Search NASA⌕ Search

SEARCH · Search NASA

Results for “exfiltration”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2022

Application of reference-free natural background–oriented schlieren photography for visualizing leakage sites in building walls

Air leakage in buildings can cause health and comfort concerns for occupants and can contribute to mold growth on building materials, or in extreme conditions, rot of building materials. Unwanted air leakage through the building envelope also contributes to approximately 4 quadrillion Btu (1172 TWh) of energy consumption per year in the building sector in the United States. Locating and sealing leakage sites can improve the energy efficiency, comfort, air quality, and moisture durability of the building stock. Typical methods of finding leakage sites, such as infrared imaging and smoke tracing, rely on concurrent blower door operation, which can also measure the total leakage rate of the building. Smoke tracing can be disruptive to occupants, and infrared imaging and smoke tracing cannot measure the contribution of individual leaks to prioritize sealing efforts. Here, an optical fluid flow imaging technique, reference-free natural background–oriented schlieren imaging, was adapted to visualize air exfiltration. This is the first step in developing a method to noninvasively locate and measure exfiltration or infiltration sites so that sealing efforts can be prioritized. Experimental results of this technique are presented, demonstrating the method's applicability to visualizing exfiltration through three common building claddings in an outdoor environment. Key variables impacting the performance of this technique when applied to building leakage are also discussed.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2022

Precursor Analysis Report: Doppelpaymer Ransomware Attack on Petroleos Mexicanos (PEMEX) 2019

The DoppelPaymer Ransomware Attack on Petroleos Mexicanos (PEMEX) 2019 Precursor Analysis Report leverages publicly available information about the PEMEX cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. The 2019 DoppelPaymer ransomware attack on PEMEX, Mexico’s nationalized petroleum corporation, highlights a unique threat that ransomware and cybercriminal extortion poses to Operational Technology (OT) environments in critical infrastructure. The incident began with an employee downloading commodity malware that allowed adversaries to gain initial access to PEMEX’s enterprise environment. After conducting privilege escalation, tool ingress, and data exfiltration, the adversaries deployed DoppelPaymer ransomware throughout the PEMEX enterprise environment, resulting in the company having to take dozens of systems offline for at least several days. Although PEMEX stated that their operations were not affected, the data exfiltrated from PEMEX was made available for download on DoppelPaymer’s leak site, as well as on other illicit criminal forums. This stolen data included not only company information, but also sensitive OT-specific configuration data. This incident showcases how cybercriminal exfiltration and posting of sensitive OT architecture documentation can pose security concerns for the targeted organization for years due to the long lifespan of OT assets and architectures. Researchers and analysts identified 18 unique techniques utilized during the attack with a total of 190 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Fifteen of the identified techniques used during the DoppelPaymer ransomware attack were precursors to the triggering event. Analysis identified 163 observables associated with these precursor techniques, 34 of which were assessed to have an increased likelihood of being perceived in the 60 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
NASA NTRS2021

Responses of Florida Scrub Vegetation to Water Additions from a Groundwater Treatment Project and to Hurricane Disturbance

Florida scrub is a fire-maintained shrub vegetation of well-drained, sandy soils; dominant species include several species of Quercus and Serenoa repens. In a remediation project, treated groundwater was distributed through an exfiltration gallery into intact scrub. We established eight permanent line-intercept transects (15 m length) in the site in April 2002, four close to the exfiltration gallery and four more distant from it. We sampled vegetation, < 0.5 m and ≥ 0.5 m, along each transect and measured vegetation height at four points (0, 5, 10, 15 m) annually through 2019. The initial phase of the project operated from October 2002 to early March 2004 (494 days) and distributed 1.74 x 10^8 L of water. The final phase of the project occurred from March 2005 through August 2008 (1251 days) and distributed 1.90 x 10^8 L of water. Pumping raised the water table near the exfiltration gallery. Vegetation height did not differ between the near and far transects initially. Vegetation height increased in the near transects by 2004 with the greatest percent change in 2003 and 2004 as did total cover ≥ 0.5 m. Total cover < 0.5 m and bare ground were similar initially in the near and far transects and declined in the near transects by 2004. Scrub species, particularly the dominant scrub oaks, increased height and cover in response to water additions with no loss of dominant scrub species and no establishment of mesophytes. Hurricane Frances (September 2004) reduced cover ≥ 0.5 m the following year. Hurricane Matthew (October 2016) and Hurricane Irma (September 2017) caused greater damage including breaking limbs as reflected in reduced height and total cover ≥ 0.5 m probably because the older, taller scrub was more vulnerable to wind damage.

