Search NASA⌕ Search

SEARCH · Search NASA

Results for “Threat Detection”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 145 records · Page 8

Anomaly Detection and Mitigation for Dynamic Frequency Regulation in Hydropower-Battery Systems

Hydropower operators and energy storage providers are increasingly interested in participating in frequency regulation services, driven by the incentives offered by independent system operators, such as the PJM Interconnection. This transition, however, unfolds against the backdrop of a modernizing and rapidly digitizing power grid, exposing the integrated legacy infrastructure to a multitude of cybersecurity threats. This work presents an approach for developing an anomaly detection and mitigation system to address cybersecurity challenges during the participation of a hydropower-integrated battery energy storage system (BESS) in a frequency regulation market. The applied anomaly detector utilizes machine learning algorithms to provide detailed classification of cyber-physical events. Later, the applied mitigation system triggers predefined corrective actions to minimize the impact of data integrity attacks on the regulation market and system stability. We evaluated the proposed approach on a hydropower-integrated BESS topology, specifically analyzing the slow regulation signal (Reg A) coming from the PJM market. Our simulation results demonstrate that the proposed approach performs well in detecting data integrity attacks within the allocated time frame and also minimizes the system's transient instability during the participation of hydropower and BESS in the regulation market.

battery energy storage system↗

A cell-based Papain-like Protease (PLpro) activity assay for rapid detection of active SARS-CoV-2 infections and antivirals

Severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2) and its variants are a continuous threat to human life. An urgent need remains for simple and fast tests that reliably detect active infections with SARS-CoV-2 and its variants in the early stage of infection. Here we introduce a simple and rapid activity-based diagnostic (ABDx) test that identifies SARS-CoV-2 infections by measuring the activity of a viral enzyme, Papain-Like protease (PLpro). The test system consists of a peptide that fluoresces when cleaved by SARS PLpro that is active in crude, unprocessed lysates from human tongue scrapes and saliva. Test results are obtained in 30 minutes or less using widely available fluorescence plate readers, or a battery-operated portable instrument for on-site testing. Proof-of-concept was obtained in a study on clinical specimens collected from patients with COVID-19 like symptoms who tested positive (n = 10) or negative (n = 10) with LIAT RT-PCR using nasal mid turbinate swabs. When saliva from these patients was tested with in-house endpoint RT-PCR, 17 were positive and only 5 specimens were negative, of which 2 became positive when tested 5 days later. PLpro activity correlated in 17 of these cases (3 out of 3 negatives and 14 out of 16 positives, with one invalid specimen). Despite the small number of samples, the agreement was significant (p value = 0.01). Two false negatives were detected, one from a sample with a late Ct value of 35 in diagnostic RT-PCR, indicating that an active infection was no longer present. The PLpro assay is easily scalable and expected to detect all viable SARS-CoV-2 variants, making it attractive as a screening and surveillance tool. Additionally, we show feasibility of the platform as a new homogeneous phenotypic assay for rapid screening of SARS-CoV-2 antiviral drugs and neutralizing antibodies.

60 APPLIED LIFE SCIENCES↗

Automatic DDoS Attack Detection on SDNs: Preprint

Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks pose a serious threat to computing networks - especially to critical systems within the U.S. electrical grid. As attack mechanisms have increased in complexity and variety, more sophisticated detection mechanisms have become necessary to ensure network security. This paper explores the use of artificial intelligence to automate the process of detection and mitigation of DoS and DDoS attacks within the framework of Software-Defined Networking (SDN), to a high degree. Machine learning algorithms are trained to recognize DoS and DDoS attacks and are deployed in real-time to mitigate malicious network traffic. The results show a well-tuned gradient-boosted decision tree detecting DoS and DDoS attacks, as well as initial successful mitigation of attacks within an SDN framework.

cyber detection↗

Federated Machine Learning-Based Anomaly Detection System for Synchrophasor Network Using Heterogeneous Data Sets: Preprint

