Search NASA⌕ Search

SEARCH · Search NASA

Results for “Detection approach”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 127 records · Page 7
All sourcesNASA NTRSDOE OSTI
DOE OSTI2023

A Randomization-Based, Zero-Trust Cyberattack Detection Method for Hierarchical Systems

This paper demonstrates a novel randomization-based approach for verifying power system control signals with application to detecting cyberattacks. We consider fully connected hierarchical systems containing multiple local agents and a global "trust" agent. The global agent uses a time-varying randomized assignment scheme to identify corrupt network links based on principles of zero trust and majority rule. To evaluate the performance of this detection approach, we implement our algorithm in MATLAB and run it against nearly 43 million unique attack scenarios spanning a range of system sizes. For each scenario, the algorithm determines whether the identified corruptions satisfy a set of validity constraints reflecting network topology and uses that result to say whether the recovered state value for one or more local agents is malicious. We compare the algorithm's determination to the true state of the system to assess performance and find that classification accuracy converges to 100% as system size increases, suggesting that the validity constraints become more difficult to satisfy for larger systems. We further explore the scenarios that evade detection to understand practical implications for employing this detection approach.

cybersecurity↗
DOE OSTI2025

CAMIS: A Cylindrical Active Mask Imaging System

Detecting and locating radiological and nuclear materials at distances of 10 m or more in urban and cluttered environments continues to pose challenges in nuclear security and proliferation detection. Previous approaches have focused on large-area radiation imaging using planar configurations of detectors and passive masks. However, these approaches suffer from limitations such as limited field-of-view (FOV) and reduced detection efficiency due to absorption in the mask. To address these limitations, we have developed the cylindrical active mask imaging system (CAMIS). This system comprises 128 NaI(Tl) (10 cm)3 detectors. These detectors are arranged in a cylindrical configuration, enabling gamma-ray imaging with a full 360° azimuthal FOV. The active mask elements within the system are arranged in a pseudorandom configuration, providing unique encoding for all incident directions within the FOV. CAMIS offers an effective detection area of approximately 1 m2 across the entire 360° FOV in the horizontal plane, achieving a mean angular resolution of 10.9° in the azimuthal direction and 12.9° in the polar direction measured by taking the full-width at half-maximum (FWHM) of a cross-section at the maximum reconstructed intensity.

Lamb, C↗
DOE OSTI2022

A Hybrid DC Fault Primary Protection Algorithm for Multi-Terminal HVdc Systems

Protection against dc faults is one of the main technical hurdles faced when operating converter-based HVdc systems. Protection becomes even more challenging for multi-terminal dc (MTdc) systems with more than two terminals/converter stations. In this paper, a hybrid primary fault detection algorithm for MTdc systems is proposed to detect a broad range of failures. Sensor measurements, i.e., line currents and dc reactor voltages measured at local terminals, are first processed by a top-level context clustering algorithm. For each cluster, the best fault detector is selected among a detector pool according to a rule resulting from a learning algorithm. The detector pool consists of several existing detection algorithms, each performing differently across fault scenarios. The proposed hybrid primary detection algorithm: i) offers superior performance compared to an individual detector through a data-driven approach; ii) detects all major fault types including pole-to-pole (P2P), pole-to-ground (P2G), and external dc faults; iii) identifies faults with various fault locations and impedances; iv) is more robust to noisy sensor measurements compared to existing methods; v) does not require exhaustive simulation and sampling for training the model. Performance and effectiveness of the proposed algorithm are evaluated and verified based on time-domain simulations in the PSCAD/EMTDC software environment. The results confirm satisfactory operation, accuracy, and detection speed of the proposed algorithm under various fault scenarios.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2023

A Fine-grained Asynchronous Bulk Synchronous parallelism model for PGAS applications

The Partitioned Global Address Space (PGAS) model is well suited for executing irregular applications on cluster-based systems, due to its efficient support for short, one-sided messages. Separately, the actor model has been gaining popularity as a productive asynchronous message-passing approach for distributed objects in enterprise and cloud computing platforms, typically implemented in languages such as Erlang, Scala or Rust. To the best of our knowledge, there has been no past work on using the actor model to deliver both productivity and scalability to irregular PGAS applications with large number of small messages. In this paper, we introduce a new programming system for PGAS applications, in which point-to-point remote operations can be expressed as fine-grained asynchronous actor messages. In our approach, the programmer does not need to worry about programming complexities related to message aggregation and termination detection. Our approach can be viewed as extending the classical Bulk Synchronous Parallelism model with fine-grained asynchronous communications within a phase or superstep. Here, we believe that our approach offers a desirable point in the productivity-performance space for PGAS applications, with more scalable performance and higher productivity relative to past approaches. Specifically, for seven irregular mini-applications from the Bale Kernels and three graph kernels executed using 2048 cores in the NERSC Cori system, our approach shows geometric mean performance improvements of ≥ 20X relative to standard PGAS versions (UPC and OpenSHMEM) while maintaining comparable productivity to those versions.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2026

