Search NASA⌕ Search

SEARCH · Search NASA

Results for “industrial control system”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 145 records · Page 8
All sourcesNASA NTRSDOE OSTI
DOE OSTI2026

Embedded EPICS server for PowerPMAC motion controllers

An embedded server layer of Experimental Physics and Industrial Control System (EPICS) for PowerPMAC motion controllers has been developed and deployed at two undulator beamlines of the National Institute of General Medical Sciences and the National Cancer Institute (GM/CA) Structural Biology Facility at the Advanced Photon Source (APS). This compact, open source solution makes the power and versatility of PowerPMAC motion controls directly accessible to distributed EPICS clients. At GM/CA the system controls about 200 servo and stepper motors — both encoded and unencoded — and multiple digital and analog I/O accessories. The server stack comprises two sublayers: a lower-level driver and database that communicates directly with PowerPMAC, and a facility-specific soft sublayer built on top. The paper describes installing EPICS on PowerPMAC, the implementation of both layers and client examples, including on-the-fly scanning.

EPICS↗
DOE OSTI2026

EPICS for small-scale laboratories with Python soft IOCs

While the Experimental Physics and Industrial Control System (EPICS) is widely used at large laboratories for slow controls and instrumentation, the deployment of a full EPICS installation can be difficult, with a steep learning curve to new users. Taking advantage of the pythonSoftIOC module, we developed an EPICS slow controls implementation for Jefferson Lab's Hall B cryotarget written entirely in Python and based on software IOCs that communicate with instruments over Ethernet. Here, this system ran successfully, interfacing with Jefferson Lab's full EPICS network, and we offer it as an example of the capabilities of pythonSoftIOC to build lightweight, yet robust and flexible instrumentation platforms that would be easily adapted for use at a small-scale laboratory. University groups can use these examples to build complete slow controls systems, from device communication to data archiving and display, using open-source, mature EPICS tools and student-friendly Python as an alternative to expensive and proprietary systems such as LabVIEW.

Computing↗
DOE OSTI2026

Feature Engineering and Ensemble Methods for Imbalanced ICS Intrusion Detection: Pipeline Audit and Constrained Evaluation

Industries are becoming increasingly connected and are more vulnerable to cyberattacks due to the widened attack surface. Industrial Control Systems (ICS) are among the most critical sectors that malicious actors can target, as such attacks can cause significant operational disruption and physical damage. It is imperative to detect such attacks as early as possible. This paper evaluates constraint-conditioned optimistic performance estimates for traditional ML models in ICS intrusion detection (i.e., estimates obtained under contiguous, non-shuffled temporal evaluation without test-set alteration, but with pre-split feature engineering that may introduce temporal leakage, due to dataset constraints). Our findings are threefold. First, we quantify how iterative feature engineering affects tree-based ensemble performance and examine how pipeline decisions (split strategy, sampling scope, and cleaning policy) can inflate or reduce reported IDS results under constraint-bound evaluation. Second, we compare intrinsic class-imbalance handling across ensemble models. Third, under our current pipeline constraints (including pre-split feature engineering), CatBoost achieves the best performance on Water Storage Tank (accuracy: 0.9831, class-1 F1: 0.9682), while Light- GBM achieves the best performance on Gas Pipeline (accuracy: 0.9618, class-1 F1: 0.9086).

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2026

The Impact of Time-Aware Design Choices in ICS Anomaly Detection

Industrial control systems (ICS) remain vulnerable to increasingly sophisticated cyberattacks, yet evaluating anomaly detection models in these environments is challenging due to temporal dependencies, missing-not-at-random patterns, and extremely imbalanced datasets. These factors make common practices—especially random data splits and na¨ıve imputation— prone to severe temporal leakage, which can inflate reported performance and obscure real-world limitations. In this work, we systematically examine classical machine learning models, temporal deep learning architecture, and tensordecomposition– based methods on a gas-pipeline dataset using a fully temporally separated evaluation pipeline designed to mimic realistic deployment conditions. Our findings show that proper temporal handling and MNAR-aware preprocessing significantly alter the relative performance of popular anomaly-detection methods, providing practical guidance for designing reliable, leakage-resistant ICS intrusion-detection systems.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2019

