutral, and risk-seeking) through the development and application of an open-source simulation environment. Motivating numerical simulation examples include representative single-zone and multizone building control use cases. Finally, six key insights for future research and broader adoption of RL methods are identified, with specific emphasis on problem features, algorithmic explainability, and solution stability.
Secure State Estimation with Asynchronous Measurements for Coordinated Cyber Attack Detection in Active Distribution Systems
Coordinated cyber attacks tamper with measurement data to disrupt the situational awareness of active distribution systems. Various sensors report measurements asynchronously at different rates, which introduces challenges during state estimation. In addition, this forces cyber intruders to exert greater effort to compromise multiple communication channels and launch coordinated attacks. Therefore, multi-channel and asynchronous measurements could be harnessed to develop more secure cyber defense strategies. In this paper, a prediction-correction-based multi-rate observer is designed to exploit the value of asynchronous measurements for the detection of coordinated false data injection (FDI) attacks. First, a time-function-dependent prediction-correction strategy is proposed to adjust the sampling interval for each sensor’s measurement. Then, an observer is designed based on the trade-off between estimation error and the optimal period of the most recent sampling instant, with the convergence of estimation error with the maximum permitted sampling interval. Moreover, the conditions for exponential stability are developed using the Lyapunov–Krasovskii functional technique. Next, a coordinated FDI attack detection strategy is developed based on the dual nonlinear minimization problem. The proposed attack detection and secure state estimation strategies are tested on the IEEE 13-node system. Simulation results show that these schemes are effective in enhancing attack detection based on asynchronous measurements or compromised data.
CYDRES: CYber Defense and REsilient System for securing grid-interactive efficient buildings
Smart buildings, especially Grid-interactive Efficient Buildings (GEBs), suffer from cyber-attacks and physical faults due to the integration of a large number of sensors and controls, connected devices, and associated communication networks. This study demonstrated a real-time advanced building resilient platform, called CYber Defense and REsilient System (CYDRES), which is deployable for existing and emerging Building Automation Systems (BASs). CYDRES aims to empower GEBs with cyber-attack-immune capabilities through multi-layer prevention and adaptation mechanisms to monitor, detect, and respond to cyber-attacks and physical operational faults. CYDRES is demonstrated through real-time experiments in a Hardware-in-the-Loop (HIL) testbed.
Cyber-Physical Reconfiguration for Disaster Resilience of Power Distribution Systems
Cyber-physical distribution systems (CPDS) have emerged from the integration of information technology into distribution systems. While offering substantial benefits, this integration also introduces vulnerabilities. The interaction between cyber networks and distribution systems renders CPDS susceptible to disasters. To ensure critical load supply and system resilience, rapid post-disaster load restoration is required. The paper proposes a critical load restoration (CLR) framework in CPDS using a network reconfiguration approach that exploits the existing post-disaster resources to restore critical loads within the shortest possible time. Using graph theory, the cyber network and distribution system are integrated into a single digraph, minimizing the CLR complexity in CPDS. A cost metric is also defined to satisfy network-specific objectives and constraints. A heuristic is proposed to guide the load restoration process using the cost metric within the integrated digraph. Simulation results confirm the framework's superiority over existing literature, which either overlooks cyber components or prolongs restoration with additional resource deployment.
Real-Time Federated Cyber-Transmission-Distribution Testbed Architecture for the Resiliency Analysis
With the ongoing automation driven by the push toward the smart electric grid and the advancement in associated cyber infrastructure, the interaction between physical [electric transmission and distribution (T&D) systems], cyber (communication, automation, and control), and human (grid operators and decision-makers) is increasingly becoming more complex. This creates the requirement of analyzing the effect of the transmission system on the distribution system and vice versa with consideration of the additional complexity of the cyber infrastructure. Such an integrated testbed will also help with resiliency analysis, where resiliency refers to the ability of the system to continue serving energy to the critical loads even with limited extreme contingencies. Interaction of the physical power grid with the cyber layer can be effectively modeled using real-time (RT) simulator for developing and validating various operational and control algorithms. Testbeds using RT simulators with multiple capabilities have been developed at different institutions. Still, no single existing testbed can offer full scalability while simultaneously meeting high fidelity requirements for resiliency experimentation. Co-simulating federated testbed assets can provide a scalable experimentation platform that can be leveraged for verification and validation. In this article, an architecture is developed for federated cyber-physical testbed. A local federation with two real-time simulators is developed: real-time digital simulator (RTDS) and OPAL-RT have been interfaced using VILLAS framework for end-to-end testing. Also, a real-time linear predictor is developed and integrated here to address the communication latency impact on geographically allocated federated RT simulation. Finally, resiliency analysis tools are formulated and utilized for T&D systems. Finally as an illustrative use case, the resiliency of a T&D test system is simulated, and the results are analyzed. A 179-bus Western Electricity Coordinating Council (WECC) transmission system is developed using OPAL-RT/ HYPERSIM, and a modified IEEE 13 node feeder system is modeled in RTDS/RSCAD and interfaced for resiliency analysis.
