Search NASA⌕ Search

SEARCH · Search NASA

Results for “intrusion detection systems”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records
All sourcesNASA NTRSDOE OSTI
NASA NTRS1980

Passive intrusion detection system

An intrusion detection system is described in which crystal oscillators are used to provide a frequency which varies as a function of fluctuations of a particular environmental property of the atmosphere, e.g., humidity, in the protected volume. The system is based on the discovery that the frequency of an oscillator whose crystal is humidity sensitive, varies at a frequency or rate which is within a known frequency band, due to the entry of an intruder into the protected volume. The variable frequency is converted into a voltage which is then filtered by a filtering arrangement which permits only voltage variations at frequencies within the known frequency band to activate an alarm, while inhibiting the alarm activation when the voltage frequency is below or above the known frequency band.

Laue, E. G.↗
NASA NTRS2002

Intrusion detection: systems and models

This paper puts forward a review of state of the art and state of the applicability of intrusion detection systems, and models. The paper also presents a classfication of literature pertaining to intrusion detection.

intrusion detection risk security↗
NASA NTRSDate not supplied

Cyber Resiliency and the Implementation of a Host-Based Intrusion Detection System in an Urban Air Mobility Environment

With the growth in urban air mobility systems and the increasing reliance on interconnected technologies, ensuring the security of these complex infrastructures has become critical. As cities evolve into smart urban centers, the vulnerability to cyber threats escalates, possibly endangering citizens’ safety and the efficiency of transportation networks. In response to these challenges, this paper presents a study on implementing a Host-Based Intrusion Detection System (HIDS) tailored explicitly to urban mobility environments’ unique demands. This study explores the design, development, and deployment of the proposed HIDS, focusing on its adaptability to monitor the hybrid nature of the urban mobility environment. Leveraging machine learning algorithms and anomaly detection techniques, the HIDS is equipped to continuously monitor and analyze the behavior of individual host systems, vehicles, and devices, thereby providing a proactive approach to threat detection. Implementing a HIDS is a pivotal strategy for enhancing cyber resiliency, as it gives an organization granular visibility into internal system activities, enables rapid detection and response to anomalous behavior and cyber threats, and fortifies the organization’s overall cybersecurity posture. In conclusion, this paper highlights the significance of host-based intrusion detection in urban mobility environments and underscores the necessity of tailored security solutions to safeguard against emerging cyber threats.

UAM↗
NASA NTRSDate not supplied

Cyber Resiliency and the Implementation of a Host-Based Intrusion Detection System in an Urban Air Mobility Environment

With the growth in Urban Air Mobility systems and the increasing reliance on interconnected technologies, ensuring the security of these complex components has become critical. As cities evolve into smart urban centers, the vulnerability to cyber threats escalates, possibly endangering citizens safety and the efficiency of transportation networks.In response to these challenges, this paper presents a study on the need for cyber resilient techniques within future air traffic environments. It will pay specific attention to the implementation of a Host-Based Intrusion Detection System (HIDS) utilizing Atomic OSSEC software, tailored specifically to a NASA simulation of an UrbanAirMobility environments’ unique demands. Further, this study seeks to outline the rational for NASA’s recommendation for a HIDS in such environments. It explores the design, development, and deployment of the proposed HIDS, focusing on its adaptability to monitor the hybrid nature of the Urban Air Mobility environment. Leveraging machine learning algorithms and anomaly detection techniques, the HIDS is equipped to continuously monitor and analyze the behavior of individual host systems, vehicles, and devices, thereby providing a proactive approach to threat detection. Implementing a HIDS is a pivotal strategy for enhancing cyber resiliency, as it gives an organization granular visibility into internal system activities, enables rapid detection and response to anomalous behavior and cyber threats, and fortifies the organizations overall cybersecurity posture. Finally, this study aims to provide recommendations and include learned takeaways that the Urban Air Mobility industry should consider. In brief, this paper highlights the significance of host-based intrusion detection in UrbanAirMobility environments and underscores the necessity of tailored security solutions to safeguard against emerging cyber threats.

