Search NASA⌕ Search

SEARCH · Search NASA

Results for “Cyber Analytics”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 127 records · Page 7
All sourcesNASA NTRSDOE OSTI
DOE OSTI2022

Aggregate attack surface management for network discovery of operational technology

Interconnectivity has become a substratum of technology as the benefits of data-driven functionality are being realized in nearly all industries. Increased connectivity of Operational Technology (OT) exacerbates cyber risks because Industrial Control Systems (ICS) are becoming exposed to the Internet. These exposures are often done inadvertently through misconfigurations as additional network devices come online. Attack surface management (ASM) platforms can be used to identify vulnerabilities by performing external network discovery over the Internet using web spiders. These web spiders enable big data analytics of Internet of Things (IoT) devices as identifiable information of Internet-exposed equipment are archived in searchable databases that are made publicly available. There are a multitude of ASM service providers on the market. Here, this study was conducted to evaluate several commonly known tools to determine the aggregate attack surface of control systems. Queries were crafted by targeting commonly known manufacturers and communication protocols found in OT networks. Identified devices were that categorized based on technology types. Each query was replicated between several tools to target identical ICS equipment. Findings in this paper suggested a significant variance in the exposures discovered by each tool, but unique contributions were identified for each tool when a merged attack surface was derived. Therefore, all tools should be used in aggregate.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2018

Situ: Identifying and Explaining Suspicious Behavior in Networks

Despite the best efforts of cyber security analysts, networked computing assets are routinely compromised, resulting in the loss of intellectual property, the disclosure of state secrets, and major financial damages. Anomaly detection methods are beneficial for detecting new types of attacks and abnormal network activity, but such algorithms can be difficult to understand and trust. Network operators and cyber analysts need fast and scalable tools to help identify suspicious behavior that bypasses automated security systems, but operators do not want another automated tool with algorithms they do not trust. Experts need tools to augment their own domain expertise and to provide a contextual understanding of suspicious behavior to help them make decisions. In this paper we present Situ, a visual analytics system for discovering suspicious behavior in streaming network data. Situ provides a scalable solution that combines anomaly detection with information visualization. The system's visualizations enable operators to identify and investigate the most anomalous events and IP addresses, and the tool provides context to help operators understand why they are anomalous. Finally, operators need tools that can be integrated into their workflow and with their existing tools. This paper describes the Situ platform and its deployment in an operational network setting. Furthermore, we discuss how operators are currently using the tool in a large organization's security operations center and present the results of expert reviews with professionals.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2015

Evaluating Moving Target Defense with PLADD

This project evaluates the effectiveness of moving target defense (MTD) techniques using a new game we have designed, called PLADD, inspired by the game FlipIt. PLADD extends FlipIt by incorporating what we believe are key MTD concepts. We have analyzed PLADD and proven the existence of a defender strategy that pushes a rational attacker out of the game, demonstrated how limited the strategies available to an attacker are in PLADD, and derived analytic expressions for the expected utility of the game’s players in multiple game variants. We have created an algorithm for finding a defender’s optimal PLADD strategy. We show that in the special case of achieving deterrence in PLADD, MTD is not always cost effective and that its optimal deployment may shift abruptly from not using MTD at all to using it as aggressively as possible. We believe our effort provides basic, fundamental insights into the use of MTD, but conclude that a truly practical analysis requires model selection and calibration based on real scenarios and empirical data. We propose several avenues for further inquiry, including (1) agents with adaptive capabilities more reflective of real world adversaries, (2) the presence of multiple, heterogeneous adversaries, (3) computational game theory-based approaches such as coevolution to allow scaling to the real world beyond the limitations of analytical analysis and classical game theory, (4) mapping the game to real-world scenarios, (5) taking player risk into account when designing a strategy (in addition to expected payoff), (6) improving our understanding of the dynamic nature of MTD-inspired games by using a martingale representation, defensive forecasting, and techniques from signal processing, and (7) using adversarial games to develop inherently resilient cyber systems.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2025

