SEARCH · Search NASA
Results for “Detection and Defense”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
AI-based Detection and Defense Against Cyberattacks in Distributed Energy Resources
This study will provide comprehensive artificial intelligence (AI)-based solution tools for network security, malware prevention, and sensor data anomaly detection for distributed energy resource (DER) research, development, and demonstration. DER technologies are energy systems (e.g., solar panels, wind turbines, and energy storage systems) that are often connected to the internet and thus vulnerable to cyberattacks. Cybersecurity should be of primary concern for DERs, which is why we propose an integrated multi-layer cyber-defense system for DERs. This system encompasses risk assessments, network security, malware prevention, and detection of anomalies in the sensor data. Implementation of a comprehensive risk assessment with an overview of the model architecture should be the primary step, and should include the potential impact of experiencing, at a given time, one or more cyberattacks on the system. The second step is to ensure that the network security includes firewalls, intrusion detection, and malware prevention. The third step is to provide solution tools that enable sensor data anomaly detection for DERs. By incorporating these considerations into DER research, development, and demonstration, organizations can help ensure the safety and security of their systems and protect against potential cyberattacks.
A critical review of cyber-physical security for building automation systems
Modern Building Automation Systems (BASs), as the brain that enable the smartness of a smart building, often require increased connectivity both among system components as well as with outside entities, such as the cloud, to enable low-cost remote management, optimized automation via outsourced cloud analytics, and increased building-grid integrations. As smart buildings move towards open communication technologies, providing access to BASs through the building's intranet, or even remotely through the Internet, has become a common practice. However, increased connectivity and accessibility come with increased cyber security threats. BASs were historically developed as closed environments with limited cyber-security considerations. As a result, BASs in many buildings are vulnerable to cyber-attacks that may cause adverse consequences, such as occupant discomfort, excessive energy usage, and unexpected equipment downtime. Therefore, there is a strong need to advance the state-of-the-art in cyber-physical security for BASs and provide practical solutions for attack mitigation in buildings. However, an inclusive and systematic review of BAS vulnerabilities, potential cyber-attacks with impact assessment, detection & defense approaches, and cyber resilient control strategies is currently lacking in the literature. This review paper fills the gap by providing a comprehensive up-to-date review of cyber-physical security for BASs at three levels in commercial buildings: management level, automation level, and field level. The general BASs vulnerabilities and protocol-specific vulnerabilities for the four dominant BAS protocols (i.e., BACnet, KNX, LonWorks, and Modbus) are reviewed, followed by a discussion on four attack targets and seven potential attack scenarios. Furthermore, the impact of cyber-attacks on BASs is summarized as signal corruption, signal delaying, and signal blocking. The typical cyber-attack detection and defense approaches are identified at the three levels. Cyber resilient control strategies for BASs under attack are categorized into passive and active resilient control schemes. Open challenges and future opportunities are finally discussed.
Production of Cf-252 and other transplutonium isotopes at Oak Ridge National Laboratory
In 1957 Glenn T. Seaborg conceived and advocated for the construction of the High Flux Isotope Reactor (HFIR) and the Transuranium Processing Plant (since then renamed the Radiochemical Engineering Development Center, or REDC) at Oak Ridge National Laboratory. There, heavily shielded hot cells, glove boxes, and laboratories allow recovery of transuranium elements produced in substantial quantities. Seaborg’s vision of HFIR and REDC producing milligram quantities of berkelium, californium, and einsteinium has been fulfilled beginning in 1966 through May 2019 with 78 production campaigns yielding a cumulative totals of 1.2 g of 249 Bk, 10.2 g of 252 Cf, 39 mg of 253 Es, and 15 pg of 257 Fm. Notably, 252 Cf is a neutron source used in many industrial applications including oil exploration; process control systems for the cement industry, coal analysis, and power production; sources to start nuclear reactors and perform nondestructive materials analyses; homeland security and national defense detection devices; and medical research. Isotopes made available through transplutonium production at HFIR/REDC have enabled scientists to study the nuclear properties and reactions, chemical properties, optical properties, and solid-state properties of transplutonium elements. Long-lived isotopes have served as targets in heavy ion accelerators to produce heavier elements leading to the discovery of 104 Rf, 105 Db, 106 Sg, 113 Nh, 114 Fl, 115 Mc, 116 Lv, 117 Ts, and 118 Og. This paper reviews the evolution of the processing flowsheets to produce, separate, and purify transplutonium isotopes, which have evolved over 50 years of operation at HFIR and REDC, and summarizes directions of future work to improve the efficiency of the production operations.
