Search NASA⌕ Search

SEARCH · Search NASA

Results for “Structured Threat Intelligence Expression”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

7 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2020

"Russians in the Grid" Enrichment Process

Threat intelligence sources are numerous, and the quality of their intelligence is equally variable. The need for quality, actionable, and shareable intelligence is becoming increasingly important as cyber-threats continue to increase. In this paper, we describe the process we used to enrich U.S. CERT’s Technical Alert entitled “Russian Government Cyber-Activity Targeting Energy and Other Critical Infrastructure Sectors,” affectionately referred to as “Russians In the Grid,” from a series of separate but related reports to a final, actionable, unified Structured Threat Information Expression (STIX) v2 representation of the report. In the process, we detail the tools and procedures we used, some of which are automated and others highly manual. We identify some of the limitations of current STIX enrichment tools and techniques, and propose enhancements to allow for more effective enrichment and better overall threat intelligence to be used for more effective threat data-sharing, as well as machine learning-based predictive threat work being conducted at Idaho National Laboratory.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2026

Automated Generation of Graph-based Cyber Threat Intel

With the advancement of AI technology and tools, specifically in the cybersecurity domain, both cyber defenders and threat actors are continuously adapting the use of these capabilities to expedite their operations. With this phenomenon, threat intelligence that is up to date, refreshable, and has relevant context to a specific threat becomes more and more important as it enables cybersecurity professionals to gain insight into relevant data and relationships to guide their operations. This project enables users to frequently aggregate threat intelligence from various sources, such as vendor vulnerability advisories affecting critical infrastructure, malware reports, and adversary writeups into a centralized, standardized database. The project utilizes the Structured Threat Intelligence eXpression (STIX) for a standardized, shareable threat intelligence data format and Neo4j as a graph database solution to store STIX nodes and relationships. Initial results of the project include datasets of over 8,000 nodes and 20,000 relationships extracted from over 500 data sources that have been released within the past month.

Threat Intelligence↗
DOE OSTI2022

Using Structured Intelligence Graph (STIG) to protect our critical infrastructure against cyber attacks [Poster]

STIG is a revolutionary cybersecurity tool developed by researchers at the U. S. Department of Energy's Idaho National Laboratory and it is a software that allows utility owners and operators to easily visualize, create, and edit cyberthreat intelligence information. STIG uses Structured Threat Information eXpression (STIX) and converts complex data on cybersecurity vulnerabilities into a visualization that is easy to understand and act on. With STIG, utility owners and operators have a common system for sharing threat intelligence information, thus increasing the chances of detecting and mitigating cyber exploits before they lead to a cyberattack.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2024

Zapiary: Creating Visibility in IOT Networks

Zigbee and Z-Wave are the main networking protocols used by low-power Internet of Things (IOT) devices. These protocols use low frequencies. Mesh architecture, and unique address formats that make them not compatible with traditional network traffic tools like IX-Discovery Tools. Zapiary is a software that takes CSV files with Zigbee and Z-Wave traffic and generates Structured Threat Information eXpression (STIX) JSON bundles illustrating the communication within IOT networks. The bundles can then be viewed within Structured Threat Intelligence Graph (STIG) or used with AI/ML models to provide deeper visibility into nodes that make up the network and the ability to trend the mesh network over time.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2024

A Privacy-Preserving Cyber Threat Intelligence Sharing System

Cyber Threat Intelligence (CTI) is a key resource for developing defensive strategies against potential cyber adversaries. Entities typically access CTI through open-source platforms, national agencies, or specialized commercial services. However, the bi-directional exchange of CTI is hindered by organizational trust boundaries, which complicate the sharing processes between entities and CTI providers. Centralized CTI services benefit from receiving suspicious cyber observables such as IP addresses, domain names, and email addresses from various entities. The aggregation allows for the correlation of widespread adversarial activities to enhance the alert and response mechanisms across the network of involved parties. Despite these benefits, openly sharing such observables incurs potential legal, regulatory, and reputational risks for the disclosing entities.This paper introduces a system designed to facilitate the secure exchange of cyber observables across trust boundaries without compromising the anonymity of the sharing entities. Here, we propose an architecture that leverages common web protocols alongside zero-knowledge proofs to authenticate members while maintaining anonymity. Additionally, we outline a privacy model tailored for STIX (Structured Threat Information eXpression) cyber observables to minimize the risk of inadvertently disclosing private information. Through our threat models, we assess the privacy implications of our proposed system and demonstrate its potential to enhance collaborative cyber defense efforts without exposing entities to undue risk.