DSS-SimPy-RL (Open-DSS and SimPy based Cyber-Physical RL environment) [SWR-23-29]
Recently, numerous data-driven approaches to control an electric grid using machine learning techniques have been investigated. With the advancement of reinforcement learning (RL) based techniques, gradually the conventional optimization based solvers are being replaced with RL approach where there is uncertainty in the environment such as renewable generation or cyber system emulation. However, to train an agent efficiently, it requires numerous interactions with an environment to learn the best policies. There are numerous RL environments for the power systems based on some well-known simulators, similarly there are environment for communication domains. While majority of the cyber emulators are based in an UNIX environment, the power simulators are based in the Windows-based operating system, the generation of cyber-physical mixed domain RL environment has been challenging. Existing co-simulation methods are efficient but resource and time intensive to generate large scale data set for training RL agents. Hence, this software focuses on development and validation of a mixed domain RL environment using Open DSS for the physical side and leverages a discrete event simulator python package, SimPy, for cyber-side emulation which is Operating Systems agnostic. Further utilizing this software co-simulation and training RL agents for re-routing based resilient control for network reconfiguration and volt-var control in power distribution feeder are performed.
International Space Agency CIO Forum Industrial Control System (ICS) and Cyber
This briefing covers Industrial Control System (ICS) best practices for enhancing cyber protection. The briefing provides a very high-level overview of best practices currently being pursued by NASA as well as by other US government agencies such as NIST and DHS ICS-CERT. All information presented in this slide deck is publicly available and no sensitive information is provided in these slides. These slides will be used to generate discussion around best practices within the international community in the area of ICS cyber protections.
Time-frequency based cyber security defense of wide-area control system for fast frequency reserve
Global power systems are transiting from conventional fossil fuel energy to renewable energies due to their environmental benefits. The increasing penetration of renewable energies presents challenges for power system operation. The efficiency and sufficiency of responsive reserves have become increasingly important for power systems with a high proportion of renewable energies. The Fast Frequency Reserve (FFR), especially the Wide-area Monitoring System (WAMS)-based FFR, is a promising and effective solution to secure and enhance the stability of power systems. However, cyber security has become a new challenge for the WAMS-based FFR system. Cyber attacks on the FFR control system may threaten the safety of power system operation due to the rapid power controllability requirement of FFR. Therefore, to address this problem, a time-frequency based cyber security defense framework is proposed to detect the cyber spoofing of synchrophasor data in WAMS-based FFR control systems. This paper first introduces the Continuous Wavelet Transforms (CWTs) to decompose spoofing signals. Then, the Dual-frequency Scale Convolutional Neural Networks (DSCNN) is proposed to identify the time-frequency domains matrix from two frequency scales. Integrating CWTs and DSCNN, an identification framework called CWTs-DSCNN is further proposed to detect the spoofing attacks in the WAMS-based FFR system. Multiple experiments using the actual data from FNET/GridEye are performed to verify the effectiveness of the framework in securing WAMS-based FFR systems.
Inferring adversarial behaviour in cyber‐physical power systems using a Bayesian attack graph approach
Abstract Highly connected smart power systems are subject to increasing vulnerabilities and adversarial threats. Defenders need to proactively identify and defend new high‐risk access paths of cyber intruders that target grid resilience. However, cyber‐physical risk analysis and defense in power systems often requires making assumptions on adversary behaviour, and these assumptions can be wrong. Thus, this work examines the problem of inferring adversary behaviour in power systems to improve risk‐based defense and detection. To achieve this, a Bayesian approach for inference of the Cyber‐Adversarial Power System (Bayes‐CAPS) is proposed that uses Bayesian networks (BNs) to define and solve the inference problem of adversarial movement in the grid infrastructure towards targets of physical impact. Specifically, BNs are used to compute conditional probabilities to queries, such as the probability of observing an event given a set of alerts. Bayes‐CAPS builds initial Bayesian attack graphs for realistic power system cyber‐physical models. These models are adaptable using collected data from the system under study. Then, Bayes‐CAPS computes the posterior probabilities of the occurrence of a security breach event in power systems. Experiments are conducted that evaluate algorithms based on time complexity, accuracy and impact of evidence for different scales and densities of network. The performance is evaluated and compared for five realistic cyber‐physical power system models of increasing size and complexities ranging from 8 to 300 substations based on computation and accuracy impacts.