UAM↗
NASA NTRSDate not supplied

Cybersecurity - Host-based Intrusion Detection Systems (HIDS)

Given a set of flight trajectories, can we classify the trajectories that do not follow a normal path? By identifying abnormal trajectories, further analysis can be done to determine the reasoning for these actions. Addressing these scenarios can bring possible solutions for holding and rerouting problems when its time to incorporate UAM in the airspace.

DFR↗
NASA NTRS2004

Addressing software security and mitigations in the life cycle

Traditionally, security is viewed as an organizational and Information Technology (IT) systems function comprising of firewalls, intrusion detection systems (IDS), system security settings and patches to the operating system (OS) and applications running on it. Until recently, little thought has been given to the importance of security as a formal approach in the software life cycle. The Jet Propulsion Laboratory has approached the problem through the development of an integrated formal Software Security Assessment Instrument (SSAI) with six foci for the software life cycle.

model checking↗
NASA NTRS2003

Addressing software security and mitigations in the life cycle

Traditionally, security is viewed as an organizational and Information Technology (IIJ systems function comprising of Firewalls, intrusion detection systems (IDS), system security settings and patches to the operating system (OS) and applications running on it. Until recently, little thought has been given to the importance of security as a formal approach in the software life cycle. The Jet Propulsion Laboratory has approached the problem through the development of an integrated formal Software Security Assessment Instrument (SSAI) with six foci for the software life cycle.

formal methods↗
NASA NTRS2013

Detecting Distributed SQL Injection Attacks in a Eucalyptus Cloud Environment

The cloud computing environment offers malicious users the ability to spawn multiple instances of cloud nodes that are similar to virtual machines, except that they can have separate external IP addresses. In this paper we demonstrate how this ability can be exploited by an attacker to distribute his/her attack, in particular SQL injection attacks, in such a way that an intrusion detection system (IDS) could fail to identify this attack. To demonstrate this, we set up a small private cloud, established a vulnerable website in one instance, and placed an IDS within the cloud to monitor the network traffic. We found that an attacker could quite easily defeat the IDS by periodically altering its IP address. To detect such an attacker, we propose to use multi-agent plan recognition, where the multiple source IPs are considered as different agents who are mounting a collaborative attack. We show that such a formulation of this problem yields a more sophisticated approach to detecting SQL injection attacks within a cloud computing environment.

Kebert, Alan↗
NASA NTRS2001

Adapting safety requirements analysis to intrusion detection

Several requirements analysis techniques widely used in safety-critical systems are being adapted to support the analysis of secure systems. Perhaps the most relevant system safety techique for Intrusion Detection Systems is hazard analysis.

requirements analysis safety intrusion detection↗
NASA NTRS2002

Speaking Volumes About 3-D

In 1999, Genex submitted a proposal to Stennis Space Center for a volumetric 3-D display technique that would provide multiple users with a 360-degree perspective to simultaneously view and analyze 3-D data. The futuristic capabilities of the VolumeViewer(R) have offered tremendous benefits to commercial users in the fields of medicine and surgery, air traffic control, pilot training and education, computer-aided design/computer-aided manufacturing, and military/battlefield management. The technology has also helped NASA to better analyze and assess the various data collected by its satellite and spacecraft sensors. Genex capitalized on its success with Stennis by introducing two separate products to the commercial market that incorporate key elements of the 3-D display technology designed under an SBIR contract. The company Rainbow 3D(R) imaging camera is a novel, three-dimensional surface profile measurement system that can obtain a full-frame 3-D image in less than 1 second. The third product is the 360-degree OmniEye(R) video system. Ideal for intrusion detection, surveillance, and situation management, this unique camera system offers a continuous, panoramic view of a scene in real time.