Synchrophasor technology is widely deployed in the energy management system to monitor the grid health at micro level and perform necessary corrective actions in real time; however, integrated phasor devices and data aggregators are exposed to several cybersecurity threats. This paper proposes a federated ML(FML)-based ADS to detect several data integrity attacks in the synchrophasor network. The proposed approach integrates the horizontal FML technique and consists of substation-based local models and a control center-based global model. The proposed methodology includes training local models using heterogeneous data sets that include network and grid information and updating the global model through multiple iterations by sharing model gradients. Finally, the trained global model is applied to identify cyberattacks, normal operation, and physical events. To validate the proof of concept, we used synthetic data sets generated by Mississippi State University and Oak Ridge National Laboratory for training and testing the classification models using the National Renewable Energy Laboratory's high performance computing resources. Our experimental results, computed through several performance measures, reveal that the proposed approach shows consistent performance during the binary, three-class, and multiclass classifications while ensuring privacy of synchrophasor data.

anomaly detection system↗

Lightning strike prediction at the Savannah River Site

At the Savannah River Site, employees receive warnings about lightning only after three strikes have already occurred near the site. In order to increase employee safety, it is preferential to warn employees of a lightning threat much sooner. We used data from an on-site Electric Field Mill to measure values of the atmospheric electric charge. We also used lightning detection data from the National Lightning Detection Network and the Geostationary Lightning Mapper. By comparing the data of each, we can determine how long before or after a lightning strike did the Electric Field Mill first measure within our lightning detection threshold. If the detection threshold occurs before the strike does, this provides a lead time for knowing about lightning risks before they happen. Our findings conclude that 95% of lightning strikes have a lead time in the electric field where we can predict the lightning before it occurs and warn employees of the potential lightning threat. However, our lightning detection threshold can occur even without lightning or precipitation. Finding how these false lightning alarms affect our data is necessary to improving the lightning warning system.

54 ENVIRONMENTAL SCIENCES↗

Characterizing Human Performance: Detecting Targets at High False Alarm Rates [Slides]

Analysts develop a “no threat” bias with high false alarms. If only shown alarms for actual attacks, may never actually see an alarm. We see this in the laboratory, but not often studied in applied environments. (TSA is an exception.) In this work, near-operational paradigms are useful, but difficult to construct well. Pilot testing is critical before engaging time-limited professionals. Experimental control is difficult to balance with operational realism. Grounding near-operational experiments in basic research paradigms has both advantages and disadvantages. Despite shortcomings in our second experiment, we now have a platform for experimental investigations into the human element of physical security systems.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

Model-Based Diagnostics and Mitigation of Cyber Threats

The report summarizes key tasks performed to develop a toolkit for detecting cyber-attack events in instrumentation and control (I&C) systems of nuclear power plants. The toolkit connects the state-of-the-art GPWR Simulator with the RELAP5 code providing best-estimate nuclear steam supply system (NSSS) analyses, via the application programming interface (API), and allows users to introduce potential cyber-attack scenarios into power plant operational simulation. This summary for the project reflects topical reports submitted during the project as well as a journal paper published in 2022. The focus areas of the summary include: (1) modeling I&C systems for the AP1000 Generation III+ nuclear plant and GPWR simulator, (2) simulation and monitoring of plant response to cyber-attack events, (3) API structure for the toolkit interfacing the GPWR simulator and RELAP5 code, and (4) restructuring of the three-loop NSSS software of GPWR to model the two-loop AP1000 structure. Discussed in some details are (a) the attack tree analysis assessing the susceptibility of the AP1000 I&C system, resulting in reactor trips, in terms of the attack possibility and component sensitivity and (b) realistic estimation of the time to steam generator trip due to cyber-intrusions in the GPWR Simulator. Finally, sample demonstrations of the cyber-security tool kit, in the form of the GPWR-RELAP5 API, are summarized.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

Sequence-Based Anomaly Detection in Critical Infrastructure Networks

United States critical infrastructure faces new cyber threats from adversarial nation-state actors in the form of malware-free attacks. Traditional cybersecurity techniques use rules-based methods to identify indicators of compromise on networks, often missing these sophisticated attacks. Our approach leverages multiple state of the art machine learning models in a pipeline to identify abnormal network events through sequential analysis. We combine both device and packet-level information into individual events to characterize anomalous network actions. The model is trained and tested on real network traffic from the Idaho National Lab High Performance Computing (HPC) with greater than 98% precision. It is capable of flagging malicious tactics used by adversaries in malware-free attacks, severe changes to the network, and abnormal user activity by network devices.