A Semi-Supervised Learning Method for the Identification of Bad Exposures in Large Imaging Surveys

As the data volume of astronomical imaging surveys rapidly increases, traditional methods for image anomaly detection, such as visual inspection by human experts, are becoming impractical. We introduce a machine-learning-based approach to detect poor-quality exposures in large imaging surveys, with a focus on the DECam Legacy Survey (DECaLS) in regions of low extinction (i.e., E ( B − V ) < 0.04 ). Our semi-supervised pipeline integrates a vision transformer (ViT), trained via self-supervised learning (SSL), with a k-Nearest Neighbor (kNN) classifier. We train and validate our pipeline using a small set of labeled exposures observed by surveys with the Dark Energy Camera (DECam). A clustering-space analysis of where our pipeline places images labeled in good and bad categories suggests that our approach can efficiently and accurately determine the quality of exposures. Applied to new imaging being reduced for DECaLS Data Release 11, our pipeline identifies 780 problematic exposures, which we subsequently verify through visual inspection. Being highly efficient and adaptable, our method offers a scalable solution for quality control in other large imaging surveys.

Luo, Yufeng (ORCID:0000000246230683)↗
DOE OSTI2025

STILGAR End-of-Project Report

The Subsurface Tunnel Imaging LeveraGed by Analysis of Rayleigh wave ellipticity (STILGAR) project demonstrated an integrated geophysical approach for detecting, locating, and characterizing underground structural changes using dense seismic arrays and advanced inversion techniques. Field campaigns were conducted at two operational mines—the Redmond salt mine (Utah) and Graymont Pleasant Gap limestone mine (Pennsylvania)—providing real-world testbeds for monitoring anthropogenic subsurface activity. At the Redmond salt mine, seismic interferometry combined with back-projection inversion successfully identified continuous, low-amplitude signals from mining operations. The approach differentiated stationary from migrating anthropogenic sources, captured daily operational cycles, and validated the potential of passive seismic monitoring for remote detection of underground activity. At the Graymont Pleasant Gap mine, two dense seismic deployments in the spring and fall of 2023 generated over 4 TB of high-resolution data. Key outcomes included the relocation of 199 underground and 8 surface explosions with accuracies within tens of meters and the development of a 3D P-wave velocity model using the triple-difference tomography algorithm (tomoTD) that resolved major structural features such as the mine entrance, low-velocity tunnels, and roof-collapse areas. Ambient noise cross-correlation and back-projection analyses revealed persistent sources linked to ongoing mining activity, whereas horizontal-to-vertical spectral ratio (HVSR) and ellipticity studies confirmed stable site responses across seasons and identified soil thickness trends consistent with regional erosional and depositional processes. Checkerboard and sensitivity tests further validated the robustness of the tomographic results. Overall, the findings emphasize that although significant progress has been made in subsurface imaging, further work is needed to enhance the detection and localization of underground structures. Accurate imaging requires higher frequencies, yet anthropogenic sources tend to dominate the seismic record at those frequencies, and high-frequency surface waves are affected by higher modes that complicate interpretation. The improved detection and localization of human-induced signals enabled detailed temporal and spatial mapping of daily mine operations, demonstrating the feasibility of continuous anthropogenic source monitoring. Sensitivity to signals from nontraditional sources, such as fan operations, highlights the broader applicability of this approach to other industrial environments in which continuous and impulsive signals are present. The field campaigns produced a substantial volume of high-quality seismic data, supporting the development and testing of new methods for seismic source characterization and subsurface imaging. Future deployments should include sensors capable of recording lower frequencies to probe deeper structures, increase bandwidth to enhance resolution and sensitivity to both shallow and deep targets, and collect additional large-scale datasets to refine imaging and source characterization techniques. Moreover, conducting 3D modeling studies of seismic wavefields at higher frequencies will provide a better understanding of wave scattering and cavity–wavefield interactions in complex underground environments. In conclusion, the STILGAR project demonstrated that integrated seismic monitoring can effectively characterize underground operations, capturing both natural and anthropogenic signals. The approaches developed provide a foundation for improved detection, localization, and imaging of subsurface structures and are directly transferable to broader industrial monitoring applications.