Florida scrub↗
DOE OSTI2024

Hydrological controls of a riparian wetland based on stable isotope data and model simulations

Isotopic evidence of groundwater and stream water is frequently used to investigate water exchanges with groundwater. Monthly sampling of rain, stream water, and groundwater was conducted at Tims Branch watershed in South Carolina for the oxygen and hydrogen stable isotope (δ 2 H and δ 18 O) measurement, as well as pH and oxidation–reduction potential (ORP). Together with a mass balance perspective, it was determined that it takes a few weeks to one month for groundwater in the hyporheic zone to fully exchange with stream water. From hydrodynamic modelling, we show that substantial (up to 70 %) groundwater exchange occurs at gaining and losing sites. Groundwater exfiltration, i.e. inflow into stream water, contributes up to 4 % to stream water, with the remainder from upstream exfiltration. A 2–4 % per day renewal rate of adjacent groundwater would indirectly indicate a groundwater residence time in the order of half a month to a full month (assuming either a well-mixed case or large dispersion rate in pulse flow case), in agreement with a greatly reduced variability of δ 2 H and δ 18 O of groundwater compared to stream water and rain. This reduced variability of stable isotope signal from groundwater confirms our hypothesis that riparian groundwater mixing at Tims Branch is more of a mixed type rather than a pulse flow type. As a result, a monthly time scale is sufficient for groundwater to become anoxic at exit points into stream water resulting in the episodic production of natural organic matter- and iron-rich flocs upon oxidation.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2022

What does it take to “see” air leakage through a building envelope?

Unwanted air leakage in buildings can cause health and comfort issues for the building occupants and contribute to rot and mold growth in building materials. Leakage also contributes to unnecessary energy consumption ~4 quads (1172 TWh) per year in the buildings sector in the United States. Finding and repairing leaks through the building envelope can improve the energy efficiency, comfort, air-quality, and moisture durability of the building stock. Typical methods of locating air leakage, such as infrared imaging or smoke tracing, rely on concurrent blower door operation which also measures the total leakage rate of the building. These methods can be disruptive to occupants and can’t measure the contribution of individual leaks to prioritize sealing efforts. ORNL is working on a refraction-based fluid flow imaging technique that can measure the leakage rate of individual leaks from the outside of the building. The working principle of this device is based on the refraction of light caused by the exfiltration because there is a small difference in density between the exfiltration and ambient air. We will discuss the operation of the air leak detector and key variables that affect its performance. We will also present preliminary results showing the visualization capability of this new air leak detector under different conditions. Experiments were completed with different claddings, air temperatures, and lighting conditions.