Data Security Defense: Modeling and Detection of Synchrophasor Data Spoofing Attack for Grid Edge
Data security and cyberattack have become critical issues in the distributed power system where adversaries can swap the source information of sensors or even spoof and alter measurements. However, the cyber security of the power system is challenged by the unpredictability and stealth of the spoofing attacks. Here, to protect the data security at the grid edge, this paper developed a synchrophasor data spoofing attack detection framework based on the time-frequency feature extraction techniques including the short-time Fourier transform (STFT) and object detection network for real-time synchrophasor data categorization and spoofing attack localization. The proposed approach outperforms earlier work in terms of spoofing attack detection and offers a vital localization function employing distributed synchrophasor sensors.
Detection and evaluation of defenses in small animals to simulated spacecraft environments Final report, 1 Sep. 1968 - 31 Aug. 1969
Evidence for maintenance or breakdown of natural or acquired resistance of guinea pigs in simulated spacecraft environment
Machine Learning Based Resilience Testing of an Address Randomization Cyber Defense
Moving target defenses (MTDs) are widely used as an active defense strategy for thwarting cyberattacks on cyber-physical systems by increasing diversity of software and network paths. Recently, machine Learning (ML) and deep Learning (DL) models have been demonstrated to defeat some of the cyber defenses by learning attack detection patterns and defense strategies. It raises concerns about the susceptibility of MTD to ML and DL methods. Here, in this article, we analyze the effectiveness of ML and DL models when it comes to deciphering MTD methods and ultimately evade MTD-based protections in real-time systems. Specifically, we consider a MTD algorithm that periodically randomizes address assignments within the MIL-STD-1553 protocol—a military standard serial data bus. Two ML and DL-based tasks are performed on MIL-STD-1553 protocol to measure the effectiveness of the learning models in deciphering the MTD algorithm: 1) determining whether there is an address assignments change i.e., whether the given system employs a MTD protocol and if it does 2) predicting the future address assignments. The supervised learning models (random forest and k-nearest neighbors) effectively detected the address assignment changes and classified whether the given system is equipped with a specified MTD protocol. On the other hand, the unsupervised learning model (K-means) was significantly less effective. The DL model (long short-term memory) was able to predict the future addresses with varied effectiveness based on MTD algorithm's settings.
Life strategies for Aminicenantia in subseafloor oceanic crust
Abstract After decades studying the microbial “deep biosphere” in subseafloor oceanic crust, the growth and life strategies in this anoxic, low energy habitat remain poorly described. Using both single cell genomics and metagenomics, we reveal the life strategies of two distinct lineages of uncultivated Aminicenantia bacteria from the basaltic subseafloor oceanic crust of the eastern flank of the Juan de Fuca Ridge. Both lineages appear adapted to scavenge organic carbon, as each have genetic potential to catabolize amino acids and fatty acids, aligning with previous Aminicenantia reports. Given the organic carbon limitation in this habitat, seawater recharge and necromass may be important carbon sources for heterotrophic microorganisms inhabiting the ocean crust. Both lineages generate ATP via several mechanisms including substrate-level phosphorylation, anaerobic respiration, and electron bifurcation driving an Rnf ion translocation membrane complex. Genomic comparisons suggest these Aminicenantia transfer electrons extracellularly, perhaps to iron or sulfur oxides consistent with mineralogy of this site. One lineage, called JdFR-78, has small genomes that are basal to the Aminicenantia class and potentially use “primordial” siroheme biosynthetic intermediates for heme synthesis, suggesting this lineage retain characteristics of early evolved life. Lineage JdFR-78 contains CRISPR-Cas defenses to evade viruses, while other lineages contain prophage that may help prevent super-infection or no detectable viral defenses. Overall, genomic evidence points to Aminicenantia being well adapted to oceanic crust environments by taking advantage of simple organic molecules and extracellular electron transport.
Gene drive by Fusarium SKC1 is dependent on its competing allele
The Fusarium verticillioides SKC1 gene driver is transmitted to offspring in a biased manner through spore killing. The mechanism that allows SKC1 to kill non-SKC1 offspring while sparing others is poorly understood. Here we report that gene drive by SKC1 is dependent on SKC1's competing allele. We propose that SKC1's competing allele influences the ability of a genome defense process to detect SKC1, and we provide evidence that this genome defense process is meiotic silencing by unpaired DNA (MSUD). Furthermore, our findings suggest that the successful deployment of gene drivers to control pathogenic fungi will require researchers to consider how competing alleles influence the ability of gene drivers to be detected by genome defense processes.
