Search NASA⌕ Search

SEARCH · Search NASA

Results for “threat modeling”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 109 records · Page 6

Consequence Based Framework for Deployment of Cloud Solutions in the Digital Energy Transition

This study proposes a framework for evaluating cloud computing deployment in the electric sector, focusing on the digital transition of energy systems. It assesses the implications of cloud technology adoption, particularly in terms of security, operational resilience, and efficiency. The paper introduces a method for consequence-driven risk analysis, enabling utilities to prioritize and mitigate potential threats effectively. It also discusses the shared responsibility model in cloud computing, highlighting the need for collaborative security efforts. The research aims to provide utilities with a strategic assessment tool for cloud adoption, emphasizing the importance of security culture in enhancing cloud computing's role in critical infrastructure.

99 GENERAL AND MISCELLANEOUS↗

A Review of Cyber-Physical Security for Photovoltaic Systems

In this paper, the challenges and a future vision of the cyber-physical security of photovoltaic (PV) systems are discussed from a firmware, network, PV converter controls, and grid security perspective. The vulnerabilities of PV systems are investigated under a variety of cyber-attacks, ranging from data integrity attacks to software-based attacks. A success rate metric is designed to evaluate the impact and facilitate decision making. Model-based and data-driven methods for threat detection and mitigation are summarized. In addition, the blockchain technology that addresses cyber-attacks in software and cyber networks is described. Simulation and experimental results that show the impact of cyber-attacks at the converter (device) and grid (system) levels are presented. Finally, potential research opportunities are discussed for next-generation, cyber-secure power electronics systems. These opportunities include multi-scale controllability, self-/event-triggering control, artificial intelligence/machine learning, hot patching, and online security. As of today, this study will be one of the few comprehensive studies in this emerging and fast-growing area.

14 SOLAR ENERGY↗

Dynamic Role-Based Access Control Policy for Smart Grid Applications: An Offline Deep Reinforcement Learning Approach

Role-based access control (RBAC) is adopted in the information and communication technology domain for authentication purposes. However, due to a very large number of entities within organizational access control (AC) systems, static RBAC management can be inefficient, costly, and can lead to cybersecurity threats. In this paper, a novel hybrid RBAC model is proposed, based on the principles of offline deep reinforcement learning (RL) and Bayesian belief networks. The considered framework utilizes a fully offline RL agent, which models the behavioral history of users as a Bayesian belief-based trust indicator. Thus, the initial static RBAC policy is improved in a dynamic manner through off-policy learning while guaranteeing compliance of the internal users with the security rules of the system. By deploying our implementation within the smart grid domain and specifically within a Distributed Energy Resources (DER) ecosystem, we provide an end-to-end proof of concept of our model. Finally, detailed analysis and evaluation regarding the offline training phase of the RL agent are provided, while the online deployment of the hybrid RL-based RBAC model into the DER ecosystem highlights its key operation features and salient benefits over traditional RBAC models.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗

Zapiary: Creating Visibility in IOT Networks

Zigbee and Z-Wave are the main networking protocols used by low-power Internet of Things (IOT) devices. These protocols use low frequencies. Mesh architecture, and unique address formats that make them not compatible with traditional network traffic tools like IX-Discovery Tools. Zapiary is a software that takes CSV files with Zigbee and Z-Wave traffic and generates Structured Threat Information eXpression (STIX) JSON bundles illustrating the communication within IOT networks. The bundles can then be viewed within Structured Threat Intelligence Graph (STIG) or used with AI/ML models to provide deeper visibility into nodes that make up the network and the ability to trend the mesh network over time.

