SEARCH · Search NASA
Results for “Detection and Defense”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
AI-based Detection and Defense Against Cyberattacks in Distributed Energy Resources
This study will provide comprehensive artificial intelligence (AI)-based solution tools for network security, malware prevention, and sensor data anomaly detection for distributed energy resource (DER) research, development, and demonstration. DER technologies are energy systems (e.g., solar panels, wind turbines, and energy storage systems) that are often connected to the internet and thus vulnerable to cyberattacks. Cybersecurity should be of primary concern for DERs, which is why we propose an integrated multi-layer cyber-defense system for DERs. This system encompasses risk assessments, network security, malware prevention, and detection of anomalies in the sensor data. Implementation of a comprehensive risk assessment with an overview of the model architecture should be the primary step, and should include the potential impact of experiencing, at a given time, one or more cyberattacks on the system. The second step is to ensure that the network security includes firewalls, intrusion detection, and malware prevention. The third step is to provide solution tools that enable sensor data anomaly detection for DERs. By incorporating these considerations into DER research, development, and demonstration, organizations can help ensure the safety and security of their systems and protect against potential cyberattacks.
A critical review of cyber-physical security for building automation systems
Modern Building Automation Systems (BASs), as the brain that enable the smartness of a smart building, often require increased connectivity both among system components as well as with outside entities, such as the cloud, to enable low-cost remote management, optimized automation via outsourced cloud analytics, and increased building-grid integrations. As smart buildings move towards open communication technologies, providing access to BASs through the building's intranet, or even remotely through the Internet, has become a common practice. However, increased connectivity and accessibility come with increased cyber security threats. BASs were historically developed as closed environments with limited cyber-security considerations. As a result, BASs in many buildings are vulnerable to cyber-attacks that may cause adverse consequences, such as occupant discomfort, excessive energy usage, and unexpected equipment downtime. Therefore, there is a strong need to advance the state-of-the-art in cyber-physical security for BASs and provide practical solutions for attack mitigation in buildings. However, an inclusive and systematic review of BAS vulnerabilities, potential cyber-attacks with impact assessment, detection & defense approaches, and cyber resilient control strategies is currently lacking in the literature. This review paper fills the gap by providing a comprehensive up-to-date review of cyber-physical security for BASs at three levels in commercial buildings: management level, automation level, and field level. The general BASs vulnerabilities and protocol-specific vulnerabilities for the four dominant BAS protocols (i.e., BACnet, KNX, LonWorks, and Modbus) are reviewed, followed by a discussion on four attack targets and seven potential attack scenarios. Furthermore, the impact of cyber-attacks on BASs is summarized as signal corruption, signal delaying, and signal blocking. The typical cyber-attack detection and defense approaches are identified at the three levels. Cyber resilient control strategies for BASs under attack are categorized into passive and active resilient control schemes. Open challenges and future opportunities are finally discussed.
Production of Cf-252 and other transplutonium isotopes at Oak Ridge National Laboratory
In 1957 Glenn T. Seaborg conceived and advocated for the construction of the High Flux Isotope Reactor (HFIR) and the Transuranium Processing Plant (since then renamed the Radiochemical Engineering Development Center, or REDC) at Oak Ridge National Laboratory. There, heavily shielded hot cells, glove boxes, and laboratories allow recovery of transuranium elements produced in substantial quantities. Seaborg’s vision of HFIR and REDC producing milligram quantities of berkelium, californium, and einsteinium has been fulfilled beginning in 1966 through May 2019 with 78 production campaigns yielding a cumulative totals of 1.2 g of 249 Bk, 10.2 g of 252 Cf, 39 mg of 253 Es, and 15 pg of 257 Fm. Notably, 252 Cf is a neutron source used in many industrial applications including oil exploration; process control systems for the cement industry, coal analysis, and power production; sources to start nuclear reactors and perform nondestructive materials analyses; homeland security and national defense detection devices; and medical research. Isotopes made available through transplutonium production at HFIR/REDC have enabled scientists to study the nuclear properties and reactions, chemical properties, optical properties, and solid-state properties of transplutonium elements. Long-lived isotopes have served as targets in heavy ion accelerators to produce heavier elements leading to the discovery of 104 Rf, 105 Db, 106 Sg, 113 Nh, 114 Fl, 115 Mc, 116 Lv, 117 Ts, and 118 Og. This paper reviews the evolution of the processing flowsheets to produce, separate, and purify transplutonium isotopes, which have evolved over 50 years of operation at HFIR and REDC, and summarizes directions of future work to improve the efficiency of the production operations.