99 - GENERAL AND MISCELLANEOUS↗

Gamma Spectroscopy Detector Candidates and Radioisotope Identification Algorithms for Use in National Security Applications

In 2006, the United States Congress mandated for the Department of Homeland Security (DHS) to screen all cargo containers to protect against terrorist acts and ensure the safety and security of the nation. Containers are screened by gamma and neutron detectors to ensure threat material is not smuggled into the country. However, because commerce is radioactive, detecting the presence of radioactive materials is not sufficient in ensuring the safety and security of the nation. Radioactive materials must also be identified in real time, thus distinguishing threat sources (Uranium-235 and Plutonium-230) from non-threat sources (kitty litter, pot ash, medical isotopes). Screening cargo containers can be considered a two-step process (1) alerting to the presence of radioactive material when gamma counts exceed a threshold setting, and (2) once alerted, identifying the type of radioactive material, which is done by collecting a gamma spectra and analyzing it with an analysis tool/algorithm. For this reason, it is important to evaluate not only emerging technology in neutron and gamma detection, but also investigate new advances in algorithm development for radioisotope identification (RIID). New candidates in detection and on-board algorithm analysis might offer opportunities to make the scanning, detection, and identification process more efficient while still ensuring the health and safety of the public. This research will investigate emerging technology in radiation detection focused on gamma spectroscopy capabilities and RIID algorithms for DHS applications.

61 RADIATION PROTECTION AND DOSIMETRY↗

Protection Against Graph-Based False Data Injection Attacks on Power Systems

Graph signal processing (GSP) has emerged as a powerful tool for practical network applications, including power system monitoring. By representing power system voltages as smooth graph signals, recent research has focused on developing GSP-based methods for state estimation, attack detection, and topology identification. Included, efficient methods have been developed for detecting false data injection (FDI) attacks, which until now were perceived as non-smooth with respect to the graph Laplacian matrix. Consequently, these methods may not be effective against smooth FDI attacks. In this paper, we propose a graph FDI (GFDI) attack that minimizes the Laplacian-based graph total variation (TV) under practical constraints. In addition, we develop a low-complexity algorithm that solves the non-convex GDFI attack optimization problem using ell_1-norm relaxation, the projected gradient descent (PGD) algorithm, and the alternating direction method of multipliers (ADMM). We then propose a protection scheme that identifies the minimal set of measurements necessary to constrain the GFDI output to high graph TV, thereby enabling its detection by existing GSP-based detectors. Our numerical simulations on the IEEE-57 bus test case reveal the potential threat posed by well-designed GSP-based FDI attacks. Moreover, we demonstrate that integrating the proposed protection design with GSP-based detection can lead to significant hardware cost savings compared to previous designs of protection methods against FDI attacks.

Morgenstern, Gal↗

Integration of SARS-CoV-2 testing and genomic sequencing into influenza sentinel surveillance in Uganda, January to December 2022

The Uganda Virus Research Institute, National Influenza Center laboratory integrated SARS-CoV-2 polymerase chain reaction testing and genomic sequencing into the influenza surveillance program that was established in 2007. A total of 7,698 nasopharyngeal/oropharyngeal (NP/OP) swab samples were collected and analyzed from ILI/SARI sentinel sites across the country from January to December 2022. All samples were tested for influenza and SARS-CoV-2. Of these, 252 (3.3%), 162 (2.1%), and 589 (7.7%) were positive for influenza A, influenza B, and SARS-CoV-2, respectively. Out of 414 influenza-positive samples, 122 (29.5%) were AH1pdm09, 130 (31.4%) were AH3, and 162 (39.1%) were B-Victoria. All SARS-CoV-2 sequenced samples were of the Omicron variant, with subvariants of concern known to evade the immune system being detected, such as BQ.1 and XBB.2. Other SARS-CoV-2 positive samples collected from other health centers in the community outside the surveillance sites were included into SARS-CoV-2 genomic sequencing with similar patterns with respect to variants. In all, the ILI/SARI surveillance system has shown to be an efficient, cost-effective, and sustainable program, providing a ready platform to monitor the circulation of SARS-CoV-2 in communities at the national level while remaining vigilant for the persistent threat of influenza. The integration of SARS-CoV-2 detection and genomic surveillance into the influenza surveillance program will strengthen the laboratory response capacity, as well as facilitate the timely release of SARS-CoV-2 genomic information to be used to complement the multiple response strategies for COVID-19 pandemic mitigation.