24 POWER TRANSMISSION AND DISTRIBUTION↗

Machine learning and process-based modeling of spatiotemporal changes in active layer thickness across Alaska

Permafrost degradation poses a growing threat to infrastructure stability and ecosystem resilience in the rapidly warming Arctic. We investigated the spatiotemporal dynamics of active layer thickness (ALT) across Alaska by integrating field observations, environmental datasets, a physically based Stefan model, and machine learning (ML) techniques. Using weather projections from the Coupled Model Intercomparison Project Phase 6 under two Shared Socioeconomic Pathways (SSP 2-4.5 and SSP 5-8.5), we assessed ALT sensitivity to projected future weather conditions. The random forest (RF) model outperformed the Stefan approach in predicting ALT on the training dataset (R² = 0.84 vs. 0.53) but demonstrated lower generalizability on the test dataset (R² = 0.24 vs. 0.54). The root mean square error (RMSE) for the RF model for training and testing ranged from 14 to 22 cm, compared to 17 and 18 cm for the Stefan model. Variable importance analysis revealed that mean annual temperature and slope angle were the strongest predictors of ALT, accounting for 19% and 18% of the variance, respectively, followed by sediment transport index (14%) and stream power index (11%). Comparative analysis of baseline ALT predictions showed the Stefan model tended to project a thicker active layer (mean ± SD: 65 ± 16 cm), compared to the RF model (mean ± SD: 59 ± 8.8) cm). Both models indicated a latitudinal gradient in ALT, with shallower depths at higher latitudes. Projected ALT increases by 2100 were estimated at 3.3 ± 2.2 cm under SSP 2-4.5 and 5.9 ± 4.0 cm under SSP 5-8.5 for the ML model, whereas the Stefan model projected substantially larger increases of 13 ± 2.6 cm (SSP 2-4.5) and 28 ± 4.4 cm (SSP5-8.5). Spatial analysis showed the greatest ALT increases in northern Alaska, with relatively smaller changes in southern regions. These findings highlight the complex, multifactorial nature of ALT dynamics and the value of hybrid modeling approaches. As rising temperatures accelerate permafrost thaw, changes in ALT can disrupt ecosystems, damage infrastructures, and enhance the release of stored soil carbon, highlighting the urgent need for improved predictive capabilities to inform adaptation strategies in the Arctic.

Climate sciences↗

Random forest models accurately classify synthetic opioids using high-dimensionality mass spectrometry datasets

Detection of novel threat agents presents several challenges, a principle one being the development of untargeted methods to screen an increasing number of threat chemicals whose exact structures are unknown. With the use of Machine Learning (ML) tools, we can guide the development of analytical methods for broad-spectrum detection of unbounded threat chemical families in complex mixtures. Toward this goal, we used nominal mass and high-resolution mass spectrometry data for hundreds of synthetic opioids and non-opioid compounds. We tested two ML techniques, logistic regression and random forest, to develop models towards a practical, implementable method for opioid detection. We found that of these tested ML methods, random forest models resulted in the highest validation accuracy (95+%) for both nominal mass and high-resolution classification of opioids versus non-opioids, with low false positive and false negative rates. The RF models were then used to successfully predict the classification of 10 compounds—five opioids and five non-opioids not part of the training and validation analysis. This application of ML is a critical step towards the development of field-deployable nominal mass spectrometers with ML-driven analyses for classification of emergent threats.

Chemistry↗

Random forest models accurately classify synthetic opioids using high-dimensionality mass spectrometry datasets

Detection of novel threat agents presents several challenges, a principle one being the development of untargeted methods to screen an increasing number of threat chemicals whose exact structures are unknown. With the use of Machine Learning (ML) tools, we can guide the development of analytical methods for broad-spectrum detection of unbounded threat chemical families in complex mixtures. Toward this goal, we used nominal mass and high-resolution mass spectrometry data for hundreds of synthetic opioids and non-opioid compounds. We tested two ML techniques, logistic regression and random forest, to develop models towards a practical, implementable method for opioid detection. We found that of these tested ML methods, random forest models resulted in the highest validation accuracy (95+%) for both nominal mass and high-resolution classification of opioids versus non-opioids, with low false positive and false negative rates. The RF models were then used to successfully predict the classification of 10 compounds—five opioids and five non-opioids not part of the training and validation analysis. This application of ML is a critical step towards the development of field-deployable nominal mass spectrometers with ML-driven analyses for classification of emergent threats.