Development of a Host-Based Intrusion Detection and Control Device for Industrial Field Control Devices

Industrial control systems contain a multitude of devices deployed into the field to observe and control a physical process. Currently, most of these devices lack common host-based cybersecurity features, which can lead them to be seen as vulnerable targets. The Cymbiote device was developed to address this problem by examining multiple streams of data to determine what might indicate a potential threat, and to evaluate and execute appropriate response actions. This paper discusses the evolution of the Cymbiote device in response to evaluation and testing done on real-world hardware. Experimental results are discussed, as are the new developments that have been made to the device in response to the findings. In addition, we describe future research directions for this approach along with the experimental setup changes in response to the requirements for statistical rigor.

Rice, Theora R.↗
DOE OSTI2025

Self-Supervised and Interpretable Anomaly Detection Using Network Transformers

Machine learning and deep neural networks (DNNs) have been proposed as a tool to identify anomalies in computer network communications. However, due the obfuscated nature of off-the-shelf machine learning models, their output often does not provide enough information to isolate the source of the anomaly to take corrective measures. In this article, we introduce the network transformer (NeT), a DNN model for anomaly detection that incorporates the graph structure of the communication network in order to improve interpretability. Further, the presented approach has the following advantages: first, enhanced interpretability by incorporating the graph structure of computer networks; second, provides a hierarchical set of features that enables analysis at different levels of granularity; second, self-supervised training that does not require labeled data. The NeT model was evaluated on a set of anomalous scenarios executed in a real industrial control system. The presented approach successfully identified the anomalies, the devices affected, and the specific connections causing the anomalies, providing a data-driven hierarchical approach to analyze the behavior of a cyber network.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2022

Detecting Hardware Trojans in PCBs Using Side Channel Loopbacks

Malicious modifications to printed circuit boards (PCBs) are known as hardware Trojans. These may arise when malafide third parties alter PCBs premanufacturing or postmanufacturing and are a concern in safety-critical applications, such as industrial control systems. In this research, we examine how data-driven detection can be utilized to detect such Trojans at run-time. We develop a flexible and reconfigurable PCB test bed derived from the popular open-source programmable logic controller (PLC) platform “OpenPLC.” We then develop a Trojan detection framework, which utilizes and analyzes multimodal side channels (e.g., timing, magnetic signals, power, and hardware performance counters). We consider defender-configurable input/output (I/O) loopback test, comparison with design-document baselines, and magnetometer-aided monitoring of system behavior under defender-chosen excitations. Our approach can extend to golden-free environments. Golden (known-good) versions of the PCBs are assumed not available, but design information, datasheets, and component-level data are available. We demonstrate the efficacy of our approach on a range of Trojans instantiated in the test bed.

42 ENGINEERING↗
DOE OSTI2026

MARIAH PCAP data for Validation Demonstration

This dataset holds simulated PCAP (packet capture) data from the SCEPTRE validation demonstration model as a set of pairwise communications between devices via specific protocols. All connections should be assumed to be symmetric, as this data is an aggregation of the true PCAP. A mapping is also provided associating each IP address with its true device type.

cyber-physical system↗
DOE OSTI2021

ManiPIO - Manipulate Process I/O

SAND2021-15053 O ManiPIO is a Python-based tool used to test Programmable Logic Controllers (PLCs), Industrial Control Systems (ICS), and ICS networks. It reads an input script to construct complex Events on ICS networks and uses the ModBus communication standard to communicate. Users can use ManiPIO to construct complex timelines of ICS communication events to simulate any number of network-based scenarios. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.

Hahn, Andrew↗
DOE OSTI2024

Cytrics Repository Of Analysis Tools And Engineering Resources

Cybersecurity Testing for Resilient Industrial Control Systems (CyTRICS) is a DOE-funded project that works with vendors to evaluate the cybersecurity of equipment used in US critical infrastructure. In the process of testing systems, CyTRICS researchers often develop custom tools. The tools in this repository were developed during multiple CyTRICS tests to assist with the testing process. They help solve problems encountered by CyTRICS researchers and address uncommon testing subjects for which limited tooling is available. They are useful to other researchers working on similar systems and architectures.