58 GEOSCIENCES↗
DOE OSTI2024

Advancing Cyber-Attack Detection in Power Systems: A Comparative Study of Machine Learning and Graph Neural Network Approaches

This paper explores the detection and localization of cyber-attacks on power systems, focusing on comparing conventional machine learning (ML) and deep learning methods, and graph neural network (GNN)-based techniques. We assess the detection accuracy of these approaches and their potential to pinpoint the locations of specific buses under attack. Given the demonstrated success of GNNs in other time series anomaly detection applications, we aim to evaluate their performance within the context of power systems cyber-attack. Utilizing the IEEE 68-bus system, we simulated four types of attacks to test the selected approaches. Our results indicate that GNN-based methods outperform conventional machine learning and deep learning models in detection. Additionally, GNNs show promise in accurately localizing attacks for simple scenarios, although they still face challenges in more complex cases.

artificial intelligence↗
DOE OSTI2021

Physics-Based Feature Extraction from Bulk Time-Series PMU Datasets for Event Detection

In this work, two physics-based feature extraction techniques are developed for bulk time-series phasor measurement unit (PMU) datasets collected from the field to train the machine learning model for anomaly detection. Two approaches have been developed to extract useful features for different types of events. An admittance-based feature extraction technique is developed to detect events that involve line outages and system topology variations. The developed algorithm extracts the system equivalent admittance variation. Additionally, Fielder’s Theory is utilized to further reduce the potential computation burden by sectionalizing large-scale grids and datasets into smaller areas. Second, an oscillation-based feature extraction technique is developed to detect low-frequency oscillations in power grids. The dominant oscillation modes in the grids are extracted using energy-sorted Prony analysis. The extracted dominant oscillation modes by the developed work exhibit a high fitting resolution. Finally, the developed techniques have been validated using large-scale and real-world datasets.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2025

Covalent Drug Binding in Live Cells Monitored by Mid-Infrared Quantum Cascade Laser Spectroscopy: Photoactive Yellow Protein as a Model System

The detection of drug-target interactions in live cells enables analysis of therapeutic compounds in a native cellular environment. Recent advances in spectroscopy and molecular biology have facilitated the development of genetically encoded vibrational probes like nitriles that can sensitively report on molecular interactions. Nitriles are powerful tools for measuring electrostatic environments within condensed media like proteins, but such measurements in live cells have been hindered by low signal-to-noise ratios. In this study, we design a spectrometer based on a double-beam quantum cascade laser (QCL)-based transmission infrared (IR) source with balanced detection that can significantly enhance sensitivity to nitrile vibrational probes embedded in proteins within cells compared to a conventional FTIR spectrometer. Here, using this approach, we detect small-molecule binding in Escherichia coli, with particular focus on the interaction between para-Coumaric acid (pCA) and nitrile-incorporated photoactive yellow protein (PYP). This system effectively serves as a model for investigating covalent drug binding in a cellular environment. Notably, we observe large spectral shifts of up to 15 cm –1 for nitriles embedded in PYP between the unbound and drug-bound states directly within bacteria, in agreement with observations for purified proteins. Such large spectral shifts are ascribed to the changes in the hydrogen-bonding environment around the local environment of nitriles, accurately modeled through high-level molecular dynamics simulations using the AMOEBA force field. Our findings underscore the QCL spectrometer’s ability to enhance sensitivity for monitoring drug–protein interactions, offering new opportunities for advanced methodologies in drug development and biochemical research.

chromophores↗
DOE OSTI2021

Seismic savanna: machine learning for classifying wildlife and behaviours using ground‐based vibration field recordings

Abstract We develop a machine learning approach to detect and discriminate elephants from other species, and to recognise important behaviours such as running and rumbling, based only on seismic data generated by the animals. We demonstrate our approach using data acquired in the Kenyan savanna, consisting of 8000 h seismic recordings and 250 k camera trap pictures. Our classifiers, different convolutional neural networks trained on seismograms and spectrograms, achieved 80%–90% balanced accuracy in detecting elephants up to 100 m away, and over 90% balanced accuracy in recognising running and rumbling behaviours from the seismic data. We release the dataset used in this study: SeisSavanna represents a unique collection of seismic signals with the associated wildlife species and behaviour. Our results suggest that seismic data offer substantial benefits for monitoring wildlife, and we propose to further develop our methods using dense arrays that could result in a seismic shift for wildlife monitoring.