Cusp and LLBL as Sources of the Isolated Dayside Auroral Feature During Northward IMF
An intense dayside proton aurora was observed by Imager for Magnetopause-to- Aurora Global Exploration Far Ultra-Violet imager (IMAGE FUV) for an extensive period of northward interplanetary magnetic field (IMF) on 17 and 18 September 2000. This aurora partially coincided with the auroral oval and intruded farther poleward into the polar cap, and it showed longitudinal motions in response to IMF By variation. Intense magnetosheath-like electron and ion precipitations have been simultaneously detected by Defense Meteorological Satellite Program (DMSP) above the poleward portion of the high-latitude dayside aurora. They resemble the typical plasmas observed in the low-altitude cusp. However, less intense electrons and more energetic ions were detected over the equatonvard part of the aurora. These plasmas are closer to the low-latitude boundary layer (LLBL) plasmas. Under strongly northward IMF, global ionospheric convection derived from Super Dual Auroral Radar Network (SuperDARN) radar measurements showed a four-cell pattern with sunward convection in the middle of the dayside polar cap and the dayside aurora corresponded to two different convection cells. This result further supports two source regions for the aurora. The cusp proton aurora is on open magnetic field lines convecting sunward whereas the LLBL proton aurora is on closed field lines convecting antisunward. These IMAGE, DMSP, and SuperDARN observations reveal the structure and dynamics of the aurora and provide strong evidence for magnetic merging occurring at the high-latitude magnetopause poleward from the cusp. This merging process was very likely quasi-stationary.
Inferring adversarial behaviour in cyber‐physical power systems using a Bayesian attack graph approach
Abstract Highly connected smart power systems are subject to increasing vulnerabilities and adversarial threats. Defenders need to proactively identify and defend new high‐risk access paths of cyber intruders that target grid resilience. However, cyber‐physical risk analysis and defense in power systems often requires making assumptions on adversary behaviour, and these assumptions can be wrong. Thus, this work examines the problem of inferring adversary behaviour in power systems to improve risk‐based defense and detection. To achieve this, a Bayesian approach for inference of the Cyber‐Adversarial Power System (Bayes‐CAPS) is proposed that uses Bayesian networks (BNs) to define and solve the inference problem of adversarial movement in the grid infrastructure towards targets of physical impact. Specifically, BNs are used to compute conditional probabilities to queries, such as the probability of observing an event given a set of alerts. Bayes‐CAPS builds initial Bayesian attack graphs for realistic power system cyber‐physical models. These models are adaptable using collected data from the system under study. Then, Bayes‐CAPS computes the posterior probabilities of the occurrence of a security breach event in power systems. Experiments are conducted that evaluate algorithms based on time complexity, accuracy and impact of evidence for different scales and densities of network. The performance is evaluated and compared for five realistic cyber‐physical power system models of increasing size and complexities ranging from 8 to 300 substations based on computation and accuracy impacts.
From enhanced detection to automation: enhancing cybersecurity defense with Google SecOps SIEM and SOAR
Explore the source record for details and available documents.
Modular Architecture for the Measurement of Space Radiation
A modular architecture has been conceived for the design of radiation-monitoring instruments used aboard spacecraft and in planetary-exploration settings. This architecture reflects lessons learned from experience with prior radiation-monitoring instruments. A prototype instrument that embodies the architecture has been developed as part of the Mars Advanced Radiation Acquisition (MARA) project. The architecture is also applicable on Earth for radiation-monitoring instruments in research of energetic electrically charged particles and instruments monitoring radiation for purposes of safety, military defense, and detection of hidden nuclear devices and materials.
Generating SBoMs Utilizing Structured Threat Information Expression JSON bundles
With cyber-attacks on the rise, information is one of the first lines of defense. Now more than ever, security experts and developers need efficient ways to know if their software may be outdated or vulnerable to emerging threats. By generating a Software Bill of Material based on STIX2/JSON bundles, security experts and developers can ensure that they know where to find what can go wrong with their systems before the hackers do. As part of the Infrastructure Expression project, Idaho National Laboratory (INL) is currently working on ways that can aid in the development of efficient SBOMs using Structured Threat Information Expression (STIX). Doing so can provide an efficient first line of defense for detection and monitoring that can be easily used by cyber personnel from beginners to highly skilled experts.