59 BASIC BIOLOGICAL SCIENCES↗

Exhaled breath biomarkers of influenza infection and influenza vaccination

Respiratory viral infections are considered a major public health threat, and breath metabolomics can provide new ways to detect and understand how specific viruses affect the human pulmonary system. In this pilot study, we characterized the metabolic composition of human breath for an early diagnosis and differentiation of influenza viral infection, as well as other types of upper respiratory viral infections. We first studied the non-specific effects of planned seasonal influenza vaccines on breath metabolites in healthy subjects after receiving the immunization. We then investigated changes in breath content from hospitalized patients with flu-like symptoms and confirmed upper respiratory viral infection. The exhaled breath was sampled using a custom-made breath condenser, and exhaled breath condensate (EBC) samples were analysed using liquid chromatography coupled to quadruplole-time-of-flight mass spectrometer (LC-qTOF). All metabolomic data was analysed using both targeted and untargeted approaches to detect specific known biomarkers from inflammatory and oxidative stress biomarkers, as well as new molecules associated with specific infections. We were able to find clear differences between breath samples collected before and after flu vaccine administration, together with potential biomarkers that are related to inflammatory processes and oxidative stress. Moreover, we were also able to discriminate samples from patients with flu-related symptoms that were diagnosed with confirmatory respiratory viral panels (RVPs). RVP positive and negative differences were identified, as well as differences between specific viruses defined. These results provide very promising information for the further study of the effect of influenza A and other viruses in human systems by using a simple and non-invasive specimen like breath.

60 APPLIED LIFE SCIENCES↗

An accurate and interpretable model for antimicrobial resistance in pathogenic Escherichia coli from livestock and companion animal species

Understanding the microbial genomic contributors to antimicrobial resistance (AMR) is essential for early detection of emerging AMR infections, a pressing global health threat in human and veterinary medicine. Here we used whole genome sequencing and antibiotic susceptibility test data from 980 disease causing Escherichia coli isolated from companion and farm animals to model AMR genotypes and phenotypes for 24 antibiotics. We determined the strength of genotype-to-phenotype relationships for 197 AMR genes with elastic net logistic regression. Model predictors were designed to evaluate different potential modes of AMR genotype translation into resistance phenotypes. Our results show a model that considers the presence of individual AMR genes and total number of AMR genes present from a set of genes known to confer resistance was able to accurately predict isolate resistance on average (mean F 1 score = 98.0%, SD = 2.3%, mean accuracy = 98.2%, SD = 2.7%). However, fitted models sometimes varied for antibiotics in the same class and for the same antibiotic across animal hosts, suggesting heterogeneity in the genetic determinants of AMR resistance. We conclude that an interpretable AMR prediction model can be used to accurately predict resistance phenotypes across multiple host species and reveal testable hypotheses about how the mechanism of resistance may vary across antibiotics within the same class and across animal hosts for the same antibiotic.