Laird, SutterE↗
DOE OSTI2025

AdCyDER Attack Simulator

SF-25-117 A framework for simulating various cyber attacks on industrial control systems and SCADA environments.

Blakely, Benjamin↗
DOE OSTI2026

Cyote-attack Chain Estimator

Attack Chain Estimator (ACE) Application Overview The Attack Chain Estimator (ACE) Application is a sophisticated tool designed for the ingestion, classification, sequencing, and enrichment of cybersecurity threat reports. This application leverages advanced machine learning models and extensive historical data to provide comprehensive insights into cyber threats, specifically targeting Industrial Control Systems (ICS). Purpose The primary functions of the ACE Application include: Ingestion of Cybersecurity Threat Reporting: Capable of ingesting text-based threat reports in markdown or text file format. Supports ingestion of structured data from other sources in STIX/JSON format. Classification of Report’s Text-Based Events: Utilizes a DeBERTa classifier, specifically trained on cybersecurity data, to map the events to MITRE ATT&CK for ICS Tactics and Techniques. Classification is performed using multiple Jupyter notebooks and machine learning workflows hosted as FastAPI microservices: regex_data deberta_base_35_train_hft_classifier_mlflow.ipynb hft_regex_classifier_mlflow.ipynb param_train_hft_classifier_mlflow.ipynb regex_tactic_tech.ipynb Ordering of Tactics, Techniques, and Observable Events: Sequences the identified tactics, techniques, and events to form a coherent attack chain. Enrichment with Historical Attack Chain Details: Enhances the attack chain with details from historical attacks using a Markov model developed from CyOTE Precursor Analysis Report data. The Markov model is available as a FastAPI endpoint for seamless integration. Enrichment with Adversary Emulation Capabilities Data: Integrates adversary emulation capabilities data using MITRE Caldera for OT adversary abilities UUIDs. Export of Output Files: Provides options to export the enriched attack chain in JSON or CSV formats. Routing of Output to Other Applications: Facilitates routing of output to various platforms and applications, including: Threat Intelligence Platforms COREII Scout for Threat Intelligence Analysis COREII Modeling and Simulation for Adversary Emulation Technical Description The ACE Application is an advanced cybersecurity tool designed to provide detailed threat analysis and sequence generation. It is built on a robust architecture that integrates natural language processing, machine learning, and historical data modeling. Key Components: Data Ingestion Module: Handles the input of threat reports and data from various formats, ensuring flexibility in data sources. Classification Engine: Employs DeBERTa-based classifiers hosted as FastAPI microservices to analyze and classify threat report events in accordance with the MITRE ATT&CK framework for ICS. Sequence Generator: Orders the classified events into a logical attack chain, providing clear insight into the sequence of tactics and techniques used in the threat. Enrichment Engine: Integrates historical data and adversary emulation capabilities to enhance the attack chain with valuable context and additional details. The historical data enrichment is powered by a Markov model, which is available as a FastAPI endpoint. Export and Routing Module: Facilitates the export of the enriched attack chain in multiple formats and routes the output to designated applications for further analysis or emulation.

Paul, Tony [Idaho National Laboratory (INL), Idaho↗
DOE OSTI2020

Digital Biosecurity Pilot Project

Security models for the bioeconomy have largely been developed on risk profiles borrowed from the financial industry and, in some cases, industrial control systems. The bioeconomy, however, has unique characteristics that require domain-specific knowledge of the risks to environmental, health and economic impact from directly targeted attacks. Key questions need to be assessed and answered for any facility engaged in bioproduction. These include: how much technical information must the attacker possess in order to target a specific process or facility? Which processes cause the largest economic impact if disrupted? Can an attacker lead companies down the wrong path of research, leading to irrecoverable losses of time, resources and capital? Can attackers disrupt venture capital strategies and affect financial returns? What are the resources required to attack key workflows, and subsequently what is the cost of defense? What strategies are effective against such attackers, and what are their cost? Can government provide an active role in assurance of material, process and results for critical bioeconomic infrastructure?