Arasteh, Kourosh [Lawrence Livermore National Labo↗

In vitro toxicity assessment of uranium particulates on different human lung epithelial cell models

Inhalation of uranium aerosols produced via human activities such as mining can pose a threat to human respiratory systems. Uranium oxide particulates emit short-range alpha particles that elicit DNA and direct damage, beyond associated physiochemical heavy-metal toxicity, to internal epithelial tissues. The availability of reliable in vitro models to study radiation exposure can greatly enhance our ability to understand and combat the biological impacts of exposure. However, the toxicological effects of alpha emissions and/or the oxidation states of uranium particulates vary across different human lung epithelial cell models and have not been systematically compared. We have endeavored to address this limitation by comparing impacts in three different human lung cell models: primary human bronchial and tracheal epithelial cells, primary human small airway epithelial cells, and human adenocarcinoma alveolar basal epithelial cells. Other studies have mainly investigated the toxicity of depleted uranium. Here, we compared the exposure of uranium oxide particulates (U 3 O 8 and UO 3 ) of different enrichment states on the chosen cell systems. Each cell model was exposed to 0.1, 1, 10, 50, 100, and 500 µg/mL of depleted U 3 O 8 , highly-enriched U 3 O 8 , and natural UO 3 particulates for 24 hours in submerged monolayer cultures. We compared viability and superoxide dismutase activity results across cell lines and uranium enrichment/ oxidative states. The results showed that 1) the oxide state of the particulates affected cell viability, implying that uranium’s different oxidation states contribute to different toxicological responses, and 2) each cell model reacts differently when exposed to uranium oxides, which may provide insights into the mechanistic processes associated with the exposure of radiological particulates on different biological systems. For instance, increased uranium enrichment corresponds to increased toxicity for the primary cells, but not for the immortalized cells. Our study shows that a holistic approach that incorporates similarities between model systems and types of radionuclides is required to truly develop empirical solutions for radiation exposure.

59 BASIC BIOLOGICAL SCIENCES↗

ChatGPT and Other Large Language Models for Cybersecurity of Smart Grid Applications

Cybersecurity breaches targeting electrical substations constitute a significant threat to the integrity of the power grid, necessitating comprehensive defense and mitigation strategies. Any anomaly in information and communication technology (ICT) should be detected for secure communications between devices in digital substations. This paper proposes large language models (LLMs), e.g., ChatGPT, for the cybersecurity of IEC 61850-based communications. Multi-cast messages such as generic object oriented system events (GOOSE) and sampled values (SV) are used for case studies. The proposed LLM-based cybersecurity framework includes, for the first time, data pre-processing of communication systems and human-in-the-loop (HITL) training (considering the cybersecurity guidelines recommended by humans). The results show a comparative analysis of detected anomaly data carried out based on the performance evaluation metrics for different LLMs. A hardware-in-the-loop (HIL) testbed is used to generate and extract a dataset of IEC 61850 communications.

ChatGPT↗

Flexible AI Models for Grid Resilience

The rapid growth in size and complexity of artificial intelligence (AI) and machine learning (ML) models has led to increased energy demands, posing a threat to the reliability of the existing power grid. This project addresses the challenge of highly intermittent and energy-intensive inference workloads by (1) developing fidelity-adaptive neural networks capable of dynamic response to grid conditions and (2) integrating these networks with power flow simulations to assess their impact on power grid reliability. We will explore both top-down and bottom-up approaches to create hierarchies of submodels that provide a controlled trade-off between power draw and prediction accuracy. The top-down method utilizes NN pruning to reduce a flagship model into progressively smaller, energy-efficient variants. The bottom-up approach employs geometrically principled weight setting strategies to construct depth-efficient models from the ground up. A real-time hardware-in-the-loop (HIL) platform will be developed to simulate a scaled AC power grid, integrating live AI workload power draw and enabling dynamic model switching in response to grid feedback. This work will provide a novel framework for evaluating the impact of flexible AI/ML workloads on grid performance and establish new methodologies for energy-aware computing in data centers. The outcomes will demonstrate that adaptive AI/ML can play a critical role in improving grid stability while advancing NREL's leadership in energy-efficient computing research.