Chung, Henri C.↗

A Projected Network Model of Online Disinformation Cascades

Within the past half-decade, it has become overwhelmingly clear that suppressing the spread of deliberate false and misleading information is of the utmost importance for protecting democratic institutions. Disinformation has been found to come from both foreign and domestic actors, but the effects from either can be disastrous. From the simple encouragement of unwarranted distrust to conspiracy theories promoting violence, the results of disinformation have put the functionality of American democracy under direct threat. Present scientific challenges posed by this problem include detecting disinformation, quantifying its potential impact, and preventing its amplification. We present a model on which we can experiment with possible strategies toward the third challenge: the prevention of amplification. This is a social contagion network model, which is decomposed into layers to represent physical, ''offline'', interactions as well as virtual interactions on a social media platform. Along with the topological modifications to the standard contagion model, we use state-transition rules designed specifically for disinformation, and distinguish between contagious and non-contagious infected nodes. We use this framework to explore the effect of grassroots social movements on the size of disinformation cascades by simulating these cascades in scenarios where a proportion of the agents remove themselves from the social platform. We also test the efficacy of strategies that could be implemented at the administrative level by the online platform to minimize such spread. These top-down strategies include banning agents who disseminate false information, or providing corrective information to individuals exposed to false information to decrease their probability of believing it. We find an abrupt transition to smaller cascades when a critical number of random agents are removed from the platform, as well as steady decreases in the size of cascades with increasingly more convincing corrective information. Finally, we compare simulated cascades on this framework with real cascades of disinformation recorded on Whatsapp surrounding the 2019 Indian election. We find a set of hyperparameter values that produces a distribution of cascades matching the scaling exponent of the distribution of actual cascades recorded in the dataset. We acknowledge the available future directions for improving the performance of the framework and validation methods, as well as ways to extend the model to capture additional features of social contagion.

42 ENGINEERING↗

Outcomes of PAX sapiens-Supported Global Wildlife Data Sharing Conferences for Enhanced One Health Security (GWDSC)

Across two consecutive Global Wildlife Data Sharing Conferences supported by PAX sapiens—Year 1 (May 2024) at Pacific Northwest National Laboratory and Year 2 (2025) in Ciudad Real, Spain—the initiative converted wildlife data sharing from aspiration into operational reality, producing measurable impacts in platform development, data mobilization, standards harmonization, and international partnership formation. The conferences addressed a critical gap in global health security: while 75% of emerging infectious diseases affect both humans and animals and over 60% originate in wildlife, wildlife health surveillance has historically lagged behind human and agricultural sectors due to fragmented databases, inconsistent terminology, uneven capacity, and limited cross-border coordination. By convening practitioners, government agencies, international organizations, academic institutions, and NGOs, the GWDSC catalyzed trust-based relationships and practical workflows that enable earlier detection, better risk assessment, and more effective prevention of threats at the wildlife–domestic animal–human–environment interface.

54 ENVIRONMENTAL SCIENCES↗

Cybersecurity for Distributed Energy Resources: All Hazards Approach for Grid Modernization

Distributed energy resources (DER) sit at the intersection of IoT and critical infrastructure. As we work towards clean energy and decarbonization targets, high rates of growth of DER are expected, making them an important component of generation and grid services. They have been a part of the explosion of internet connected devices developed to solve real-world problems and make life easier by providing clean, local energy and enable the smart management of grid services. However, the quick-to-market, low-cost drivers for DER, combined with a historically relative low-impact has meant that cybersecurity has not been a top priority. So as DER penetration increases, will DER be a part of the growing challenge of securing the grid, or part of the solution for necessary grid modernization? In this talk, we will discuss the factors that have led to our current position and what makes cybersecurity for DER unique. A wide range of research is conducted at national labs, in partnership with industry and academia, to inform everything from standards and regulation, to the development of cyber-physical anomaly detection through use of digital twins, and even advanced threat analytics to SBOM and HBOM tracking. Even with this multi-faceted approach to the challenges, the question remains: is this too little too late or are we doing enough to secure the grid for the next 30 years?