Boudreaux, Philip↗
DOE OSTI2020

Modeling and analysis of heat emissions from buildings to ambient air

Heat emissions from buildings is a significant source of anthropogenic heat influencing the urban microclimate; however, they are usually oversimplified in urban climate and microclimate modeling. This study developed a bottom-up physics-based approach to calculate heat emissions from buildings to the ambient air and implemented the approach in EnergyPlus. In this work, a simple result verification was conducted by comparing the EnergyPlus simulated results against the spreadsheet calculations. Simulations covering 16 commercial building types, four climates, and two energy efficiency levels were conducted to understand and evaluate the building heat emissions and their temporal patterns as well as three major components: (1) building envelope (convective heat transfer to ambient air), (2) zones (air exfiltration and exhaust air), and (3) HVAC systems (relief air and heat rejection from condensers or cooling towers). The main findings are: (1) heat emissions are usually higher than the site energy use (about 2.5 times), and their dynamics should be considered; (2) building characteristics and their energy systems lead to differences in heat emission contributions from the three components, and their dynamics, for example, in the warehouse models, the envelope component accounts for 90.4%, while it is 12.7% for the large office models; (3) for most building typologies, the climate has a strong impact on heat emissions, for example, buildings with dominant heat emissions from the zone exhaust air and/or the HVAC reject heat, a general decrease in heat emissions in hotter climates is observed, while envelope-dominated buildings show the opposite; and (4) building technologies that reduce energy use in buildings may perform differently in reducing heat emissions. The developed heat emissions calculation method can be adopted in EnergyPlus and most other building energy modeling programs. It can provide dynamic building heat emissions as an input to urban climate computational fluid dynamics (CFD) models at a higher spatial and temporal resolution than is currently available, to improve the simulation accuracy of the urban microclimate and capture the urban heat island effect and urban overheating.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗
DOE OSTI2022

A Multicomponent Reactive Transport Model for Integrated Surface‐Subsurface Hydrology Problems

Abstract Despite the widespread use of integrated hydrology models in a variety of applications, consideration of multicomponent reactive transport is still not common. The implementation of these processes requires coupling transport at the surface‐subsurface interface and efficient solution of the non‐linear geochemical model that is consistent with the integrated hydrology solution. The Advanced Terrestrial Simulator provides a flexible multiphysics framework that facilitated this process. In this work, the integrated reactive transport process kernel (PK) was weakly coupled to the integrated hydrology PK. In turn, integrated transport and reactions were coupled using an operator splitting approach. This splitting enabled an explicit solution of the integrated transport problem, including a novel algorithm to calculate exchange fluxes across the surface‐subsurface interface and a point‐by‐point solution of the geochemical problem. Geochemical capabilities were added using well‐established external codes, but rather than using a custom interface to each, a generic interface was used that clearly specifies the variables and operations used by the chemistry PK. The implementation is demonstrated with two example simulations: transport of a tracer in a soil column as it saturates over time and water ponds on the surface and reactive transport in a hillslope driven by successive wet‐dry cycles that result in infiltration, runoff and exfiltration processes.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2020

Distributed Intrusion Detection System using Semantic-based Rules for SCADA in Smart Grid

Cyber-physical system (CPS) security for the smart grid enables secure communication for the SCADA and wide-area measurement system data. Power utilities world-wide use various SCADA protocols, namely DNP3, Modbus, and IEC 61850, for the data exchanges across substation field devices, remote terminal units (RTUs), and control center applications. Adversaries may exploit compromised SCADA protocols for the reconnaissance, data exfiltration, vulnerability assessment, and injection of stealthy cyberattacks to affect power system operation. In this paper, we propose an efficient algorithm to generate robust rule sets. We integrate the rule sets into an intrusion detection system (IDS), which continuously monitors the DNP3 data traffic at a substation network and detects intrusions and anomalies in real-time. To enable CPS-aware wide-area situational awareness, we integrated the methodology into an open-source distributed-IDS (D-IDS) framework. The D-IDS facilitates central monitoring of the detected anomalies from the geographically distributed substations and to the control center. The proposed algorithm provides an optimal solution to detect network intrusions and abnormal behavior. Different types of IDS rules based on packet payload, packet flow, and time threshold are generated. Further, IDS testing and evaluation is performed with a set of rules in different sequences. The detection time is measured for different IDS rules, and the results are plotted. All the experiments are conducted at Power Cyber Lab, Iowa State University, for multiple power grid models. After successful testing and evaluation, knowledge and implementation are transferred to field deployment.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2023

Wheelbyte Incident Response [Slides]