Resilient State Recovery Using Prior Measurement Support Information

Resilient state recovery of cyber-physical systems has attracted much research attention due to the unique challenges posed by the tight coupling between communication, computation, and the underlying physics of such systems. By modeling attacks as additive adversary signals to a sparse subset of measurements, this resilient recovery problem can be formulated as an error correction problem. To achieve exact state recovery, most existing results require less than 50% of the measurement nodes to be compromised, which limits the resiliency of the estimators. In this paper, we show that observer resiliency can be further improved by incorporating data-driven prior information. Here, we provide an analytical bridge between the precision of prior information and the resiliency of the estimator. By quantifying the relationship between the estimation error of the weighted ℓ 1 observer and the precision of the support prior, this quantified relationship provides guidance for the estimator’s weight design to achieve optimal resiliency. Several numerical simulations and an application case study are presented to validate the theoretical claims.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2020

Perturbation-Based Diagnosis of False Data Injection Attack Using Distributed Energy Resources

Modern smart grid relies on various sensor measurements for its operational control. In a successful false data injection attack, the attacker manipulates the measurements from the grid sensors such that undetected errors are introduced into the estimates of the system parameters leading to catastrophic situations. This paper proposes a novel perturbation based false data injection attack detection mechanism that utilizes inverter based distributed energy resources (DERs) to create low magnitude perturbation signal in the distribution system voltage that is inconsequential to the normal grid operation. Two voltage sensitivity analysis based algorithms are designed to identify the optimal set of DERs that can create the voltage perturbation signal of desired magnitude. An analytical method of voltage sensitivity analysis is used to compute the magnitude of voltage perturbation signal at each node in a computationally efficient manner. Then, a detection mechanism is developed that checks for the presence of the perturbation sequence in each sensor measurement. A sensor measurement is deemed authentic if the voltage perturbation signal is present in the data. In case of sensor malfunction or cyber-attack, the perturbation signal will not be present in the measurement data. Performance of the proposed attack detection mechanism is validated via simulation of the IEEE 69 bus test system.

24 POWER TRANSMISSION AND DISTRIBUTION↗
NASA NTRS2018

Evolving Storage and Cyber Infrastructure at the NASA Center for Climate Simulation

This talk will describe recent developments at the NASA Center for Climate Simulation, which is funded by NASAs Science Mission Directorate, and supports the specialized data storage and computational needs of weather, ocean, and climate researchers, as well as astrophysicists, heliophysicists, and planetary scientists. To meet requirements for higher-resolution, higher-fidelity simulations, the NCCS augments its High Performance Computing (HPC) and storage retrieval environment. As the petabytes of model and observational data grow, the NCCS is broadening data services offerings and deploying and expanding virtualization resources for high performance analytics.

Cyberinfrastructure↗
DOE OSTI2019

Cyber Threat Screening Using a Queuing-Based Game-Theoretic Approach

Dynamic and uncertain security environments, such as cyber systems, often involve strategic interactions among multiple decision-making agents. In this paper, we consider a cybersecurity setting where a system administrator (defender) has to screen malicious service requests of an attacker who seeks to exhaust available cyber resources and inconvenience users with normal requests. We propose a novel cyber-threat inspection model, based on Stackelberg games, that unies aspects of Threat Security Games with the Erlang-B queuing framework to provide equilibrium strategies for both the attacker and defender. In our proposed model, the defender seeks to determine the optimal number of inspection nodes required to maximize detection probability of malicious requests, while the attacker maximizes the probability of legitimate requests dropping out of the system. We derive analytical expressions of the equilibrium solutions of the proposed Stackelberg game under realistic assumptions on system observability and payoff structure of the players. A numerical case study is presented, and steps for further research are identified.

Cybersecurity, Stackelberg game, Erlang-B loss sys↗
DOE OSTI2017

Unleashing the Power of Wide-Area Data Analytics for Enhanced Grid Visibility

We report that the operation of modern electric transmission systems relies increasingly on the use of advanced sensing and synchronized-measurement technologies. These technologies collect and collate a wide variety of data from disperse locations to monitor the health of network, obtain fast and accurate diagnosis of systemic changes, and detect signs of anomalies and instabilities at an early stage. In view of the far-reaching blackout risk from potential damages to critical transmission grid assets (due to severe disturbances, physical attacks, and extreme weather events), stealthy activities that compromise the operation of wide-area sensing, communication, and control systems could cripple the entire cyber-physical smart-grid infrastructure. To this end, achieving robust event identification, ensuring bulk system observability, and developing actionable intelligence (by fostering data-driven decision making under imminent threat of complex, multifaceted attacks and disruptions) remain key challenges for sustaining a resilient power grid operation.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2024