24 POWER TRANSMISSION AND DISTRIBUTION↗

PRIMED for the Future: Purposing Raw Intake for Machine Learning-Enabled Detection (Final Report)

The COVID-19 pandemic demonstrated how a novel, elusive, and diffuse biological threat can engender uncertainty and misinformation, and it underscored the need for flexible analytical modalities agnostic to the identity of biological material. Yet even before the pandemic, recognition of the limitations of the current, list-based approach, which focuses on known pathogens and biotoxins, and of the importance of agent-agnostic biodetection was growing within the biosecurity community. In a 2018 report on “Biodefense in the Age of Synthetic Biology,” for example, the National Academy of Sciences stated that “an overreliance on the Select Agent List is a systematic weakness affecting many aspects of the United States’ current biodefense mitigation capability”. More recently, a group of biodefense researchers proposed the identification and adoption of “bioagent-agnostic signatures (BASs)” as a way of detecting and characterizing not only existing agents but also novel ones, an approach they believe will “enable a more flexible and resilient biodefense posture”. Indeed, the future of biodetection requires us to begin developing novel analytics that can identify anomalies and/or characteristics that indicate a potential threat, whether known or unknown, without looking for a specific signature that has been identified previously. To assess potential threats more rapidly, it is critical to develop agnostic artificial intelligence (AI)/machine learning (ML) systems that can be employed for real-time assessment of the nature and source of a perturbation. Such systems should be multi scale and multi-dimensional, integrating sensor data from a range of biological, chemical, and physical application spaces. Emerging deep learning (DL) models demonstrate exceptional promise for identification of discriminatory features within multi-dimensional datasets. DL models have the capacity to recognize and encode highly complex patterns in a wide range of input data modalities, including images, text, and biological/chemical/physical spectra. As such, they can execute a wide range of assessments and determinations that have traditionally required a human operator. The promise of advances in DL is apparent in the realm of human health and medicine. DL models have been validated for evaluating a variety of clinical threats to human health in a range of contexts, including infection and cancer, and they demonstrated improved performance in predicting stroke relative to human neurologists in some categories of data. Continuously evolving advances in AI/ML are expected to support more efficient evaluation of raw sequence, spectroscopy, and spectrometry data. For instance, recent advances and deployment of large language models (LLM) such as Generative Pre training Transformer (GPT) and Bidirectional Encoder Representations from Transformers (BERT) have already motivated application of these models for biological function prediction. As frameworks such as LLMs become larger and more complex in their representations, their capacity to serve as pre-trained models that can be fine-tuned for biological/biodetection purposes will similarly be amplified. While existing and emerging AI/ML have found broad applicability and use cases in the clinical sciences, development for environmental evaluation and biodetection has been limited. Functionalizing such capabilities for this purpose requires an understanding of the existing technical landscape and how the respective tools and algorithms are currently being employed. This landscape awareness then allows an assessment of the current practical capabilities of existing models and the anticipated requirements and development efforts that will be needed to adapt available algorithms for biodetection applications relevant to DHS. Leveraging expertise in biodetection, ML, and operational biodetection, the effort described in this report is comprised of a systematic landscape assessment (Subtask 2.1), comparative evaluation (Subtask 2.2), and formulation of a value proposition (Subtask 2.3) for the prospect of ML-enabled, agnostic biodetection from raw, or minimally-processed, datasets.

59 BASIC BIOLOGICAL SCIENCES↗

Securing Grid-interactive Efficient Buildings (GEB) through Cyber Defense and Resilient System (CYDRES)