Wheelbyte faced some challenges regarding cyber attacks. The company reported possible exfiltration of company and customer data, along with the sudden death of an employee.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

TF9 Dataset Analysis

Incident Overview: In the time between November 2, 2019 and November 11, 2019, WheelByte was plagued by breaches in security. These insecurities led to breaches in customer data, company data, and even the death of an employee, Matthew Swift. They have launched an investigation into the company’s computer systems in hopes to find the root cause. We have been provided with the following artifacts from WheelByte: memory images, disk images, network packet captures, and emails. We have found multiple cyber-system attacks against WheelByte. Our investigation lasted from July 13th - August 3rd, 2023. WheelByte allowed us to look at any and every file, and there were no restrictions on what we could or could not use in our investigation. By the end of our investigation, we have been able to deduce who is behind the attack, what they have done, and why they did it. A company that is closely related to WheelByte is called Slyde. Slyde sells electric scooters and it is known that the Chief Executive Officer (CEO) of Slyde, Kimberly Holmes, sees WheelByte as a threat to business, as Wheelbyte sells electric skateboards. We have been able to deduce that Slyde is likely behind many of the malicious attacks. We have seen exfiltration addresses to Slyde domains, along with other Slyde information within their malware. We can see lots of traffic to and from Slyde Internet Protocol (IP) addresses. This may be an attempt to cripple WheelByte’s productivity to remove Slyde’s competitor from the market.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Reinforcement Learning Approach to Cybersecurity in Space (RELACSS)

Securing satellite groundstations against cyber-attacks is vital to national security missions. However, these cyber threats are constantly evolving. As vulnerabilities are discovered and patched, new vulnerabilities are discovered and exploited. In order to automate the process of discovering existing vulnerabilities and the means to exploit them, a reinforcement learning framework is presented in this report. We demonstrate that this framework can learn to successfully navigate an unknown network and detect nodes of interest despite the presence of a moving target defense. The agent then exfiltrates a file of interest from the node as quickly as possible. This framework also incorporates a defensive software agent that learns to impede the attacking agents progress. This setup allows for the agents to work against each other and improve their abilities. We anticipate that this capability will help uncover unforeseen vulnerabilities and the means to mitigate them. The modular nature of the framework enables users to swap out learning algorithms and modify the reward functions in order to adapt the learning tasks to various use cases and environments. Several algorithms, viz., tabular Q learning, deep Q networks, proximal policy optimization, advantage actor-critic, generative adversarial imitation learning, are explored for the agents and the results highlighted. The agent learns to solve the tasks in a light-weight abstract environment. Once the agent learns to perform sufficiently well, it can be deployed in a minimega virtual machine environment (or a real network) with wrappers that map abstract actions to software commands. The agent also uses a local representation of the actions called a ‘slot-mechanism’. This allows the agent to learn in a certain network and generalize it to different networks. The defensive agent learns to predict the actions taken by an offensive agent and uses that information to anticipate the threat. This information can then either be used to raise an alarm or to take actions to thwart the attack. We believe that with the appropriate reward design, a representative environment, and action set, this framework can be generalized to tackle other cybersecurity tasks. By sufficiently training these agents, we can anticipate vulnerabilities leading to robust future designs. We can also deploy automated defensive agents that can help secure satellite groundstation and their vital national security missions.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2024

Low Yield Nuclear Monitoring Physics Experiment 1 – Integrated Data Acquisition System Design and Initial Observations

The report documents the design of the Integrated Data AcQuisition (IDAQ) system and observations recorded during the first in a series of underground chemical explosions conducted on the Nevada National Security Site (NNSS) in southern Nevada. Experiments are funded as part of Low Yield Nuclear Monitoring (LYNM) research and development within the United States National Nuclear Security Administration NA-22 nuclear non-proliferation program. The series is part of the broader Physical Experiment 1 (PE1) being conducted in and around the P-tunnel facility on the NNSS. Each explosive experiment utilizes several tons of comp-B to generate signals recorded by a broad suite of instrumentation. The IDAQ serves as the backbone for all subsurface instrumentation providing precise time synchronization, remote control, data exfiltration and backup, along with recording several sensing modalities throughout the underground complex that includes ground motion, environmental conditions, and electromagnetic signals.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Precursor Analysis Report: Conti Ransomware Attack on the Health Service Executive of Ireland 2021