Szenicer, Alexandre↗
DOE OSTI2026

Emerging anomaly detection techniques for electronic health records: A survey

Background Anomaly detection in electronic health records (EHRs) is a cornerstone of biomedical informatics, with direct implications for patient safety, clinical decision-making, and the prevention of healthcare fraud. Once guided primarily by simple rule-based methods, the field has advanced rapidly, driven by increased computing power, richer and more detailed health data, and the rise of machine learning and deep learning techniques. The objective of this paper is to provide a comprehensive overview of modern approaches to detecting anomalies in EHRs, outlining their strengths, limitations, and relevance to key healthcare challenges. We review traditional statistical methods alongside newer ML- and DL-based strategies and hybrid models, with particular attention to how these techniques support transparency and build clinical trust. Methods This paper presents a thorough and critical survey through systematic review (PRISMA-based) of the latest anomaly detection strategies in time-sequence data domains within electronic health record systems. Results We explore a broad spectrum of methodologies, including statistical models, supervised and unsupervised learning approaches, hybrid frameworks, and state-of-the-art ML-based techniques that collectively advance the precision and scalability of detecting anomalies in complex clinical datasets. In addition to mapping current capabilities, we address the enduring challenges that hinder widespread implementation and provide a forward-looking perspective on the future of anomaly detection in the data-rich landscape of modern healthcare. Summary The advancement in AI-based approaches is reported along with the basic principles of the individual approaches and their applicability. The increased availability of high-quality data, advancements in DL approaches, and enhanced computation power are leading to more frequent adaptation of DL-based approaches. Emerging DL-based approaches that have been adapted in other domains or recently applied in the EHR domain are also discussed in detail. Although DL-based approaches can improve model predictions by incorporating comorbidities, their application is limited in low-frequency data domains (e.g., when the total available data remains in the single digits). Therefore, the user must carefully consider the application based on data availability.

Anomaly detection↗
DOE OSTI2024

Perspectives and Challenges in Bolide Infrasound Processing and Interpretation: A Focused Review with Case Studies

Infrasound sensing plays a critical role in the detection and analysis of bolides, offering passive, cost-effective global monitoring capabilities. Key objectives include determining the timing, location, and yield of these events. Achieving these goals requires a robust approach to detect, analyze, and interpret rapidly moving elevated sources such as bolides (also re-entry). In light of advancements in infrasonic methodologies, there is a need for a comprehensive overview of the characteristics that distinguish bolides from other infrasound sources and methodologies for bolide infrasound analysis. This paper provides a focused review of key considerations and presents a unified framework to enhance infrasound processing approaches specifically tailored for bolides. Three representative case studies are presented to demonstrate the practical application of infrasound processing methodologies and deriving source parameters while exploring challenges associated with bolide-generated infrasound. These case studies underscore the effectiveness of infrasound in determining source parameters and highlight interpretative challenges, such as variations in signal period measurements across different studies. Future research should place emphasis on improving geolocation and yield accuracy. This can be achieved through rigorous and systematic analyses of large, statistically significant samples of such events, aiming to resolve interpretative inconsistencies and explore the causes for variability in signal periods and back azimuths. The topic described here is also relevant to space exploration involving planetary bodies with atmospheres, such as Venus, Mars, and Titan.

79 ASTRONOMY AND ASTROPHYSICS↗
DOE OSTI2025

Anomaly Detection in Electronic Health Records Across Hospital Networks: Integrating Machine Learning With Graph Algorithms

In a large hospital system, a network of hospitals relies on electronic health records (EHRs) to make informed decisions regarding their patients in various clinical domains. Consequently, the dependability of the health information technology (HIT) systems responsible for collecting EHR data is of utmost importance for patient safety. Recently, novel methods and tools aimed at identifying anomalies in EHR data to bolster the reliability of HIT systems have been introduced. However, these existing methods and tools primarily concentrate on individual hospitals, which limits our understanding of system-wide anomalous events and their potential impact on patient safety across multiple hospitals. In this article, we introduce a new approach to detecting anomalies in EHR data within a network of hospitals. This is achieved by combining advanced machine learning techniques with graph algorithms to create a tool capable of swiftly identifying and responding to deviations. Our proposed approach employs a combination of five machine learning models, harnessing the unique strengths of each model to provide a more robust detection system. The detected anomalies are then represented as graphs, allowing us to recognize patterns across the hospital network. This aids in identifying anomalies that span multiple medical facilities, potentially indicating broader system-level risks. Extensive real-world testing of our approach demonstrated its ability to offer actionable insights compared to existing methods. Additionally, its scalable design ensures seamless integration into existing HIT infrastructures.

