Search NASA⌕ Search

SEARCH · Search NASA

Results for “anomaly detection system”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2022

Feature-based Anomaly Detection System

SAND2022-7963 O The Feature-Based Anomaly Detection System detects anomalies in video data based on features derived from pre-trained image models to avoid the need for training. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.

Hannasch, David↗
DOE OSTI2024

Autoencoder-Based Anomaly Detection System for Online Data Quality Monitoring of the CMS Electromagnetic Calorimeter

The CMS detector is a general-purpose apparatus that detects high-energy collisions produced at the LHC. Online data quality monitoring of the CMS electromagnetic calorimeter is a vital operational tool that allows detector experts to quickly identify, localize, and diagnose a broad range of detector issues that could affect the quality of physics data. A real-time autoencoder-based anomaly detection system using semi-supervised machine learning is presented enabling the detection of anomalies in the CMS electromagnetic calorimeter data. A novel method is introduced which maximizes the anomaly detection performance by exploiting the time-dependent evolution of anomalies as well as spatial variations in the detector response. The autoencoder-based system is able to efficiently detect anomalies, while maintaining a very low false discovery rate. The performance of the system is validated with anomalies found in 2018 and 2022 LHC collision data. In addition, the first results from deploying the autoencoder-based system in the CMS online data quality monitoring workflow during the beginning of Run 3 of the LHC are presented, showing its ability to detect issues missed by the existing system.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
DOE OSTI2023

A Graph Convolutional Network for Active Distribution System Anomaly Detection Considering Measurement Spatial-Temporal Correlations

The accuracy of distribution system state estimation may be significantly impacted by the existence of bad measure-ments and unexpected topology errors. This paper proposes a data-driven Graph Convolutional Network (GCN) for anomaly detection, including bad measurements and topology change events. Compared to many existing machine learning approaches, the proposed approach embeds both spatial-temporal measure-ment correlations, which allows us to detect and distinguish different anomalies. Numerical results carried out on the IEEE 37-node system demonstrate that the proposed-based method can obtain high accuracy in detecting bad data and topology changes as compared to other approaches, even in the presence of high PV penetrations.

active distribution system↗
DOE OSTI2025

FL‐ADS: Federated learning anomaly detection system for distributed energy resource networks

Abstract With the ongoing development of Distributed Energy Resources (DER) communication networks, the imperative for strong cybersecurity and data privacy safeguards is increasingly evident. DER networks, which rely on protocols such as Distributed Network Protocol 3 and Modbus, are susceptible to cyberattacks such as data integrity breaches and denial of service due to their inherent security vulnerabilities. This paper introduces an innovative Federated Learning (FL)‐based anomaly detection system designed to enhance the security of DER networks while preserving data privacy. Our models leverage Vertical and Horizontal Federated Learning to enable collaborative learning while preserving data privacy, exchanging only non‐sensitive information, such as model parameters, and maintaining the privacy of DER clients' raw data. The effectiveness of the models is demonstrated through its evaluation on datasets representative of real‐world DER scenarios, showcasing significant improvements in accuracy and F1‐score across all clients compared to the traditional baseline model. Additionally, this work demonstrates a consistent reduction in loss function over multiple FL rounds, further validating its efficacy and offering a robust solution that balances effective anomaly detection with stringent data privacy needs.

Purohit, Shaurya [Iowa State University Ames Iowa ↗
DOE OSTI2021

The value of human data annotation for machine learning based anomaly detection in environmental systems

Anomaly detection is the process of identifying unexpected data samples in datasets. Automated anomaly detection is either performed using supervised machine learning models, which require a labelled dataset for their calibration, or unsupervised models, which do not require labels. While academic research has produced a vast array of tools and machine learning models for automated anomaly detection, the research community focused on environmental systems still lacks a comparative analysis that is simultaneously comprehensive, objective, and systematic. This knowledge gap is addressed for the first time in this study, where 15 different supervised and unsupervised anomaly detection models are evaluated on 5 different environmental datasets from engineered and natural aquatic systems. To this end, anomaly detection performance, labelling efforts, as well as the impact of model and algorithm tuning are taken into account. As a result, our analysis reveals the relative strengths and weaknesses of the different approaches in an objective manner without bias for any particular paradigm in machine learning. Most importantly, our results show that expert-based data annotation is extremely valuable for anomaly detection based on machine learning.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2024

Federated Machine Learning-Based Anomaly Detection System for Synchrophasor Network Using Heterogeneous Data Sets: Preprint