The Conti Ransomware Attack on the Health Service Executive (HSE) of Ireland 2021 Precursor Analysis Report leverages publicly available information about the attack and catalogs anomalous observables for each technique employed by the adversary. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. The HSE provides public healthcare corporate services and operational services throughout Ireland, with critical functions including the acute national ambulance service, acute hospital service, and community healthcare service. On 14 May 2021, Conti ransomware encrypted 80 percent of the HSE’s Information Technology (IT) infrastructure across corporate, hospital, community, and electronic health record services. Conti is a ransomware-as-a-service operation that encrypts local files, uses double extortion against victims, and is facilitated by many intrusion tools. The attack forced the HSE to shut down its entire IT infrastructure to contain the ransomware, forcing employees to revert to pen and paper recordkeeping and leading to the cancellation of many appointments and procedures. The adversary also exfiltrated 700 GB of data, compromising the confidentiality of patients’ protected health information. Had the adversary targeted the COVID-19 cloud systems or operational technology assets, such as Internet of Medical Things medical devices or smart building management systems, the impact of the attack would almost certainly have been far more severe. Researchers and analysts identified 21 unique techniques (used in a sequence of 23 steps) likely utilized during the attack with a total of 1,185 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Twenty-one of the identified techniques used during the attack on the HSE were precursors to the triggering event. Analysis identified 1,086 observables associated with these precursor techniques, 850 of which were assessed to have an increased likelihood of being perceived in the 57 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

A multi-scale time-series dataset of anthropogenic heat from buildings in Los Angeles County

The dataset contains hourly Anthropogenic heat (AH) from buildings in Los Angeles County, based on weather data from 2018. The hourly AH is aggregated at three spatial resolutions: 450m x 450m grid, 12km x 12km grid, and census tract. The AH is broken down into three components: building envelope surface convection, heating, ventilation, and air conditioning (HVAC) system heat release, and zone exfiltration and exhaust air heat loss. The dataset is created with the physics-based EnergyPlus building energy models to calculate individual buildings' AH considering WRF-UCM simulated microclimate conditions. Please refer to the paper "A multi-scale time-series dataset of anthropogenic heat from buildings in Los Angeles County" for more information about the data generation workflow and the data validation procedure. The data set contains two folders: the "output_data" folder holds the simulation results (EP_output and EP_output_csv), building metadata (building_metadata.geojson and building_metadata.csv), aggregated heat emission and energy consumption time-series data (hourly_heat_energy), and geographical data (geo_data) associated with the GEOID referenced in heat and energy consumption data. The "input_data" folder contains the raw data used to generate files in the "output_data" folder as well as data sets used in the validation. The code repository (https://github.com/IMMM-SFA/xu_etal_2022_sdata) holds the processing scripts for data curation, validation, and visualization.

Energy↗
NASA NTRS2015

Tactically Extensible and Modular Communications X-Band TEMCOM-X

This paper will discuss a CubeSat size (3U) telemetry system concept being developed at Marshall Space Flight Center (MSFC) in cooperation with the U.S. Department of the Army and Dynetics Corporation. This telemetry system incorporates efficient, high-bandwidth communications by developing flight-ready, low-cost, Proto-flight software defined radio (SDR) and Electronically Steerable Patch Array (ESPA) antenna subsystems for use on platforms as small as CubeSats and unmanned aircraft systems (UASs). Higher bandwidth capacity will enable high-volume, low error-rate data transfer to and from tactical forces or sensors operating in austere locations (e.g., direct imagery download, unattended ground sensor data exfiltration, interlink communications).

