Search NASA⌕ Search

SEARCH · Search NASA

Results for “alert aggregation”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

14 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2023

Alerga: Alert Aggregation and Reasoning in GOOSE Simulation Pipeline

IEC 61850 specifies the Generic Object Oriented Substation Event (GOOSE) protocol as one option for low latency communication of substation-related events. Due to its strict timing requirements, GOOSE lacks any form of encryption or authentication and has only minimal integrity guarantees. These absences render the protocol vulnerable to a variety of communication anomalies, including adversarial action. In particular, an adversary with access to the substation network can launch man in the middle (MITM) attacks. We propose Alerga, a set of tools to allow operators to mitigate some of the risks of the protocol while retaining its strengths. To that end, we have developed first a GOOSE simulation pipeline including data generation, anomaly detection, alert handling, causal reasoning and data visualization components. The simulator is designed to be modular, allowing operators to swap components to better fit their network capabilities. The volume of alert traffic on a substation network threatens operators with alert fatigue. In order to combat this, we secondly present a novel form of alert aggregation and processing, offering operators a condensed view of any threats to the system. Thirdly, to facilitate the handling of these threats, our causal reasoning system traces the alerts back to their most likely cause, generating an initial hypothesis for operators to investigate.

alert aggregation↗
NASA NTRS2021

Perceive: Proactive Exploration of Risky Concept Emergence for Identifying Vulnerabilities & Exposures

National databases that collect various kinds of textual threat reports such as ASRS, CERT, and NVD manually process their reports individually. They then offer data products to disseminate the aggregate information, like newsletters, alerts or individual report searching. The goal of this research is to connect these individual reports thematically and temporally to identify emerging or recurring threats, by analyzing large collections of text, source code, collaboration and communication patterns. This capability, I argue, enables us to identify the emergence and recurrence of such themes, and the contexts in which they re-occur, facilitating faster and more capable mitigation. I propose two models to shed light on this goal: An empirical model of vulnerabilities as bugs, the commit flow model, and one of the vulnerabilities and aviation safety threats as topics, the topic flow model. I use as gold standard existing manual workflows in both domains, reflected in the existing data products by these organizations, and empirically evaluate if the automated model scan match or outperform existing manual practices.

ASRS↗
DOE OSTI2021

RAVIS: Resource Forecast and Ramp Visualization for Situational Awareness - An Introduction to the Open-Source Tool and Use Cases

The Resource Forecast and Ramp Visualization for Situational Awareness (RAVIS) is an open-source tool for visualizing variable renewable resource forecasts and ramp alerts for significant up/down ramps in renewable resource and the consequent net-load. The modular dashboard of RAVIS contains configurable panes for viewing- probabilistic time series forecasts, ramp event alerts on the look-ahead timeline, spatially resolved resource sites and forecasts, and system simulation and market clearing data such as transmission lines utilization, nodal prices and available generation flexibility. RAVIS uses a technology suite that is assembled to provide optimum visualization facility while maintaining a wide pool of potential deployment and client environments. The tool is designed to take advantage of web application technologies, open source visualization libraries and tooling. Utilizing this technology will enable deployment in any environment, using any operating system, and is scalable to much higher spatial and temporal scales of visualization. As a prototype of the tool and demonstrating a use case of variable renewable integration, RAVIS currently integrates site-specific solar power forecasts in the California Independent System Operator (CAISO) and Mid-continent ISO (MISO) footprint from the IBM WattSun forecasting platform, and also superimposes market simulation data for CAISO footprint from as in-house NREL market clearing tool. The tool has the ability to alert the viewer for excessive up or down ramps for both individual solar sites as well as regionally aggregated net-load ramps, and alerts can also be qualified with respect to available flexible generation. This report will provide an introduction to the RAVIS tool, and summarize the above mentioned capabilities, typical use cases and possible extensions of the tool. The RAVIS development team believes there are likely to be high economic and reliability benefits of integrating probabilistic forecasts of variable renewables into control center visualizations and improved ramp events situational awareness for system operators and forecasting teams in the ISOs and electric utilities in comparison with their business as usual practices.