The DOE CYDRES project is driven by the urgent need to address critical research gaps in the domain of cyber-physical security of smart buildings, including Grid-interactive Efficient Buildings (GEBs). CYDRES, a real-time advanced building resilient platform, aims to enhance the cyber-attack-immune capabilities of buildings through multi-layered prevention, detection, and adaptation mechanisms. CYDRES consists of five key modules: a multi-layer network analyzer, an Automatic Fault Detection, Diagnosis, and Prognosis (AFDDP) framework, an intelligent mode selector, a cyber-resilient control framework, and a situation awareness platform. The Network Analyzer employs a data-driven framework that includes a protocol state learning tool and a CRF (Conditional Random Field) command validator. In Hardware-In-the-Loop (HIL) testbeds, it achieved 100% detection accuracy with a false alarm rate of 3%, validating its efficacy in identifying selected cyber-attacks. The AFDDP framework leverages pattern matching, PCA (Principal Component Analysis)-based strategies, and a DBN (Dynamic Bayesian Network)-based fault diagnosis approach to pinpoint the causes of physical system abnormalities using Building Automation System (BAS) data. In HIL experiments, the AFDDP module attained a detection accuracy of over 95% with a false alarm rate below 7%. Additionally, the fault detector utilized machine learning (Random Forest) and deep learning (Multi-Layer Perceptron) methods with acoustic sensor data to achieve a 100% fault detection accuracy in Heating, Ventilation, and Air-Conditioning (HVAC) equipment. The Mode Selector offered real-time impact analysis, allowing immediate actions to protect BASs in the face of emerging threats. The cyber-resilient control framework included an adaptive Model Predictive Control (MPC) and a measurement compensator, reducing temperature violations by up to 94% and improving the total demand flexibility by up to 70% in HIL experiments. Such HIL experiments covered a cyber-attack case and a physical fault case, showcasing CYDRES’ efficiency in maintaining operational continuity during threats. The situation awareness platform in Grafana enhanced real-time threat detection and response visualization, augmenting the operational awareness for building operators. CYDRES demonstrated high technical effectiveness in various test scenarios, particularly in HIL environments. The project's phased development approach ensured efficient use of resources, highlighting its practical feasibility and readiness for commercialization. By enhancing the security and resilience of building operations, CYDRES represents a significant advance in mitigating risks associated with cyber-physical systems, thereby enhancing public confidence in the safety of modern building infrastructure. Future directions for the project include expanding testing protocols, refining AFDDP methodologies, exploring more comprehensive resilient control strategies, and testing in real commercial buildings.

42 ENGINEERING↗

Supporting U.S. National Security Through Cybersecurity Partnerships

At NLR, we're studying energy evolutions and threats to understand the challenges they pose and uncover ways to leverage grid advancements to achieve more secure, defensible, and reliable systems. Our integrated research approach bridges the gap between cyber threats and real-world consequences to deliver actionable solutions that reduce vulnerabilities and help strengthen U.S. national security.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗

Ransomware Attack Modeling and Artificial Intelligence-Based Ransomware Detection for Digital Substations

Ransomware has become a serious threat to the current computing world, requiring immediate attention to prevent it. Ransomware attacks can also have disruptive impacts on operation of smart grids including digital substations. This paper provides a ransomware attack modeling method targeting disruptive operation of a digital substation and investigates an artificial intelligence (AI)-based ransomware detection approach. The proposed ransomware file detection model is designed by a convolutional neural network (CNN) using 2-D grayscale image files converted from binary files. Here, the experimental results show that the proposed method achieves 96.22% of ransomware detection accuracy.

artificial intelligence↗

Mental Models for Managing Grid Cybersecurity Risk - ARC Industry Forum, Cybersecurity and Energy Transition

A proper mental model of the concepts of cyber risk and its components of threat and exploitability and consequence is necessary to allocate limited resources to different security activities, especially when considered alongside reliability and regulatory and economic risks. Understanding the consequence and frequency different risks are realized also helps align the right mitigations to the right risks. Cyber-informed engineering (CIE) is an emerging method to “engineer out” cyber risk across product and system lifecycles, and INL has a portfolio of programs operationalizing CIE’s principles for the energy sector.

24 POWER TRANSMISSION AND DISTRIBUTION↗

Assessment of Physical Security Modeling and Simulation in the Vulnerability Assessment Process

This report provides a comprehensive assessment of physical security modeling and simulation tools available for use in the vulnerability assessment (VA) process for nuclear facilities. It outlines the historical evolution of VA methodologies, emphasizing the transition from traditional layer-based approaches to a more holistic framework that integrates detection probabilities directly into combat simulations. The document details the critical components of the VA process, including the characterization of targets, threats, and protective measures, as well as the development of adversary scenarios that reflect both insider and outsider threats. It highlights the importance of performance assurance programs, emphasizing the need for continuous evaluation and testing of security systems to ensure their effectiveness against evolving threats. Additionally, the report discusses the significance of utilizing accredited modeling and simulation tools in accredited areas to accurately represent adversary actions and the corresponding responses of protective forces. By establishing a systematic approach to VA, this document aims to enhance the overall security posture of nuclear facilities, ensuring compliance with regulatory standards while effectively mitigating risks associated with potential adversarial actions.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