Synchrophasor technology is widely deployed in the energy management system to monitor the grid health at micro level and perform necessary corrective actions in real time; however, integrated phasor devices and data aggregators are exposed to several cybersecurity threats. This paper proposes a federated ML(FML)-based ADS to detect several data integrity attacks in the synchrophasor network. The proposed approach integrates the horizontal FML technique and consists of substation-based local models and a control center-based global model. The proposed methodology includes training local models using heterogeneous data sets that include network and grid information and updating the global model through multiple iterations by sharing model gradients. Finally, the trained global model is applied to identify cyberattacks, normal operation, and physical events. To validate the proof of concept, we used synthetic data sets generated by Mississippi State University and Oak Ridge National Laboratory for training and testing the classification models using the National Renewable Energy Laboratory's high performance computing resources. Our experimental results, computed through several performance measures, reveal that the proposed approach shows consistent performance during the binary, three-class, and multiclass classifications while ensuring privacy of synchrophasor data.

anomaly detection system↗
DOE OSTI2017

Detecting Periodic Subsequences in Cyber Security Data

Anomaly detection for cyber-security defence has garnered much attention in recent years providing an orthogonal approach to traditional signature-based detection systems. Anomaly detection relies on building probability models ofnormal computer network behaviour and detecting deviations from the model. Most data sets used for cyber-security have a mix of user-driven events and automated network events, which most often appears as polling behaviour. Separating these automated events from those caused by human activity is essential to building good statistical models for anomaly detection. In this article, we present a change point detection framework for identifying automated network events appearing as periodic subsequences of event times. The opening event of each subsequence is interpreted as a human action which then generates an automated, periodic process. Difficulties arising from the presence of duplicate and missing data are addressed. The methodology is demonstrated using authentication data from Los Alamos National Laboratory's enterprise computer network.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2021

On Anomaly Detection for Transactive Energy Systems with Competitive Market

Two anomaly-detection criteria are proposed for transactive energy systems with competitive markets. Participants of transactive energy systems seek an optimal power allocation through hybrid economic-control methods to facilitate the integration of various types of distributed energy resources to power distribution systems. In transactive energy systems, every participant is assumed to be a rational entity, and consumers have diminishing marginal utility and suppliers have increasing marginal cost. With the first proposed anomaly-detection criterion, the monotonicity of marginal cost and marginal utility are examined. The impact of line flow constraints is also taken into consideration. Then, the second anomaly-detection criterion is proposed for TESs with marginal cost and marginal utility which change faster than a certain rate. The second criterion is more accurate than the first one for TES with marginal cost and marginal utility which change faster than a certain rate, but it requires the knowledge of that rate. Neither criteria requires more data than those necessary to find the optimal power allocation and the market-clear price in a transactive energy system. Therefore, the proposed criteria do not disclose any more data than necessary. As the monotonicity of marginal cost and marginal utility in a TES with competitive markets results in convex objective functions in an optimization problem and strongly convex ones when marginal cost and marginal utility changes faster than a certain rate, the two detection criteria are also applicable to anomaly detection of general convex optimization problems. Simulations are carried out to show the efficacy of the proposed criteria to detect anomalies caused by cyberattacks.

Wang, Peng↗
DOE OSTI2025

Anomaly Detection Based on Machine Learning for the CMS Electromagnetic Calorimeter Online Data Quality Monitoring

Using a semi-supervised machine learning approach we present a real-time anomaly detection system based on an autoencoder used for online data quality monitoring of the CMS electromagnetic calorimeter operating at the CERN LHC. We introduce a novel method that maximizes the anomaly detection performance making use of the time-dependence of anomalies and the spatial variations in the detector response. The autoencoder-based system efficiently detects anomalies in real time and maintains a very low false discovery rate. We validate the performance of this novel system with anomalies from LHC collision data taken in 2018 and 2022. In addition, results are presented after deploying the autoencoder-based system in the CMS online Data Quality Monitoring workflow at the beginning of LHC Run 3 resulting in the system to detect issues that were missed by the existing system.