An iterative learning and inference approach to managing dynamic cyber-vulnerabilities of complex systems
As modern systems become increasingly reliant on cyber-technologies and continue to be integrated with physical systems, managing risks from deliberate and non-deliberate sources is a significant research challenge. Unlike strictly physical systems, cyber-enabled physical systems are influenced by dynamic and evolving technologies, environments, and attack mechanisms. As a result, vulnerabilities are rapidly changing and difficult to detect and manage. While there is recent interest in the dynamic properties of performance through resilience analysis, limited research addresses the dynamic nature of cyber-system vulnerability. This paper presents a dynamic iterative learning approach to evaluate the state of health for systems as related to cyber-vulnerabilities. These time-varying system health characteristics may not be visible, but can be inferred using observable characteristics. The approach recognizes that multiple types of vulnerabilities need to be included in a holistic system health assessment. The methods are applied to the Common Vulnerability Scoring System database containing over 100,000 documented cybersecurity vulnerabilities. This work is the first to acknowledge the dynamic properties of cyber-vulnerability, while also inferring system health using observable data and hidden states of system health. This work will be of interest to managers of large-scale cyber-enabled physical systems who are seeking to prioritize system health investments.
Real-Time Hardware-in-the-Loop Distributed Energy Resources System Testbed using IEEE 2030.5 Standard
IEEE 2030.5 standard is drawing special attention among communication protocols for smart inverters and distributed energy resources (DER). Moreover, California Rule 21 mandates new DER must be ready to communicate to a host utility using the IEEE 2030.5 standard. Therefore, development of an effective real-time simulation method for managing DER using IEEE 2030.5 network is crucial. This paper presents a real-time hardware-in-the-loop (HIL) DER system testbed using the IEEE 2030.5 standard. The proposed real-time co-simulation testbed consists of a DER physical system simulation using OP AL-RT real-time simulator and a cyber system simulation including DER gateways and a DER management system (DERMS) cloud server. Custom-built client and server programs are developed to meet the compliant with IEEE 2030.5-2018 standard and implemented in the DER gateways and a DERMS server, respectively. Furthermore, the feasibility of the proposed testbed for DER systems is validated by experiments.
WISP: Watching grid Infrastructure Stealthily through Proxies (Final Technical Report)
The complex interdependencies of cyber systems (sensors and communications), physical grids and associated electricity market operations make protecting electric power grids a significant challenge. The energy sector is constantly under new, targeted, advanced and dangerous cyber-attacks that have the potential to result in the loss of human life. These threats are further exacerbated by our need to modernize the grid. One focus of cyber security research in smart grids is the securing of the SCADA system through advanced intrusion detection systems (IDS) and bad data detection algorithms in state estimation. These methods either require full knowledge of the system topology and parameters or fail to understand the physical behaviors under attack. WISP (Watching grid Infrastructure Stealthily through Proxies) is designed to provide additional protection to the power grid using only publicly available data. In particular, WISP exploits the spatio-temporal nature of the real time locational marginal prices (LMPs), in conjunction with other information such as bids, weather, outages and load data to analyze anomalous power pricing behaviors and then correlate those observations to localize regions of interest and identify potential cyber events. WISP is non-intrusive as the tool is deployed as a service in the Cloud or on premise and provides reliable information to system operators for enhanced situational awareness, without impeding energy delivery functions. The WISP technology comprises three modules: the data-driven anomaly detection core, the vulnerability and risk analysis and the root cause analysis. The data-driven anomaly detection core performs the tasks of feature selection, anomaly detection and attack region localization. The vulnerability and risk analysis module provides system level information of the vulnerable variables and times, assisting the operators in selecting monitoring and protection nodes. The root cause analysis module takes the detection results and identifies potential operational conditions that contribute to the detected anomalies. In Phase I, we have demonstrated the feasibility and effectiveness of WISP. We developed a realistic electricity market simulator capable of generating normal and attack market data under various operational conditions. We developed a series of cyber-attack detection and analysis algorithms and evaluated them under multiple data sources. Finally, we integrated all modules into an end-to-end software, providing functions for data management, data analytics and visualization. Specifically, we have achieved: (i) real-time data acceptance from external utility interfaces with >99% acceptance rate; (ii) high performance anomaly detection algorithms with >98% detection accuracy and <0.1% false alarm rate; and (iii) ultra-low computing delay <50 milliseconds. Additionally, our team developed algorithms to identify the vulnerable variables in electricity market operations and root cause analysis functions to identify major contributors to the price spikes. These ancillary modules are necessary when deploying WISP in real world industry environment. In Phase II, we have demonstrated the effectiveness of WISP software on realistic largescale power systems. We performed red team testing for the Phase I WISP software and identified software vulnerabilities and implemented corresponding mitigation solutions. We adapted the electricity market simulator for the Texas synthetic 2000-bus system and generated datasets for the false data injection attacks. We created database and visualization interfaces for the Texas system and the ISO New England system. We performed software optimization in terms of operation efficiency, computing speed and detection accuracy. Finally, we tested the software on the Texas system and the ISO New England system and evaluated the detection performance. Overall, we achieved above 89% detection rate, below 3% false alarm rate and below 37 seconds of end-to-end detection delay.