59 BASIC BIOLOGICAL SCIENCES↗
DOE OSTI2023

Toward a Resilient Cybersecure Hydropower Fleet: Cybersecurity Landscape and Roadmap 2021

With this roadmap, Pacific Northwest National Laboratory (PNNL) hopes to assist the U.S. Department of Energy’s (DOE’s) Water Power Technologies Office (WPTO) in improving the cybersecurity of hydropower plants across the nation. This effort draws upon collected data from the dams sector, from industrial control system cybersecurity threat reports, from similar work focused on neighboring sectors, and from frank discussions with owners, operators, and vendors. While remaining tightly focused on the needs of hydropower projects, during this landscape study and development of the resulting roadmap, the research team sought to remain informed by the larger energy sector’s vision and direction so that the topics and milestones may fit within a larger vision common to the whole.

13 HYDRO ENERGY↗
DOE OSTI2021

Neighborhood Keeper

Neighborhood Keeper is a collective defense and community-wide visibility solution that provides a more effective industrial cyber defense by sharing threat intelligence at machine-speed across industries and geographic regions.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2023

Cyber-CHAMP White Paper

Cyber-CHAMP white paper intern school assignment. Worldwide there is a tremendous shortfall in the cybersecurity workforce. By 2021, researchers have forecasted a deficit of 3.5 million cyber professionals. As workforce capabilities diminished, the world's cybersecurity threats have continued to multiply. Industrial control systems (ICSs) and their operational technology (OT) components became more vulnerable to attack and compromise. When an ICS is compromised, attackers can cause widespread impacts on national security, public health, and safety. This capacity makes ICSs attractive targets, with 90% of surveyed OT organizations reporting a damaging cyberattack in the last two years. To address the risk to ICSs, personnel must be competent in operational best practices and the latest threats. While frameworks for information technology (IT) cybersecurity education have been developed, educational standards for OT cybersecurity are nonexistent.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Virtualizing Industrial Control Networks for Cyber Resilience Experiments

Industrial control systems (ICS) networks are undergoing constant shifts to accommodate new security measures. It is challenging to test varying network configurations and security tools with physical systems as they typically include large, expensive equipment. Not only this, but researchers often do not have access to this type of equipment for development of new security tools and techniques. As a solution to these issues, this work presents a set of tools for utilizing GNS3 and Docker as a virtual ICS network. Additionally, the virtual network can be attached to physical devices including network switches, hardware simulations, and intelligent electronic devices (IEDs). Two case studies showcase a relatively complex automatically generated network and an attack on a simple ICS network with an example mitigation.

42 ENGINEERING↗
DOE OSTI2025

5G integrated edge computing platform for efficient component monitoring in coal-fired power plants

This project developed a cutting-edge 5G-integrated edge computing framework to enhance operational efficiency and reliability in coal-fired power plants through real-time component monitoring and anomaly detection. The initiative focused on leveraging distributed machine learning, federated learning, and 5G-based dynamic network slicing to support scalable, fault-tolerant monitoring environments to meet the operational requirements in industrial control systems. With a Distributed Edge Computing Service (DECS) orchestration, this project enabled federated learning at edge for condition monitoring and introduced adaptive client selection strategies to minimize communication overhead. Scalable distributed training was achieved using the Horovod framework, thus enhancing performance across edge nodes. In the realm of 5G networking, the project designed and deployed reconfigurable, QoS-aware network slicing tailored for operational technology (OT) environments, integrating software-defined networks to bolster cyber-resilience and enabling dynamic slicing for federated learning workloads. A significant milestone was the development of a virtualized ICS environment with 5G core integration—which allowed elastic and fault tolerant distributed training on real-world datasets such as NASA Bearings, Hydraulic Systems, and TEP. To broaden the impact of the project, a TRL-3 virtualized ICS testbed for research and education was designed. This project engaged several graduate and undergraduate students to conduct research on the cutting-edge technology, and it resulted in one PhD dissertation, one MS thesis, and over 14 peer-reviewed publications. With the support of this project students also participated in national cybersecurity competitions to improve their professional development skills.

20 FOSSIL-FUELED POWER PLANTS↗