Harilal, Abhirami [Carnegie Mellon University, Pit↗
DOE OSTI2022

Condition monitoring and anomaly detection in cyber-physical systems

The modern industrial environment is equipping myriads of smart manufacturing machines where the state of each device can be monitored continuously. Such monitoring can help identify possible future failures and develop a cost-effective maintenance plan. However, it is a daunting task to perform early detection with low false positives and negatives from the huge volume of collected data. This requires developing a holistic machine learning framework to address the issues in condition monitoring of high priority components and develop efficient techniques to detect anomalies that can detect and possibly localize the faulty components. This paper presents a comparative analysis of recent machine learning approaches for robust, cost-effective anomaly detection in cyber-physical systems. While detection has been extensively studied, very few researchers have analyzed the localization of the anomalies. We show that supervised learning outperforms unsupervised algorithms. For supervised cases, we achieve near-perfect accuracy of 98% (specifically for tree-based algorithms). In contrast, the best-case accuracy in the unsupervised cases was 63%—the area under the receiver operating characteristic curve (AUC) exhibits similar outcomes as an additional metric.

Marfo, William↗
DOE OSTI2020

Attack-resilient algorithms and testbed federation for wide-area protection and control in smart grid

Today’s energy infrastructure is undergoing a massive transformation across all generation, transmission, and distribution systems to provide reliability, efficiency, and sustainability to the power system network. During the past 10 years, there has been a remarkable enhancement in developing close-loop wide-area protection and control (WAPAC) applications, such as automatic generation control (AGC), wide-area protection scheme (WAPS), synchrophasor-based wide-area voltage control system (WAVCS), etc., in the energy management system (EMS) to provide an adequate situational awareness to control center operators during physical disturbances and natural events. The rapid digitalization, unencrypted communication, and numerous data-sharing devices have increased digital access points that have exposed the grid network to countless cyberattacks pertinent to the WAPAC cybersecurity. Given the amount of complex grid network coupled with legacy infrastructures, it is untrustworthy to completely rely on information technology (IT)-based conventional security measures to defend against evolving cyberattacks. Hence, there is a compelling need to go beyond the traditional paradigm of ‘security by obscurity’ and ‘bolt-on’ security measures, and develop a suite of innovative security solutions at multiple layers to transform the current “fault-resilient” grid into “fault and attack-resilient” grid of the future. This dissertation specifically focuses on developing application-specific attack-resilient solutions for critical WAPAC applications in the smart grid. The first part of the study, Attack-Resilient Wide-Area Protection Scheme, presents a cyber-physical attack-resilient system (CPARS) for WAPS, where two anomaly detection methods are proposed to detect multi-level cyberattacks followed by the rules-based intrusion mitigation system (RIMS) to initiate effective mitigation strategies, tailored to these attacks, to restore the normal grid operation after disturbances. The first anomaly detection component, Machine learning-based Anomaly Detection for Centralized WAPS, discusses a novel architecture and methodology for developing a machine-learning-based anomaly detection system (ADS) for the centralized wide-area protection system (CWAPS) by applying the variational mode decomposition (VMD) technique and decision tree (DT) algorithms using cyber logs and synchrophasor measurements. The second component, Multi-Agent-based Anomaly Detection for Decentralized WAPS, presents a two-level hierarchical multi-agent-based decentralized WAPS against the system-aware stealthy cyber-attacks. Finally, for the RIMS, the state transition diagram-based mitigation measures are defined based on the grid operation states and experimental testing and evaluation are presented in a cyber-physical testbed environment. The second part of the study, Attack-Resilient Wide-Area Voltage Control System, addresses the existing vulnerabilities in the wide-area voltage control system (WAVCS), presents the methodology for performing an impact analysis during data integrity attacks, and proposes a data-driven attackresilient system (DARS) by incorporating machine learning-based ADS and rules-based anomaly mitigation system (RAMS) to detect these attacks and provide necessary mitigation actions to maintain the transient voltage stability after disturbances. Finally, the third part, Networked Federation Testbed (NEFTSec) for Smart Grid Cybersecurity, focuses on developing an interconnected federated testbed through a common network like the internet, describes its conceptual architectures, and also presents its design components for experimental testing, validation, and evaluation. Further, it presents the co-simulation interface algorithm (CIA) to facilitate the geographically-dispersed real-time distributed simulation (GD-RTDS) during the cyber-physical federation. In general, this dissertation presents innovative attack-resilient solutions for WAPAC applications that are experimentally tested and evaluated using the PowerCyber testbed and NEFTSec platform to accelerate the transition of state-of-the-art research works to the real-field deployments.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2012

Improving Cyber-Security of Smart Grid Systems via Anomaly Detection and Linguistic Domain Knowledge