96 KNOWLEDGE MANAGEMENT AND PRESERVATION↗
DOE OSTI2024

A Privacy-Preserving Cyber Threat Intelligence Sharing System

Cyber Threat Intelligence (CTI) is a key resource for developing defensive strategies against potential cyber adversaries. Entities typically access CTI through open-source platforms, national agencies, or specialized commercial services. However, the bi-directional exchange of CTI is hindered by organizational trust boundaries, which complicate the sharing processes between entities and CTI providers. Centralized CTI services benefit from receiving suspicious cyber observables such as IP addresses, domain names, and email addresses from various entities. The aggregation allows for the correlation of widespread adversarial activities to enhance the alert and response mechanisms across the network of involved parties. Despite these benefits, openly sharing such observables incurs potential legal, regulatory, and reputational risks for the disclosing entities.This paper introduces a system designed to facilitate the secure exchange of cyber observables across trust boundaries without compromising the anonymity of the sharing entities. Here, we propose an architecture that leverages common web protocols alongside zero-knowledge proofs to authenticate members while maintaining anonymity. Additionally, we outline a privacy model tailored for STIX (Structured Threat Information eXpression) cyber observables to minimize the risk of inadvertently disclosing private information. Through our threat models, we assess the privacy implications of our proposed system and demonstrate its potential to enhance collaborative cyber defense efforts without exposing entities to undue risk.

BBS+ Signatures↗
NASA NTRS2010

Evaluation of Anomaly Detection Capability for Ground-Based Pre-Launch Shuttle Operations

This chapter will provide a thorough end-to-end description of the process for evaluation of three different data-driven algorithms for anomaly detection to select the best candidate for deployment as part of a suite of IVHM (Integrated Vehicle Health Management) technologies. These algorithms were deemed to be sufficiently mature enough to be considered viable candidates for deployment in support of the maiden launch of Ares I-X, the successor to the Space Shuttle for NASA's Constellation program. Data-driven algorithms are just one of three different types being deployed. The other two types of algorithms being deployed include a "nile-based" expert system, and a "model-based" system. Within these two categories, the deployable candidates have already been selected based upon qualitative factors such as flight heritage. For the rule-based system, SHINE (Spacecraft High-speed Inference Engine) has been selected for deployment, which is a component of BEAM (Beacon-based Exception Analysis for Multimissions), a patented technology developed at NASA's JPL (Jet Propulsion Laboratory) and serves to aid in the management and identification of operational modes. For the "model-based" system, a commercially available package developed by QSI (Qualtech Systems, Inc.), TEAMS (Testability Engineering and Maintenance System) has been selected for deployment to aid in diagnosis. In the context of this particular deployment, distinctions among the use of the terms "data-driven," "rule-based," and "model-based," can be found in. Although there are three different categories of algorithms that have been selected for deployment, our main focus in this chapter will be on the evaluation of three candidates for data-driven anomaly detection. These algorithms will be evaluated upon their capability for robustly detecting incipient faults or failures in the ground-based phase of pre-launch space shuttle operations, rather than based oil heritage as performed in previous studies. Robust detection will allow for the achievement of pre-specified minimum false alarm and/or missed detection rates in the selection of alert thresholds. All algorithms will also be optimized with respect to an aggregation of these same criteria. Our study relies upon the use of Shuttle data to act as was a proxy for and in preparation for application to Ares I-X data, which uses a very similar hardware platform for the subsystems that are being targeted (TVC - Thrust Vector Control subsystem for the SRB (Solid Rocket Booster)).

Martin, Rodney Alexander↗
DOE OSTI2025

IceCube Search for Neutrino Emission from X-Ray Bright Seyfert Galaxies

The recent IceCube detection of TeV neutrino emission from the nearby active galaxy NGC 1068 suggests that active galactic nuclei (AGNs) could make a sizable contribution to the diffuse flux of astrophysical neutrinos. The absence of TeV γ-rays from NGC 1068 indicates neutrino production in the vicinity of the supermassive black hole, where the high radiation density leads to γ-ray attenuation. Therefore, any potential neutrino emission from similar sources is not expected to correlate with high-energy γ-rays. Disk-corona models predict neutrino emission from Seyfert galaxies to correlate with keV X-rays because they are tracers of coronal activity. Using through-going track events from the Northern Sky recorded by IceCube between 2011 and 2021, we report results from a search for individual and aggregated neutrino signals from 27 additional Seyfert galaxies that are contained in the Swift's Burst Alert Telescope AGN Spectroscopic Survey. Besides the generic single power law, we evaluate the spectra predicted by the disk-corona model assuming stochastic acceleration parameters that match the measured flux from NGC 1068. Assuming all sources to be intrinsically similar to NGC 1068, our findings constrain the collective neutrino emission from X-ray bright Seyfert galaxies in the northern sky, but, at the same time, show excesses of neutrinos that could be associated with the objects NGC 4151 and CGCG 420-015. These excesses result in a 2.7σ significance with respect to background expectations.