Architecture for Web-Based Visualization of Large-Scale Energy Domains: Preprint

With the growing penetration of inverter-based distributed energy resources and increased loads through electrification, power systems analyses are becoming more important and more complex. Moreover, these analyses increasingly involve the combination of interconnected energy domains with data that are spatially and temporally increasing in scale by orders of magnitude, surpassing the capabilities of many existing analysis and decision-support systems. We present the architectural design, development, and application of a high-resolution web-based visualization environment capable of cross-domain analysis of tens of millions of energy assets, focusing on scalability and performance. Our system supports the exploration, navigation, and analysis of large data from diverse domains such as electrical transmission and distribution systems, mobility and electric vehicle charging networks, communications networks, cyber assets, and other supporting infrastructure. We evaluate this system across multiple use cases, describing the capabilities and limitations of a web-based approach for high-resolution energy system visualizations.

grid modernization↗
DOE OSTI2022

Emerging Threats and Technology Investigation: Industrial Internet of Things - Risk and Mitigation for Nuclear Infrastructure

Industries supporting the global nuclear infrastructure striving for cost savings, expansions in efficiency, and convenience are likely to adopt components (e.g., hardware, software) that comprise the Internet of Things (IoT) and Industrial Internet of Things (IIoT). These devices offer potential improvements along with security challenges. Modern conveniences achieved through application of technology have propagated through society in the form of interconnected devices, from doorbells to microwave ovens, commonly referred to as IoT. IoT devices are often Internet-connected devices that are designed to send data back to a cloud-based server, where a smart phone application then presents device status and control options. Home-based IoT applications carry a different set of risks when compared to a business or security environment, where there is also a history of convenience and interconnection. Industrial settings have long relied on specifically designed Supervisory Control and Data Acquisition (SCADA) systems for process control where IIoT devices are intended to inform business decisions and augment traditional processes. A recent National Institute of Standards and Technology (NIST) report provides a distinction between process control and IIoT in that traditional process control is not replaced by IIoT, but rather IIoT devices are intended to enhance industrial processes through additional monitoring of various sensors and application of data analytics models using artificial intelligence (AI) and machine learning (ML) (Fagan, Marron, et al. 2021) (Ross, et al. 2021).

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗
DOE OSTI2022

End-to-end Analytics for Grid Arch Design & All-hazard Assessment

Resiliency, reliability, and security of the next-generation smart grid depend upon leveraging advanced communication and computing technologies, integrating them with physical power systems, and developing real-time, fast, data-based applications to help in wide-area monitoring and control of the grid. Using a high sampling data rate from phasor measurement units (PMUs) to develop applications has opened the door to achieving the next-generation grid requirements. The North American Synchrophasor Initiative Network (NASPlnet) was developed in 2007-09 to create a standard and guide for PMU data exchanges. With the advancement in both networking and grid requirements, it is necessary to evaluate the performance of different NASPInet versions and their impact on applications. Therefore, we need a cyber-power cosimulation framework that supports very large-scale co-simulation capable of running in parallel, high-performance computing platforms and capturing real-life network behavior. This work presents a cyber-physical co-simulation testbed using NS3 to model the communication network, GridPACK to model the power grid, and HELICS as a co-simulation engine. Comparative analysis of latency in synchrophasor networks and a performance evaluation of a power system stabilizer application based on PMU data in an Institute of Electrical and Electronics Engineers 39-bus test system is presented using this co-simulation testbed.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2020

Steady-State Analysis of Microgrid Distributed Control Under Denial of Service Attacks

Distributed control is an effective method to coordinate multiple components in a microgrid. It usually has mandatory requirements for communication graph topology; changing the topology unexpectedly could disrupt the operation of a distributed controller. A denial of service (DoS) attack blocks communication channels to cause variations in communication graph. Unforeseen topology changes render a controller to receive incomplete system information. Control decisions made based on incorrect information can lead to significantly reduced grid supporting capability. As a result, the vital power balance between generation and load may be challenged. Determining power balance requires steady-state power flow analysis; however, the cyber-induced steady-state analysis is not well studied in the literature. Here, in this article, we show that a cyber–physical microgrid with unknown DoS attacks has augmented uncertain power flow equations, whose special structure creates new computational issue to determining power balance. To deal with the issue, we develop a novel cyber-induced microgrid model: the cyber–physical system is transformed into a pure physical model, where the disruption effects of DoS in the cyber layer are shown to be equivalent to the variations of the physical model parameters. With the transformed system, we develop a sufficient condition to ascertain the system power balance under unknown DoS attacks. In addition, practical insights for resilient distributed control design are shown as well.