Niu, Haoran [Oak Ridge National Laboratory (ORNL),↗
DOE OSTI2022

Computational Imaging for Intelligence in Highly Scattering Aerosols (Final Report)

Natural and man-made degraded visual environments pose major threats to national security. The random scattering and absorption of light by tiny particles suspended in the air reduces situational awareness and causes unacceptable down-time for critical systems and operations. To improve the situation, we have developed several approaches to interpret the information contained within scattered light to enhance sensing and imaging in scattering media. These approaches were tested at the Sandia National Laboratory Fog Chamber facility and with tabletop fog chambers. Computationally efficient light transport models were developed and leveraged for computational sensing. The models are based on a weak angular dependence approximation to the Boltzmann or radiative transfer equation that appears to be applicable in both the moderate and highly scattering regimes. After the new model was experimentally validated, statistical approaches for detection, localization, and imaging of objects hidden in fog were developed and demonstrated. A binary hypothesis test and the Neyman-Pearson lemma provided the highest theoretically possible probability of detection for a specified false alarm rate and signal-to-noise ratio. Maximum likelihood estimation allowed estimation of the fog optical properties as well as the position, size, and reflection coefficient of an object in fog. A computational dehazing approach was implemented to reduce the effects of scatter on images, making object features more readily discernible. We have developed, characterized, and deployed a new Tabletop Fog Chamber capable of repeatably generating multiple unique fog-analogues for optical testing in degraded visual environments. We characterized this chamber using both optical and microphysical techniques. In doing so we have explored the ability of droplet nucleation theory to describe the aerosols generated within the chamber, as well as Mie scattering theory to describe the attenuation of light by said aerosols, and correlated the aerosol microphysics to optical properties such as transmission and meteorological optical range (MOR). This chamber has proved highly valuable and has supported multiple efforts inclusive to and exclusive of this LDRD project to test optics in degraded visual environments. Circularly polarized light has been found to maintain its polarization state better than linearly polarized light when propagating through fog. This was demonstrated experimentally in both the visible and short-wave infrared (SWIR) by imaging targets made of different commercially available retroreflective films. It was found that active circularly polarized imaging can increase contrast and range compared to linearly polarized imaging. We have completed an initial investigation of the capability for machine learning methods to reduce the effects of light scattering when imaging through fog. Previously acquired experimental long-wave images were used to train an autoencoder denoising architecture. Overfitting was found to be a problem because of lack of variability in the object type in this data set. The lessons learned were used to collect a well labeled dataset with much more variability using the Tabletop Fog Chamber that will be available for future studies. We have developed several new sensing methods using speckle intensity correlations. First, the ability to image moving objects in fog was shown, establishing that our unique speckle imaging method can be implemented in dynamic scattering media. Second, the speckle decorrelation over time was found to be sensitive to fog composition, implying extensions to fog characterization. Third, the ability to distinguish macroscopically identical objects on a far-subwavelength scale was demonstrated, suggesting numerous applications ranging from nanoscale defect detection to security. Fourth, we have shown the capability to simultaneously image and localize hidden objects, allowing the speckle imaging method to be effective without prior object positional information. Finally, an interferometric effect was presented that illustrates a new approach for analyzing speckle intensity correlations that may lead to more effective ways to localize and image moving objects. All of these results represent significant developments that challenge the limits of the application of speckle imaging and open important application spaces. A theory was developed and simulations were performed to assess the potential transverse resolution benefit of relative motion in structured illumination for radar systems. Results for a simplified radar system model indicate that significant resolution benefits are possible using data from scanning a structured beam over the target, with the use of appropriate signal processing.