Abbasi, R. [Loyola University, Chicago, IL (United↗
NASA NTRS2021

Evaluation of Sensor Uncertainty Mitigation Methods for Detect-and-Avoid Systems

The impact of sensor noise on the performance of Detect-And-Avoid (DAA) systems can be reduced by implementing various mitigation schemes. This paper evaluates two such methods. One of them is the Sensor Uncertainty Mitigation (SUM) method, implemented in the Detect and Avoid Alerting Logic for Unmanned Systems (DAIDALUS) algorithm, a reference implementation in the DAA minimum operational performance standards. The second method is the Virtual Intruder State Aggregation (VISA), which averages multiple subsequent intruder states extrapolated to the current (most recent) time into a single ``aggregated`` intruder state. The VISA method can be used either individually as a sensor noise mitigation method in its own right, or in combination with DAIDALUS SUM. The performance of these methods is evaluated using three safety and operational suitability metrics and compared with a baseline configuration using static safety buffers. A large number of encounters representative of low-speed unmanned aircraft against non-cooperative manned aircraft, not equipped with a broadcasting transponder or ADS-B out system, are simulated and evaluated. An air-to-air radar model produces representative sensor noise for the DAA system. Results show that increasing the DAIDALUS SUM parameters for horizontal and vertical uncertainty improves the safety metric at the cost of increasing the number of actionable alerts leading to increased workload. A range of SUM parameters is recommended as suitable values for the type of operations considered for this work. VISA was found to be almost as effective as other noise mitigation methods even when it was used alone. Combining VISA with DAIDALUS SUM achieved the best performance among all investigated methods used with DAIDALUS. General trends and optimal SUM configurations were found to be nearly the same for two large and very different encounter data sets.

Detect-and-Avoid Systems↗
NASA NTRS2010

4D Dynamic RNP Annual Interim Report-Year 1

This Annual Interim Report summarizes the activities led by Raytheon, in collaboration with GE Aviation and SAIC, and presents the results obtained during the first year of this research effort to expand the RNP concept to 4 dimensions relative to a dynamic frame of reference. Joint Program Development Office (JPDO)Concepts of Operations for the Next Generation Air Transportation System (NextGen) considers 4 Dimension Trajectory (4DT) procedures a key enabler to Trajectory Based Operations (TBO). The JPDO defines 4DT as a precise description of an aircraft path in space and time . While NextGen assumes that this path is defined within an Earth-reference frame, many 4DT procedure implementations will require an aircraft to precisely navigate relative to a moving reference such as another aircraft to form aggregate flows or a weather cell to allow for flows to shift. Current methods of implementing routes and flight paths rely on aircraft meeting a Required Navigation Performance (RNP) specification and being equipped with a monitoring and alerting capability to annunciate when the aircraft system is unable to meet the performance specification required for the operation. Since all aircraft today operate within the NAS relative to fixed reference points, the current RNP definition is deemed satisfactory. However, it is not well understood how the current RNP construct will support NextGen 4DT procedures where aircraft operate relative to each other or to other dynamic frames of reference. The objective of this research effort is to analyze candidate 4DT procedures from both an Air Navigation Service Provider (ANSP) and aircraft perspective, to identify their specific navigational requirements, assess the shortcomings of the current RNP construct to meet these requirements, to propose an extended 4 Dimensional Dynamic RNP (4D Dynamic RNP) construct that accounts for the dynamic spatial and temporal nature of the selected 4DT procedures, and finally, to design an experiment using the Airspace and Traffic Operations Simulation (ATOS) system to validate the 4D Dynamic RNP construct. This Annual Interim Report summarizes the activities led by Raytheon, in collaboration with GE Aviation and SAIC, and presents the results obtained during the first year of this research effort to expand the RNP concept to 4 dimensions relative to a dynamic frame of reference. A comprehensive assessment of the state-of-the-art international implementation of current RNP was completed and presented in the Contractor Report RNP State-of-the-Art Assessment, Version 4, 17 December 2008 . The team defined in detail two 4DT operations, Airborne Precision Spacing and Self-Separation, that are ideally suited to be supported by 4D Dynamic RNP and developed their respective conceptual frameworks, Required Interval Management Performance (RIMP) Version 1.1, 13 April 2009 and Required Self Separation Performance (RSSP) Version 1.1, 13 April 2009 . Finally, the team started the development of a mathematical model and simulation tool for RIMP and RSSP scheduled to be delivered during the second year of this research effort.