Data Security Defense: Modeling and Detection of Synchrophasor Data Spoofing Attack for Grid Edge
Data security and cyberattack have become critical issues in the distributed power system where adversaries can swap the source information of sensors or even spoof and alter measurements. However, the cyber security of the power system is challenged by the unpredictability and stealth of the spoofing attacks. Here, to protect the data security at the grid edge, this paper developed a synchrophasor data spoofing attack detection framework based on the time-frequency feature extraction techniques including the short-time Fourier transform (STFT) and object detection network for real-time synchrophasor data categorization and spoofing attack localization. The proposed approach outperforms earlier work in terms of spoofing attack detection and offers a vital localization function employing distributed synchrophasor sensors.
Machine Learning Based Resilience Testing of an Address Randomization Cyber Defense
Moving target defenses (MTDs) are widely used as an active defense strategy for thwarting cyberattacks on cyber-physical systems by increasing diversity of software and network paths. Recently, machine Learning (ML) and deep Learning (DL) models have been demonstrated to defeat some of the cyber defenses by learning attack detection patterns and defense strategies. It raises concerns about the susceptibility of MTD to ML and DL methods. Here, in this article, we analyze the effectiveness of ML and DL models when it comes to deciphering MTD methods and ultimately evade MTD-based protections in real-time systems. Specifically, we consider a MTD algorithm that periodically randomizes address assignments within the MIL-STD-1553 protocol—a military standard serial data bus. Two ML and DL-based tasks are performed on MIL-STD-1553 protocol to measure the effectiveness of the learning models in deciphering the MTD algorithm: 1) determining whether there is an address assignments change i.e., whether the given system employs a MTD protocol and if it does 2) predicting the future address assignments. The supervised learning models (random forest and k-nearest neighbors) effectively detected the address assignment changes and classified whether the given system is equipped with a specified MTD protocol. On the other hand, the unsupervised learning model (K-means) was significantly less effective. The DL model (long short-term memory) was able to predict the future addresses with varied effectiveness based on MTD algorithm's settings.
Life strategies for Aminicenantia in subseafloor oceanic crust
Abstract After decades studying the microbial “deep biosphere” in subseafloor oceanic crust, the growth and life strategies in this anoxic, low energy habitat remain poorly described. Using both single cell genomics and metagenomics, we reveal the life strategies of two distinct lineages of uncultivated Aminicenantia bacteria from the basaltic subseafloor oceanic crust of the eastern flank of the Juan de Fuca Ridge. Both lineages appear adapted to scavenge organic carbon, as each have genetic potential to catabolize amino acids and fatty acids, aligning with previous Aminicenantia reports. Given the organic carbon limitation in this habitat, seawater recharge and necromass may be important carbon sources for heterotrophic microorganisms inhabiting the ocean crust. Both lineages generate ATP via several mechanisms including substrate-level phosphorylation, anaerobic respiration, and electron bifurcation driving an Rnf ion translocation membrane complex. Genomic comparisons suggest these Aminicenantia transfer electrons extracellularly, perhaps to iron or sulfur oxides consistent with mineralogy of this site. One lineage, called JdFR-78, has small genomes that are basal to the Aminicenantia class and potentially use “primordial” siroheme biosynthetic intermediates for heme synthesis, suggesting this lineage retain characteristics of early evolved life. Lineage JdFR-78 contains CRISPR-Cas defenses to evade viruses, while other lineages contain prophage that may help prevent super-infection or no detectable viral defenses. Overall, genomic evidence points to Aminicenantia being well adapted to oceanic crust environments by taking advantage of simple organic molecules and extracellular electron transport.
Gene drive by Fusarium SKC1 is dependent on its competing allele
The Fusarium verticillioides SKC1 gene driver is transmitted to offspring in a biased manner through spore killing. The mechanism that allows SKC1 to kill non-SKC1 offspring while sparing others is poorly understood. Here we report that gene drive by SKC1 is dependent on SKC1's competing allele. We propose that SKC1's competing allele influences the ability of a genome defense process to detect SKC1, and we provide evidence that this genome defense process is meiotic silencing by unpaired DNA (MSUD). Furthermore, our findings suggest that the successful deployment of gene drivers to control pathogenic fungi will require researchers to consider how competing alleles influence the ability of gene drivers to be detected by genome defense processes.