Sims, William H.↗
NASA NTRS2015

Tactically Extensible and Modular Communications - X-Band TEMCOM-X

This paper will discuss a proposed CubeSat size (3U) telemetry system concept being developed at Marshall Space Flight Center (MSFC) in cooperation with the U.S. Department of the Army and Dynetics Corporation. This telemetry system incorporates efficient, high-bandwidth communications by developing flight-ready, low-cost, Protoflight software defined radio (SDR) and Electronically Steerable Patch Array (ESPA) antenna subsystems for use on platforms as small as CubeSats and unmanned aircraft systems (UASs). The current telemetry system is slightly larger in dimension of footprint than required to fit within a 0.5U CubeSat volume. Extensible and modular communications for CubeSat technologies will partially mitigate current capability gaps between traditional strategic space platforms and lower-cost small satellite solutions. Higher bandwidth capacity will enable high-volume, low error-rate data transfer to and from tactical forces or sensors operating in austere locations (e.g., direct imagery download, unattended ground sensor data exfiltration, interlink communications), while also providing additional bandwidth and error correction margin to accommodate more complex encryption algorithms and higher user volume.

Sims, William Herbert↗
NASA NTRS2015

Cyber Security: Big Data Think II Working Group Meeting

This presentation focuses on approaches that could be used by a data computation center to identify attacks and ensure malicious code and backdoors are identified if planted in system. The goal is to identify actionable security information from the mountain of data that flows into and out of an organization. The approaches are applicable to big data computational center and some must also use big data techniques to extract the actionable security information from the mountain of data that flows into and out of a data computational center. The briefing covers the detection of malicious delivery sites and techniques for reducing the mountain of data so that intrusion detection information can be useful, and not hidden in a plethora of false alerts. It also looks at the identification of possible unauthorized data exfiltration.

computer security↗
DOE OSTI2022

EVSE Cybersecurity and Resilience

Consequence-driven Cybersecurity Analysis for Extreme Fast Charging Electric Vehicle Infrastructure Electric vehicle (EV) development and associated charging infrastructure are expected to advance rapidly. Thirty percent of all global vehicle sales may be EVs and hybrid EVs by 2025, and they will rely on increasingly sophisticated strategies for grid integration. Next-generation EV charging infrastructure is expected to include interconnected renewable resources, such as photovoltaic (PV) arrays and battery storage systems, along with grid-edge devices. Although distributed energy resources (DERs) are useful in several ways, such as peak shaving at high demand times and backup supply for added resilience, the integration of vehicle charging and DERs could create more avenues for cyberattack. Physical and/or remote access to EV charging station components, including charge ports, power electronics, controllers, and local generation (e.g., PV and energy storage) could be paths to cause power fluctuations, leading to altered operations at the charging station, escalated privileges to administrative systems, exfiltration of financial information (including personally identifiable information), and reduced grid stability. One compromised EV supply equipment component can open the door to a variety of exploitable vulnerabilities. Cloud computing and mobile application control have the potential to expand the threat surface to non-repudiation and firmware integrity challenges. Vendor clouds have access to hundreds of chargers, and if compromised, can scale the attack surface exponentially. The high power and voltage levels of xFC infrastructure (e.g., 400 kW at 1000- V DC) increase the hazards and ability to impact the grid and vehicles more than lower-power charging systems. Legacy communications systems and protocols could also put EV infrastructure at risk of cyberattacks requiring a robust patch management process. Communications networks link EVs and chargers to several stakeholders - including charging station operators, grid operators, vendors/manufacturers, and aggregators - who have both physical and network access to share information for control, monitoring, and analytics. Information in these networks that is vulnerable to compromise includes the state of charge, charging duration, payment information, electricity price, and load control. Analyzing and prioritizing these interconnections risks could help address cybersecurity related to data leakage and manipulation.

charging↗