BBS+ Signatures↗
DOE OSTI2025

GridSTIX

SF-25-112 Grid-STIX is a comprehensive extension of the STIX (Structured Threat Information Expression) 2.1 ontology specifically designed for electrical grid cybersecurity applications. This ontology provides a standardized, machine-readable framework for modeling grid assets, operational technology devices, threats, vulnerabilities, supply chain risks, and security relationships in electrical power systems. ## Key Features - **Comprehensive Grid Coverage**: Physical assets, OT devices, grid components, sensors, and energy storage systems - **Zero Trust Architecture**: Policy decision points, enforcement points, trust brokers, and continuous monitoring - **AMI Infrastructure**: Advanced metering networks, head-end systems, mesh gateways, and MDM systems - **Advanced Security Modeling**: Attack patterns, vulnerabilities, mitigations, and supply chain risks - **Critical Grid Relationships**: Power flow, protection, control, and synchronization relationships - **Supply Chain Security**: Supplier modeling, country of origin tracking, and risk assessment - **Protocol Support**: DNP3, Modbus, IEC 61850, IEC 60870-5-104, OPC-UA, and IEEE standards - **Python Code Generation**: Automated STIX-compliant Python class generation from ontologies - **Interactive Visualization**: Enhanced HTML network graphs with grid-specific categorization - **STIX 2.1 Compliance**: Full compatibility with STIX threat intelligence ecosystem

Blakely, Benjamin [Argonne National Laboratory (AN↗
NASA NTRS2019

Orbital Debris Ontology, Terminology, and Knowledge Modeling

The looming threat orbital debris poses to assets in orbit demands solutions. As the orbital population grows, so does this hazard, but so does the sea of data. The problem is also an opportunity for interdisciplinary innovation and cooperation. This paper focuses on the data and information management aspect of developing solutions for a sustainable and safe orbital space environment. The corresponding author’s in-progress work to develop an orbital debris domain ontology is summarized in order to discuss knowledge modeling for this domain. Methodological approaches of this effort can also contribute to standards efforts and address terminological and policy questions. Leveraging the growing volumes of orbital debris and space situational awareness (SSA) data will create a more complete picture of the orbital space environment. Part of the solution will be: consistent and correct data interpretation, sharing orbital debris and SSA data in one form or another, terminology development & harmonization, and knowledge or domain modeling. To facilitate this, [Rovetto, 2015/16] discussed ontology development for the orbital debris domain. This paper lists concepts from that paper, and subsequently developed concepts [2-9]. Ontology engineering is an interdisciplinary field related to knowledge representation and reasoning in artificial intelligence, semantic technologies and the so-called semantic web. An ontology is effectively a computable and semantically rich terminology that presents a knowledge or domain model for a topic area. Expressions of knowledge or assertions are stored using formally defined term. This knowledge base is reasoned over to yield answers to queries, among other things. Ontologies have been developed in knowledge-based projects across various disciplines, and used for such things as search engines, chatbots, enterprise knowledge graphs, etc. Ontologies support: interoperability, automated reasoning, data sharing and integration, data search and retrieval, and communicating the meaning of data. The Orbital Debris Ontology (ODO), and related ontologies [Rovetto & Kelso 2016] [Rovetto 2016, 2017], were proposed to help achieve this. ODO, for instance, is intended as a domain ontology that can be used across federated databases, offering an explicitly specified set of concepts describing the orbital debris domain. Its meaning-rich taxonomy will provide a sharable semantics for orbital debris data to, in part, consistently communicate the meaning of data to both humans and machines, and tag data elements in space object catalogs to help afford inference tasks, decision support, knowledge discovery, and information integration. ODO and the SSA ontology (SSAO) is part of the overall Orbital Space Domain Ontology concept, which is conceived as a broader domain reference ontology. It aims to provide a knowledge representation structure of the orbital space environment, a common semantic model, and develop a sharable terminology. Collectively this will provide common meaning for datasets, a high-level taxonomy or classification for orbital space objects, and thus means to characterize space objects. Ongoing efforts have included using visualizations, R, JSON-LD, and contemporary semantic technologies. Potential applications and interdisciplinary partnerships include web-based platforms, web apps, visualizations, and academia projects. Community input and participation may yield a more widely understood domain model as well as facilitate terminological standards. For example, the proposed conceptual, terminological and ontological analysis may contribute to such efforts as the Space Debris Mitigation Requirements in the International Standards Organization by developing more precise, consistent and coherent terms and definitions. Projects that seek to develop in-house ontologies can use ODO and related ontologies as domain reference ontologies. This paper was developed independent of author affiliations. Readers are encouraged to contact corresponding author(1) with general interest and potential opportunities to support or realize the described project.

Robert J. Rovetto↗