58 GEOSCIENCES↗
DOE OSTI2023

Localized keyhole pore prediction during laser powder bed fusion via multimodal process monitoring and X-ray radiography

Systematic fault detection and control during laser powder bed fusion (L-PBF) has been a long-standing objective for system manufacturers and researchers in the additive manufacturing (AM) industry. This manuscript investigates a data fusion approach for detection of keyhole porosity formation during laser irradiation of Ti-6Al-4V substrates by concurrent recording of thermally induced optical emission measured using both off-axis and coaxial photodiode sensors, and acoustic emission. Subsurface defect formation was monitored via high-speed synchrotron X-ray imaging at 20,000 frames per second, enabling temporal registration of keyhole pore formation events to the monitoring signals at a resolution of 50 µs. We developed data fusion machine learning (ML) models for localized prediction of keyhole pore formation at various time scales ranging from 0.5 ms to 2 ms. The signal segments were featurized using two independent approaches: (1) power spectral density (PSD) and (2) highly comparative time series analysis (HCTSA) framework. The extracted features from different sensor modalities were fused together to construct a multimodal feature space and sequential feature selection was used to determine the most informative features for training the ML models. The predictive performance was evaluated for three classifying algorithms: Support Vector Machine (SVM), K-Nearest Neighbor (KNN), and Gaussian Naive Bayes (GNB). As a result, pore formation events were predicted with up to 0.95 F1-score, 1.0 recall and 0.94 accuracy. The most heavily weighted features indicate that model performance is chiefly governed by the acoustic monitoring signal, with a secondary contribution from the optical emission sensors.

36 MATERIALS SCIENCE↗
DOE OSTI2023

Change Detection Applications in the Earth Sciences Using UAS-Based Sensing: A Review and Future Opportunities

Over the past decade, advancements in collection platforms such as unoccupied aerial systems (UAS), survey-grade GNSS, sensor packages, processing software, and spatial analytical tools have facilitated change detection analyses at an unprecedented resolution over broader spatial and temporal extents and in environments where such investigations present challenges. These technological improvements, coupled with the accessibility and versatility of UAS technology, have pushed the boundaries of spatial and temporal scales in geomorphic change detection. As a result, the cm-scale analysis of topographic signatures can detect and quantify surface anomalies during geomorphic evolution. This review focuses on the use of UAS photogrammetry for fine spatial (cm) and temporal (hours to days) scale geomorphic analyses, and it highlights analytical approaches to detect and quantify surface processes that were previously elusive. The review provides insight into topographic change characterization with precise spatial validations applied to landscape processes in various fields, such as the cryosphere and geosphere, as well as anthropogenic earth processes and national security applications. This work sheds light on previously unexplored aspects of both natural and human-engineered environments, demonstrating the potential of UAS observations in change detection. Our discussion examines the emerging horizons of UAS-based change detection, including machine learning and LIDAR systems. In addition, our meta-analysis of spatial and temporal UAS-based observations highlights the new fine-scale niche of UAS-photogrammetry. This scale advancement sets a new frontier in change detection, offering exciting possibilities for the future of land surface analysis and environmental monitoring in the field of Earth Science.

Andresen, Christian G.↗
DOE OSTI2022

Detecting CAN Masquerade Attacks with Signal Clustering Similarity

Vehicular Controller Area Networks (CANs) are susceptible to cyber attacks of different levels of sophistication. Fabrication attacks are the easiest to administer—an adversary simply sends (extra) frames on a CAN—but also the easiest to detect because they disrupt frame frequency. To overcome time-based detection methods, adversaries must administer masquerade attacks by sending frames in lieu of (and therefore at the expected time of) benign frames but with malicious payloads. Research efforts have proven that CAN attacks, and masquerade attacks in particular, can affect vehicle functionality. Examples include causing unintended acceleration, deactivation of vehicle’s brakes, as well as steering the vehicle. We hypothesize that masquerade attacks modify the nuanced correlations of CAN signal time series and how they cluster together. Therefore, changes in cluster assignments should indicate anomalous behavior. We confirm this hypothesis by leveraging our previously developed capability for reverse engineering CAN signals (i.e., CAN-D [Controller Area Network Decoder]) and focus on advancing the state of the art for detecting masquerade attacks by analyzing time series extracted from raw CAN frames. Specifically, we demonstrate that masquerade attacks can be detected by computing time series clustering similarity using hierarchical clustering on the vehicle’s CAN signals (time series) and comparing the clustering similarity across CAN captures with and without attacks. We test our approach in a previously collected CAN dataset with masquerade attacks (i.e., the ROAD dataset) and develop a forensic tool as a proof of concept to demonstrate the potential of the proposed approach for detecting CAN masquerade attacks.

Moriano Salazar, Pablo↗