Finkelsztein, Daniel M.↗
DOE OSTI2021

DETECTING FIRE WITH MACHINE LEARNING-ENABLED VISUAL MONITORING FOR NUCLEAR POWER PLANT ENVIRONMENTS

Nuclear power plants are experiencing significant cost challenges to remain competitive with other energy-generation utilities. Unlike other industries, the cost of operation and maintenance activities is mostly attributed to workforce costs. To mitigate this, nuclear power plant stakeholders are increasingly interested in the development and deployment of machine learning methods to potentially automate or augment manually intensive tasks to reduce costs, especially for monitoring activities. One monitoring function that is visually demanding and that can occur frequently to meet the requirements of a fire protection program is visually monitoring an area for fire occurrence. Currently, fire watch activities consist of a worker physically stationed at a given location with the sole responsibility of observing a given area to ensure a fire is detected and mitigated promptly. This effort focused on the development and evaluation of a suitable deep convolutional neural network to classify individual video frames at a sub-second frequency for the occurrence of “fire” and “no fire” in varying industrial environments similar to nuclear power plants. It is believed that a trained neural network model could be integrated with existing facility video surveillance camera feeds to generate alerts when fire inferences occur in individual frames captured at sub-second temporal resolutions. Extensive effort was dedicated to identifying and curating suitable imagery training data representing varying environments and scene settings with and without flame features to maximize generalization in nuclear power plant environments. The data collection effort resulted in the aggregation of a large, labeled image library exceeding 12,000 images to support model training for diverse industrial environments. A deep neural network model incorporating parallel multi-scale capabilities was developed and trained to support accurate image-based detection of flame incidents of varying sizes and spectral feature properties within heterogeneous scenes. Analysis results show that the trained model can achieve high inference accuracy despite heterogeneous scene environments and components. Testing accuracy exceeded 95.0 percent with very low false positive and false negative inferences.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
DOE OSTI2024

Analyzing Risks of Virtual Private Network Connections

The use of Splunk for analyzing VPN logs is an effective approach for identifying vulnerabilities in network endpoints. Splunk, a powerful platform for searching, monitoring, and analyzing machine-generated data, enables organizations to aggregate VPN logs in real-time, providing insights into network activity, user behavior, and potential security risks. By indexing VPN traffic and authentication logs, security teams can track abnormal patterns such as multiple failed login attempts, unusual IP addresses, or unexpected changes in bandwidth usage, all of which could indicate potential vulnerabilities or breaches. With Splunk’s advanced search and reporting capabilities, users can create custom dashboards and alerts to detect suspicious activities. Automated searches can flag endpoints exhibiting unusual behavior, while correlation analysis can identify links between compromised devices and broader network vulnerabilities. In particular, Splunk's machine learning capabilities can be leveraged to predict and prevent threats by identifying trends that might otherwise be missed in traditional log analysis. This proactive approach to monitoring VPN logs allows for the early detection of security weaknesses, enabling rapid response and minimizing potential damage to network integrity. By enhancing endpoint visibility, Splunk plays a crucial role in securing remote connections and safeguarding sensitive information. Additionally, Splunk’s automation and alerting features allow teams to create custom workflows that notify them of vulnerable or misconfigured endpoints identified through Shodan. This synergy between Splunk’s log analysis and Shodan’s device intelligence enhances an organization’s ability to proactively identify and mitigate security risks, improving the overall resilience of their VPN infrastructure.

97 MATHEMATICS AND COMPUTING↗
NASA NTRS2010

Centralized Alert-Processing and Asset Planning for Sensorwebs

A software program provides a Sensorweb architecture for alert-processing, event detection, asset allocation and planning, and visualization. It automatically tasks and re-tasks various types of assets such as satellites and robotic vehicles in response to alerts (fire, weather) extracted from various data sources, including low-level Webcam data. JPL has adapted cons iderable Sensorweb infrastructure that had been previously applied to NASA Earth Science applications. This NASA Earth Science Sensorweb has been in operational use since 2003, and has proven reliability of the Sensorweb technologies for robust event detection and autonomous response using space and ground assets. Unique features of the software include flexibility to a range of detection and tasking methods including those that require aggregation of data over spatial and temporal ranges, generality of the response structure to represent and implement a range of response campaigns, and the ability to respond rapidly.

Castano, Rebecca↗
DOE OSTI2021

Deep Learning Based Approach to Integrate MyShake's Trigger Data with ShakeAlert for Faster and Robust EEW Alerts

Earthquake Early Warning (EEW) systems depend on the dense seismic network to make fast and accurate earthquake detections to issue useful early alerts. The recent development and implementation of the ShakeAlert system is relying on the west coast seismic network to detect and estimate the earthquake parameters in real-time. While working on making improvements on the current system, one potential approach is to include more seismic recordings from various sources, such as the low-cost smartphone seismic network, such as the MyShake network, or the Google Android smartphones, since these smartphone seismic networks have much more portable stations (phones) to potentially provide useful data to the system. This report summarizes the initial exploration of using a deep learning approach to combine the data from both traditional seismic stations and the smartphone data in California. Due to the heterogeneity nature of the data, we aggregate data from the phones (using simulation data), as well as that from traditional seismic stations to grid cells. By generating real-time triggering ratio grid cell maps, the designed deep learning algorithm can process the data from multiple sources and detect the earthquake faster than only using that from a traditional seismic network.