Inferring adversarial behaviour in cyber‐physical power systems using a Bayesian attack graph approach
Abstract Highly connected smart power systems are subject to increasing vulnerabilities and adversarial threats. Defenders need to proactively identify and defend new high‐risk access paths of cyber intruders that target grid resilience. However, cyber‐physical risk analysis and defense in power systems often requires making assumptions on adversary behaviour, and these assumptions can be wrong. Thus, this work examines the problem of inferring adversary behaviour in power systems to improve risk‐based defense and detection. To achieve this, a Bayesian approach for inference of the Cyber‐Adversarial Power System (Bayes‐CAPS) is proposed that uses Bayesian networks (BNs) to define and solve the inference problem of adversarial movement in the grid infrastructure towards targets of physical impact. Specifically, BNs are used to compute conditional probabilities to queries, such as the probability of observing an event given a set of alerts. Bayes‐CAPS builds initial Bayesian attack graphs for realistic power system cyber‐physical models. These models are adaptable using collected data from the system under study. Then, Bayes‐CAPS computes the posterior probabilities of the occurrence of a security breach event in power systems. Experiments are conducted that evaluate algorithms based on time complexity, accuracy and impact of evidence for different scales and densities of network. The performance is evaluated and compared for five realistic cyber‐physical power system models of increasing size and complexities ranging from 8 to 300 substations based on computation and accuracy impacts.
From enhanced detection to automation: enhancing cybersecurity defense with Google SecOps SIEM and SOAR
Explore the source record for details and available documents.
Generating SBoMs Utilizing Structured Threat Information Expression JSON bundles
With cyber-attacks on the rise, information is one of the first lines of defense. Now more than ever, security experts and developers need efficient ways to know if their software may be outdated or vulnerable to emerging threats. By generating a Software Bill of Material based on STIX2/JSON bundles, security experts and developers can ensure that they know where to find what can go wrong with their systems before the hackers do. As part of the Infrastructure Expression project, Idaho National Laboratory (INL) is currently working on ways that can aid in the development of efficient SBOMs using Structured Threat Information Expression (STIX). Doing so can provide an efficient first line of defense for detection and monitoring that can be easily used by cyber personnel from beginners to highly skilled experts.
MimicGAN: Robust Projection onto Image Manifolds with Corruption Mimicking
In the past few years, Generative Adversarial Networks (GANs) have dramatically advanced our ability to represent and parameterize high-dimensional, non-linear image manifolds. As a result, they have been widely adopted across a variety of applications, ranging from challenging inverse problems like image completion, to problems such as anomaly detection and adversarial defense. A recurring theme in many of these applications is the notion of projecting an image observation onto the manifold that is inferred by the generator. In this context, Projected Gradient Descent (PGD) has been the most popular approach, which essentially optimizes for a latent vector that minimizes the discrepancy between a generated image and the given observation. However, PGD is a brittle optimization technique that fails to identify the right projection (or latent vector) when the observation is corrupted, or perturbed even by a small amount. Such corruptions are common in the real world, for example images in the wild come with unknown crops, rotations, missing pixels, or other kinds of non-linear distributional shifts which break current encoding methods, rendering downstream applications unusable. To address this, we propose corruption mimicking—a new robust projection technique, that utilizes a surrogate network to approximate the unknown corruption directly at test time, without the need for additional supervision or data augmentation. The proposed method is significantly more robust than PGD and other competing methods under a wide variety of corruptions, thereby enabling a more effective use of GANs in real-world applications. Finally, more importantly, we show that our approach produces state-of-the-art performance in several GAN-based applications—anomaly detection, domain adaptation, and adversarial defense, that benefit from an accurate projection.
Optimal D-FACTS Placement in Moving Target Defense Against False Data Injection Attacks
Moving target defense (MTD) is a defense strategy to detect stealthy false data injection (FDI) attacks against the power system state estimation using distributed flexible AC transmission system (D-FACTS) devices. However, existing studies neglect to address a fundamental yet critical issue, i.e., the D-FACTS placement, by assuming that all lines are equipped with D-FACTS devices. Here, to tackle this problem, we first derive analytical necessary conditions and requirements on the D-FACTS placement for a complete MTD. Further, we propose sufficient conditions using a graph theory-based topology analysis to ensure that the MTD under the proposed D-FACTS placement has the maximum rank of its composite matrix, which is indicative of the MTD effectiveness. Based on the analytical conditions, we design D-FACTS placement algorithms by using the minimum number of D-FACTS devices to achieve the maximum MTD effectiveness. A novel MTD-based ACOPF model, in which the reactance of D-FACTS lines is introduced as decision variables, is proposed to find a trade-off between the system loss and the MTD effectiveness. Numerical results on 6-bus, IEEE 14-bus, and IEEE 118-bus systems show the efficacy of MTDs using the proposed D-FACTS placement algorithms in maximizing the composite matrix rank and detecting FDI attacks.