14 SOLAR ENERGY↗

Towards Content Authenticity: Multimodal Fake News Detection and AI-Generated Text Identification

In today’s digital world, the spread of fake news and the rise of AI-generated text have become major threats to content authenticity and public trust. This thesis addresses both challenges through two complementary research directions: detecting fake news using multimodal features, and identifying AI-generated text using semantic and structural reasoning. The first part of the work focuses on fake news detection by introducing a novel model that combines text and image features through a unique rotational attention mechanism. Unlike traditional attention methods, this approach rotates the roles of query, key, and value across modalities to capture deeper interactions. Additionally, the model incorporates external domain information by linking news posts to top-ranked websites from Google search results, which helps assess the credibility of content based on its broader web context. This results in a more reliable and accurate fake news detection system that outperforms existing state-of-the-art methods. The second part presents SGG-ATD, a new framework for detecting AI-generated text. It uses masked language modeling to measure sentence coherence, followed by constructing a graph where keywords—both original and predicted—are connected based on semantic and contextual similarity. A Graph Convolutional Network (GCN) is then used to learn structural relationships within the text for final classification. Experimental results demonstrate that SGG-ATD achieves high F1-scores and consistently outperforms strong baselines. This method contributes to robust AI text detection, supporting accountability and resilience against AI-driven misinformation.

Gupta, Nidhi↗

PRIMED for the Future: Purposing Raw Intake for Machine Learning-Enabled Detection (Final Report)

The COVID-19 pandemic demonstrated how a novel, elusive, and diffuse biological threat can engender uncertainty and misinformation, and it underscored the need for flexible analytical modalities agnostic to the identity of biological material. Yet even before the pandemic, recognition of the limitations of the current, list-based approach, which focuses on known pathogens and biotoxins, and of the importance of agent-agnostic biodetection was growing within the biosecurity community. In a 2018 report on “Biodefense in the Age of Synthetic Biology,” for example, the National Academy of Sciences stated that “an overreliance on the Select Agent List is a systematic weakness affecting many aspects of the United States’ current biodefense mitigation capability”. More recently, a group of biodefense researchers proposed the identification and adoption of “bioagent-agnostic signatures (BASs)” as a way of detecting and characterizing not only existing agents but also novel ones, an approach they believe will “enable a more flexible and resilient biodefense posture”. Indeed, the future of biodetection requires us to begin developing novel analytics that can identify anomalies and/or characteristics that indicate a potential threat, whether known or unknown, without looking for a specific signature that has been identified previously. To assess potential threats more rapidly, it is critical to develop agnostic artificial intelligence (AI)/machine learning (ML) systems that can be employed for real-time assessment of the nature and source of a perturbation. Such systems should be multi scale and multi-dimensional, integrating sensor data from a range of biological, chemical, and physical application spaces. Emerging deep learning (DL) models demonstrate exceptional promise for identification of discriminatory features within multi-dimensional datasets. DL models have the capacity to recognize and encode highly complex patterns in a wide range of input data modalities, including images, text, and biological/chemical/physical spectra. As such, they can execute a wide range of assessments and determinations that have traditionally required a human operator. The promise of advances in DL is apparent in the realm of human health and medicine. DL models have been validated for evaluating a variety of clinical threats to human health in a range of contexts, including infection and cancer, and they demonstrated improved performance in predicting stroke relative to human neurologists in some categories of data. Continuously evolving advances in AI/ML are expected to support more efficient evaluation of raw sequence, spectroscopy, and spectrometry data. For instance, recent advances and deployment of large language models (LLM) such as Generative Pre training Transformer (GPT) and Bidirectional Encoder Representations from Transformers (BERT) have already motivated application of these models for biological function prediction. As frameworks such as LLMs become larger and more complex in their representations, their capacity to serve as pre-trained models that can be fine-tuned for biological/biodetection purposes will similarly be amplified. While existing and emerging AI/ML have found broad applicability and use cases in the clinical sciences, development for environmental evaluation and biodetection has been limited. Functionalizing such capabilities for this purpose requires an understanding of the existing technical landscape and how the respective tools and algorithms are currently being employed. This landscape awareness then allows an assessment of the current practical capabilities of existing models and the anticipated requirements and development efforts that will be needed to adapt available algorithms for biodetection applications relevant to DHS. Leveraging expertise in biodetection, ML, and operational biodetection, the effort described in this report is comprised of a systematic landscape assessment (Subtask 2.1), comparative evaluation (Subtask 2.2), and formulation of a value proposition (Subtask 2.3) for the prospect of ML-enabled, agnostic biodetection from raw, or minimally-processed, datasets.

59 BASIC BIOLOGICAL SCIENCES↗