58 GEOSCIENCES↗
NASA NTRS2013

Monitoring Regional Forest Disturbances across the US with near Real Time MODIS NDVI Products Resident to the ForWarn Forest Threat Early Warning System

Forest threats across the US have become increasingly evident in recent years. Sometimes these have resulted in regionally evident disturbance progressions (e.g., from drought, bark beetle outbreaks, and wildfires) that can occur across multiyear durations and have resulted in extensive forest overstory mortality. In addition to stand replacement disturbances, other forests are subject to ephemeral, sometimes yearly defoliation from various insects and varying types and intensities of ephemeral damage from storms. Sometimes, after prolonged severe disturbance, signs of recovery in terms of Normalized Difference Vegetation Index (NDVI) can occur. The growing prominence and threat of forest disturbances in part have led to the formation and implementation of the 2003 Healthy Forest Restoration Act which mandated that national forest threat early warning system be developed and deployed. In response, the US Forest Service collaborated with NASA, DOE Oakridge National Laboratory, and the USGS Eros Data Center to build and roll-out the near real time ForWarn early warning system for monitoring regionally evident forest disturbances. Given the diversity of disturbance types, severities, and durations, ForWarn employs multiple historical baselines that are used with current NDVI to derive a suite of six forest change products that are refreshed every 8 days. ForWarn employs daily quarter kilometer MODIS NDVI data from the Aqua and Terra satellites, including MOD13 data for deriving historical baseline NDVIs and eMODIS 7 NDVI for compiling current NDVI. In doing so, the Time Series Product Tool and the Phenological Parameters Estimation Tool are used to temporally de-noise, fuse, and aggregate current and historical MODIS NDVIs into 24 day composites refreshed every 8 days with 46 dates of products per year. The 24 day compositing interval enables disturbances to be detected, while minimizing the frequency of residual atmospheric contamination. Forest change products are computed versus the previous 1, previous 3, and all previous years in the MODIS record for a given 24 day interval. Other "weekly" forest change products include one computed using an adaptive length compositing method for quicker detection of disturbances, two others that adjust for seasonal fluctuations in normal vegetation phenology (e.g., early versus late springs). This overall approach enables forest disturbance dynamics from a variety of regionally evident biotic and abiotic forest disturbances to be viewed and assessed through the calendar year. The change products are also being utilized for forest change trend analysis and for developing regional forest overstory mortality products. ForWarn's forest change products are used to alert forest health specialists about new forest disturbances. Such alerts are also typically based on available Landsat, aerial, and ground data as well as communications with forest health specialists and previous experience. ForWarn products have been used to detect and track many types of regional disturbances to multiple forest types, including defoliation from caterpillars and severe storms, as well as mortality from both biotic and abiotic agents (e.g., bark beetles, drought, fire, anthropogenic clearing). ForWarn offers products that could be combined with other geospatial data on forest biomass to assess forest disturbance carbon impacts within the conterminous US.

Spruce, Joseph P.↗
DOE OSTI2025

Radio Afterglow Detection and AI-driven Response (RADAR): A Federated Framework for Gravitational-wave Event Follow-up

The landmark detection of both gravitational waves (GWs) and electromagnetic (EM) radiation from the binary neutron star merger GW170817 has spurred efforts to streamline the follow-up of GW alerts in current and future observing runs of ground-based GW detectors. Within this context, the radio band of the EM spectrum presents unique challenges. Sensitive radio facilities capable of detecting the faint radio afterglow seen in GW170817, and with sufficient angular resolution, have small fields of view compared to typical GW localization areas. Additionally, theoretical models predict that the radio emission from binary neutron star mergers can evolve over weeks to years, necessitating long-term monitoring to probe the physics of the various postmerger ejecta components. These constraints, combined with limited radio observing resources, make the development of more coordinated follow-up strategies essential—especially as the next generation of GW detectors promises a dramatic increase in detection rates. Here, we present RADAR, a framework designed to address these challenges by promoting community-driven information sharing, federated data analysis, and system resilience, while integrating AI methods for both GW signal identification and radio data aggregation. We show that it is possible to preserve data rights while sharing models that can help design and/or update follow-up strategies. We demonstrate our approach through a case study of GW170817, and discuss future directions for refinement and broader application.

Gravitational waves↗