Voltage Stability Constrained Moving Target Defense Against Net Load Redistribution Attacks
Moving target defense (MTD) using distributed flexible AC transmission system (D-FACTS) devices is a promising defense strategy to detect stealthy false data injection (FDI) attacks against the power system state estimation. However, all existing studies myopically perturb the reactance of D-FACTS lines without considering the system voltage stability. In this paper, we first illustrate voltage instability induced by MTDs in a three-bus system. To address this issue, we further propose a novel MTD framework that explicitly considers system voltage stability by using continuation power flow and voltage stability indices. We mathematically derive the sensitivity matrix of voltage stability index to line impedance, on which an optimization problem for maximizing voltage stability index is formulated. This framework is tested on the IEEE 14-bus and the IEEE 118-bus transmission systems, in which net load redistribution attacks are launched by sophisticated attackers. Here, the simulation results show the effectiveness of the proposed framework in circumventing the voltage instability while maintaining the detection effectiveness of MTD. We conduct case studies with and without the proposed framework under different MTD planning and operational methods. The impacts of the proposed two methods on attack detection effectiveness and system economic metrics are also revealed.
Building Intelligence with Layered Defense Using Security-Constrained Optimization and Security Risk Detection (BUILD-SOS): A Probabilistic Approach
In this project, we employ a layered protection strategy incorporating advanced optimization and detection techniques using a probabilistic approach. The probabilistic approach is not only applied when detecting cyber attacks, but also incorporated in control strategies, which greatly increases the attacking difficulties. Hackers need to understand both probabilistic detection algorithms and uncertainty modeling methods in control in order to execute any effective attacks. The end-to-end solutions enable us to provide Building Intelligence with Layered Defense using Security-Constrained Optimization and Security Risk Detection (BUILD-SOS).
Load Margin Constrained Moving Target Defense against False Data Injection Attacks
Cyber physical security of power systems with high penetration of renewable generation has attracted attention from researchers. One critical issue is that cyber-physical attacks, disguised as uncertain renewable generation, can target conventional power system state estimation (SE). Moving target defense (MTD) is a promising defense strategy to detect stealthy false data injection (FDI) attacks against SE. However, all existing studies myopically perturb the reactance of transmission lines equipped with distributed flexible AC transmission system (D-FACTS) devices without adequately considering the system voltage stability. Exacerbated by the renewable generation uncertainty, existing MTD may cause voltage instability when the power grid is under stress. To address this issue, we propose a novel MTD framework that explicitly considers system voltage stability by using continuation power flow. We utilize the sensitivity matrix of power injection to line impedance, on which an optimization problem for maximizing load margin is formulated. This framework is validated on the IEEE 14-bus system and the IEEE 118-bus system, in which net load redistribution attacks are launched by sophisticated attackers. Steady-state simulations and dynamic simulations on PSS/E show the effectiveness of the proposed framework in circumventing the voltage instability while maintaining the detection effectiveness of MTD. The impact of the proposed method on attack detection effectiveness is also revealed.
Hands-On, Heads-Up: Blending Cyber T&E with Data Science-Driven Training in Jupyter Notebooks
In an era of increasingly sophisticated threats to critical infrastructure, cybersecurity professionals must be more than just aware; they must be immersed, agile, and equipped to operate in environments where failure is not an option. Nowhere is this truer than in the nuclear sector, where cyber-physical systems, regulatory scrutiny, and insider threat potential demand a new generation of hands-on, technically fluent defenders. This paper presents a unified training approach that integrates Cybersecurity Test and Evaluation (T&E) with data science techniques using Jupyter Notebooks as the interactive lab environment. The program centers on a modular, scenario-driven curriculum designed to build not just knowledge but practical capability in the assessment and defense of radiation detection systems, firmware interfaces, and operational security postures.
Data-based and secure switched cyber–physical systems
In this work, we develop a completely model-free moving target defense framework for the detection and mitigation of sensor and/or actuator attacks in cyber–physical systems with dynamics that evolve in discrete-time. We incorporate an intrusion detection mechanism based on an approximate dynamic programming technique that learns the policies for optimal regulation and optimal tracking while simultaneously defending against actuator and sensor attacks in a model-free fashion. Switching rules are leveraged to force proactive and reactive defense mechanisms as well as, guarantee the stability of the equilibrium point. Finally, as a case study, we apply the proposed moving target defense framework to a DC–DC converter that is used in electric vehicles.