Enhancing Network Anomaly Detection Using Graph Neural Networks

In the world of Internet of Things (IoT) networks, where devices are constantly communicating, keeping them secure from cyber threats is critical. This paper introduces a novel approach to detecting unusual and potentially harmful activities in these networks using graph neural networks (GNNs). We combine two specific types of GNNs-GraphSAGE and graph attention networks (GAT)-to create a model that understands and represents the behaviors and interactions in a network. GraphSAGE creates an embedding of network activities by examining local data interactions, while GAT directs the model's focus to the most critical interactions. By integrating these two methods in a single model that considers different types of interactions (both host and flow nodes), we aim to create a system that accurately represents the current state of a network and can also spot anomalies effectively while reducing false positives and negatives. Our innovative approach has demonstrated promising results, achieving an accuracy of 98% on the UNSW-NB15 dataset, significantly outperforming standalone GraphSAGE and GAT models. This underscores its potential as a robust framework for securing IoT networks against cyber threats and anomalies.

Marfo, William↗

Soil Desiccation Treatability Testing at BC Waste Disposal Cribs

During Hanford’s production period, low-level waste products generated from chemical processing of uranium fuel rods were discharged directly to the ground through a system of cribs and trenches located in the 200-BC-1 Operable Unit (OU). The site consists of 6 cribs and 20 trenches that received more than 117,000 m3 of radioactive liquid waste discharged to the soil. These unlined infiltration galleries held volumes of liquid waste while it seeped into the ground, with the understanding that the 100 m (330 ft) thick vadose zone in the area would effectively capture the effluent and prevent groundwater impacts. A conceptual model showing the operation of cribs and trenches is shown in Figure 1. Data show effluent from the 26 cribs and trenches containing about 410 curies of Technetium-99 (Tc-99) is primarily located between 30 m and 70 m (98 ft and 230 ft) depth (Corbin et al., 2005; Ward et al., 2004). Despite no evidence indicating that the contamination has reached the groundwater at BC cribs and trenches, the mobility of Tc-99 had been demonstrated in laboratory tests and was recognized as a threat to groundwater at the site. Using data from numerical models, laboratory analyses, field investigations, and information on historical discharges, the EPA and Ecology identified Tc-99 and U contamination of the vadose zone as a remediation priority. The U.S. DOE was notified by EPA and Ecology regarding risks associated with Tc-99 contamination in a letter requesting development of a strategy for improved methods to understand the nature and extent of vadose zone contamination, specifically Tc-99, and to develop remedial options for addressing such contamination. To develop the appropriate technology for characterizing, remediating, and monitoring the deep vadose zone Tc-99 contamination, the U.S. DOE worked with the EPA and Ecology to create a Treatability Test Plan under a Remedial Investigation/Feasibility Study (RI/FS) for the Hanford 200 Areas. Under this RI/FS, it was determined that a treatability test for soil desiccation should be carried out as it was identified as a promising in-situ treatment technology for mitigating risks posed by Tc-99 contamination to the groundwater table. The BC Cribs and Trenches site was identified as a representative site for Tc-99 and U contamination and selected for the soil desiccation treatability test. In this chapter, we summarize the overlying regulatory framework of RI/FS and treatability tests and illustrate how development and experimentation supported the evaluation of selected remedies. We briefly discuss the RI/FS for the 200 Areas of the Hanford Site and focus on the soil desiccation treatability testing performed at the BC cribs and trenches site under the Deep Vadose Zone Treatability Test Plan for the Hanford Central Plateau (DVZ-TT). The DVZ-TT is one component of the remedial investigation/feasibility study for the Hanford 200 Areas and represents the underlying regulatory framework that drives site operations towards records of decision and site closure.

Mangel, Adam R.↗