The planned large scale deployment of smart grid network devices will generate a large amount of information exchanged over various types of communication networks. The implementation of these critical systems will require appropriate cyber-security measures. A network anomaly detection solution is considered in this work. In common network architectures multiple communications streams are simultaneously present, making it difficult to build an anomaly detection solution for the entire system. In addition, common anomaly detection algorithms require specification of a sensitivity threshold, which inevitably leads to a tradeoff between false positives and false negatives rates. In order to alleviate these issues, this paper proposes a novel anomaly detection architecture. The designed system applies the previously developed network security cyber-sensor method to individual selected communication streams allowing for learning accurate normal network behavior models. Furthermore, the developed system dynamically adjusts the sensitivity threshold of each anomaly detection algorithm based on domain knowledge about the specific network system. It is proposed to model this domain knowledge using Interval Type-2 Fuzzy Logic rules, which linguistically describe the relationship between various features of the network communication and the possibility of a cyber attack. The proposed method was tested on experimental smart grid system demonstrating enhanced cyber-security.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

Anomaly detection in PV systems using constrained low-rank and sparse decomposition

PV (photovoltaic) systems, also known as solar panel systems, play an essential role in the mitigation of greenhouse gas emissions and the promotion of renewable energy. Through the conversion of sunlight into usable energy, electricity is generated without emitting greenhouse gases and producing pollutants. Notwithstanding the evolutionary significance of PV systems, the occurrence of defects and anomalies in PV systems may result in diminished power output, consequently impeding the efficiency of the systems and potentially resulting in hazards in certain circumstances. Therefore, early detection of faults and anomalies in PV systems is imperative to guarantee the reliability, efficiency, and safety of the systems. In this article, we develop a signal decomposition for the purpose of anomaly detection in PV systems. The proposed methodology is grounded on the concept of low-rank and sparse decomposition, with consideration given to the signs of the decomposed low-rank and sparse components, as well as the smooth variations within and between periods in the mean signals. Through the implementation of Monte Carlo simulations, we showcase the efficacy of our proposed methodology in identifying anomalies of varying durations and magnitudes in PV systems. A case study is employed to validate the proposed methodology in detecting anomalies in real PV systems.

14 SOLAR ENERGY↗
DOE OSTI2018

Recurrent Neural Network Attention Mechanisms for Interpretable System Log Anomaly Detection

Deep learning has recently demonstrated state-of-the art performance on key tasks related to the maintenance of computer systems, such as intrusion detection, denial of service attack detection, hardware and software system failures, and malware detection. In these contexts, model interpretability is vital for administrator and analyst to trust and act on the automated analysis of machine learning models. Deep learning methods have been criticized as black box oracles which allow limited insight into decision factors. In this work we seek to "bridge the gap'' between the impressive performance of deep learning models and the need for interpretable model introspection. To this end we present recurrent neural network (RNN) language models augmented with attention for anomaly detection in system logs. Our methods are generally applicable to any computer system and logging source. By incorporating attention variants into our RNN language models we create opportunities for model introspection and analysis without sacrificing state-of-the art performance. We demonstrate model performance and illustrate model interpretability on an intrusion detection task using the Los Alamos National Laboratory (LANL) cyber security dataset, reporting upward of 0.99 area under the receiver operator characteristic curve despite being trained only on a single day's worth of data.

Anomaly detection, Attention, Recurrent Neural Net↗
DOE OSTI2023

RX-ADS: Interpretable Anomaly Detection Using Adversarial ML for Electric Vehicle CAN Data

Recent year has brought considerable advancements in Electric Vehicles (EVs) and associated infrastructures/ communications. Intrusion Detection Systems (IDS) are widely deployed for anomaly detection in such critical infrastructures. This paper presents an Interpretable Anomaly Detection System (RX-ADS) for intrusion detection in CAN protocol communication in EVs. Contributions include: 1) window based feature extraction method; 2) deep Autoencoder based anomaly detection method; and 3) adversarial machine learning based explanation generation methodology. The presented approach was tested on two benchmark CAN datasets: OTIDS and Car Hacking. The anomaly detection performance of RX-ADS was compared against the state-of-the-art approaches on these datasets: HIDS and GIDS. The RX-ADS approach presented performance comparable to the HIDS approach (OTIDS dataset) and has outperformed HIDS and GIDS approaches (Car Hacking dataset). Further, the proposed approach was able to generate explanations for detected abnormal behaviors arising from various intrusions. Furthermore, these explanations were later validated by information used by domain experts to detect anomalies. Other advantages of RX-ADS include: 1) the method can be trained on unlabeled data; 2) explanations help experts in understanding anomalies and root course analysis, and also help with AI model debugging and diagnostics, ultimately improving user trust in AI systems.

42 ENGINEERING↗