24 POWER TRANSMISSION AND DISTRIBUTION↗
NASA NTRS1983

Nonlinear control of an experimental beam by IMSC

Results are reported from an experiment designed to control the vibratory motion of a beam at NASA, Langley Research Center. The experimental setup consists of a free-free uniform beam acted upon by four electromagnetic force actuators, with the motion being measured by nine displacement sensors. The entire assembly is linked to a CDC Cyber 175 computer which permits on-line real-time computation of the control forces. The control scheme is based on Independent Modal-Space Control (IMSC), whereby the modal forces are computed using a nonlinear, on-off control law. The actuator forces are then synthesized using a linear transformation, resulting in quantized forces. The sensors data is processed by modal filters. It is observed that the controls designed on the basis of the IMSC method are very effective in suppressing the vibratory motion of the beam, even though there is about a 50 percent differene between the actual and the analytically computed frequencies.

Meirovitch, L.↗
DOE OSTI2022

Microgrid Resilience: A Holistic and Context-Aware Resilience Metric

Microgrids present an effective solution for the coordinated deployment of various distributed energy resources and furthermore provide myriad additional benefits such as resilience, decreased carbon footprint, and reliability to energy consumers and the energy system as a whole. Boosting the resilience of distribution systems is another major benefit of microgrids. This is because they can also serve as a backup power source when the utility grid's operations are interrupted due to either high-probability low-impact events like a component failure or low-probability high-impact events - be it a natural disaster or a planned cyberattack. However, the degree to which any particular system can defend, adapt, and restore normal operation depends on various factors including the type and severity of events to which a microgrid is subjected. These factors, in turn, are dependent on the geographical location of the deployed microgrid as well as the cyber risk profile of the site where the microgrid is operating. Therefore, in this work, we attempt to capture this multi-dimensional interplay of various factors in quantifying the ability of the microgrid to be resilient in these varying aspects. This paper, thus, proposes a customized site-specific quantification of the resilience strength for the individual microgrid's capability to absorb, restore, and adapt to the changing circumstances for sustaining the critical load when a low-probability high-impact event occurs - termed as - context-aware resilience metric. We also present a case study to illustrate the key elements of our integrated analytical approach.

microgrid↗
DOE OSTI2014

Resilient Monitoring Systems: Architecture, Design, and Application to Boiler/Turbine Plant

Resilient monitoring systems, considered in this paper, are sensor networks that degrade gracefully under malicious attacks on their sensors, causing them to project misleading information. The goal of this work is to design, analyze, and evaluate the performance of a resilient monitoring system intended to monitor plant conditions (normal or anomalous). The architecture developed consists of four layers: data quality assessment, process variable assessment, plant condition assessment, and sensor network adaptation. Each of these layers is analyzed by either analytical or numerical tools. The performance of the overall system is evaluated using a simplified boiler/turbine plant. The measure of resiliency is quantified using Kullback-Leibler divergence, and is shown to be sufficiently high in all scenarios considered.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2013

Massive Scale Cyber Traffic Analysis: A Driver for Graph Database Research

We describe the significance and prominence of network traffic analysis (TA) as a graph- and network-theoretical domain for advancing research in graph database systems. TA involves observing and analyzing the connections between clients, servers, hosts, and actors within IP networks, both at particular times and as extended over times. Towards that end, NetFlow (or more generically, IPFLOW) data are available from routers and servers which summarize coherent groups of IP packets flowing through the network. IPFLOW databases are routinely interrogated statistically and visualized for suspicious patterns. But the ability to cast IPFLOW data as a massive graph and query it interactively, in order to e.g.\ identify connectivity patterns, is less well advanced, due to a number of factors including scaling, and their hybrid nature combining graph connectivity and quantitative attributes. In this paper, we outline requirements and opportunities for graph-structured IPFLOW analytics based on our experience with real IPFLOW databases. Specifically, we describe real use cases from the security domain, cast them as graph patterns, show how to express them in two graph-oriented query languages SPARQL and Datalog, and use these examples to motivate a new class of "hybrid" graph-relational systems.

Joslyn, Cliff A.↗