MimicGAN: Robust Projection onto Image Manifolds with Corruption Mimicking
In the past few years, Generative Adversarial Networks (GANs) have dramatically advanced our ability to represent and parameterize high-dimensional, non-linear image manifolds. As a result, they have been widely adopted across a variety of applications, ranging from challenging inverse problems like image completion, to problems such as anomaly detection and adversarial defense. A recurring theme in many of these applications is the notion of projecting an image observation onto the manifold that is inferred by the generator. In this context, Projected Gradient Descent (PGD) has been the most popular approach, which essentially optimizes for a latent vector that minimizes the discrepancy between a generated image and the given observation. However, PGD is a brittle optimization technique that fails to identify the right projection (or latent vector) when the observation is corrupted, or perturbed even by a small amount. Such corruptions are common in the real world, for example images in the wild come with unknown crops, rotations, missing pixels, or other kinds of non-linear distributional shifts which break current encoding methods, rendering downstream applications unusable. To address this, we propose corruption mimicking—a new robust projection technique, that utilizes a surrogate network to approximate the unknown corruption directly at test time, without the need for additional supervision or data augmentation. The proposed method is significantly more robust than PGD and other competing methods under a wide variety of corruptions, thereby enabling a more effective use of GANs in real-world applications. Finally, more importantly, we show that our approach produces state-of-the-art performance in several GAN-based applications—anomaly detection, domain adaptation, and adversarial defense, that benefit from an accurate projection.
Optimal D-FACTS Placement in Moving Target Defense Against False Data Injection Attacks
Moving target defense (MTD) is a defense strategy to detect stealthy false data injection (FDI) attacks against the power system state estimation using distributed flexible AC transmission system (D-FACTS) devices. However, existing studies neglect to address a fundamental yet critical issue, i.e., the D-FACTS placement, by assuming that all lines are equipped with D-FACTS devices. Here, to tackle this problem, we first derive analytical necessary conditions and requirements on the D-FACTS placement for a complete MTD. Further, we propose sufficient conditions using a graph theory-based topology analysis to ensure that the MTD under the proposed D-FACTS placement has the maximum rank of its composite matrix, which is indicative of the MTD effectiveness. Based on the analytical conditions, we design D-FACTS placement algorithms by using the minimum number of D-FACTS devices to achieve the maximum MTD effectiveness. A novel MTD-based ACOPF model, in which the reactance of D-FACTS lines is introduced as decision variables, is proposed to find a trade-off between the system loss and the MTD effectiveness. Numerical results on 6-bus, IEEE 14-bus, and IEEE 118-bus systems show the efficacy of MTDs using the proposed D-FACTS placement algorithms in maximizing the composite matrix rank and detecting FDI attacks.
Voltage Stability Constrained Moving Target Defense Against Net Load Redistribution Attacks
Moving target defense (MTD) using distributed flexible AC transmission system (D-FACTS) devices is a promising defense strategy to detect stealthy false data injection (FDI) attacks against the power system state estimation. However, all existing studies myopically perturb the reactance of D-FACTS lines without considering the system voltage stability. In this paper, we first illustrate voltage instability induced by MTDs in a three-bus system. To address this issue, we further propose a novel MTD framework that explicitly considers system voltage stability by using continuation power flow and voltage stability indices. We mathematically derive the sensitivity matrix of voltage stability index to line impedance, on which an optimization problem for maximizing voltage stability index is formulated. This framework is tested on the IEEE 14-bus and the IEEE 118-bus transmission systems, in which net load redistribution attacks are launched by sophisticated attackers. Here, the simulation results show the effectiveness of the proposed framework in circumventing the voltage instability while maintaining the detection effectiveness of MTD. We conduct case studies with and without the proposed framework under different MTD planning and operational methods. The impacts of the proposed two methods on attack detection effectiveness and system economic metrics are also revealed.
Building Intelligence with Layered Defense Using Security-Constrained Optimization and Security Risk Detection (BUILD-SOS): A Probabilistic Approach
In this project, we employ a layered protection strategy incorporating advanced optimization and detection techniques using a probabilistic approach. The probabilistic approach is not only applied when detecting cyber attacks, but also incorporated in control strategies, which greatly increases the attacking difficulties. Hackers need to understand both probabilistic detection algorithms and uncertainty modeling methods in control in order to execute any effective attacks. The end-to-end solutions enable us to provide Building Intelligence with Layered Defense using Security-Constrained Optimization and Security Risk Detection (BUILD-SOS).