Source record↗
NASA NTRS1983

Scanning seismic intrusion detection method and apparatus

An intrusion monitoring system includes an array of seismic sensors, such as geophones, arranged along a perimeter to be monitored for unauthorized intrusion as by surface movement or tunneling. Two wires lead from each sensor to a central monitoring station. The central monitoring station has three modes of operation. In a first mode of operation, the output of all of the seismic sensors is summed into a receiver for amplification and detection. When the amplitude of the summed signals exceeds a certain predetermined threshold value an alarm is sounded. In a second mode of operation, the individual output signals from the sensors are multiplexed into the receiver for sequentially interrogating each of the sensors.

Lee, R. D.↗
NASA NTRS2012

Towards Reliable Evaluation of Anomaly-Based Intrusion Detection Performance

This report describes the results of research into the effects of environment-induced noise on the evaluation process for anomaly detectors in the cyber security domain. This research was conducted during a 10-week summer internship program from the 19th of August, 2012 to the 23rd of August, 2012 at the Jet Propulsion Laboratory in Pasadena, California. The research performed lies within the larger context of the Los Angeles Department of Water and Power (LADWP) Smart Grid cyber security project, a Department of Energy (DoE) funded effort involving the Jet Propulsion Laboratory, California Institute of Technology and the University of Southern California/ Information Sciences Institute. The results of the present effort constitute an important contribution towards building more rigorous evaluation paradigms for anomaly-based intrusion detectors in complex cyber physical systems such as the Smart Grid. Anomaly detection is a key strategy for cyber intrusion detection and operates by identifying deviations from profiles of nominal behavior and are thus conceptually appealing for detecting "novel" attacks. Evaluating the performance of such a detector requires assessing: (a) how well it captures the model of nominal behavior, and (b) how well it detects attacks (deviations from normality). Current evaluation methods produce results that give insufficient insight into the operation of a detector, inevitably resulting in a significantly poor characterization of a detectors performance. In this work, we first describe a preliminary taxonomy of key evaluation constructs that are necessary for establishing rigor in the evaluation regime of an anomaly detector. We then focus on clarifying the impact of the operational environment on the manifestation of attacks in monitored data. We show how dynamic and evolving environments can introduce high variability into the data stream perturbing detector performance. Prior research has focused on understanding the impact of this variability in training data for anomaly detectors, but has ignored variability in the attack signal that will necessarily affect the evaluation results for such detectors. We posit that current evaluation strategies implicitly assume that attacks always manifest in a stable manner; we show that this assumption is wrong. We describe a simple experiment to demonstrate the effects of environmental noise on the manifestation of attacks in data and introduce the notion of attack manifestation stability. Finally, we argue that conclusions about detector performance will be unreliable and incomplete if the stability of attack manifestation is not accounted for in the evaluation strategy.

cyber defense↗
NASA NTRS2011

Clonal Selection Based Artificial Immune System for Generalized Pattern Recognition

The last two decades has seen a rapid increase in the application of AIS (Artificial Immune Systems) modeled after the human immune system to a wide range of areas including network intrusion detection, job shop scheduling, classification, pattern recognition, and robot control. JPL (Jet Propulsion Laboratory) has developed an integrated pattern recognition/classification system called AISLE (Artificial Immune System for Learning and Exploration) based on biologically inspired models of B-cell dynamics in the immune system. When used for unsupervised or supervised classification, the method scales linearly with the number of dimensions, has performance that is relatively independent of the total size of the dataset, and has been shown to perform as well as traditional clustering methods. When used for pattern recognition, the method efficiently isolates the appropriate matches in the data set. The paper presents the underlying structure of AISLE and the results from a number of experimental studies.

pattern recognition↗
NASA NTRS2002

Security in Full-Force

When fully developed for NASA, Vanguard Enforcer(TM) software-which emulates the activities of highly technical security system programmers, auditors, and administrators-was among the first intrusion detection programs to restrict human errors from affecting security, and to ensure the integrity of a computer's operating systems, as well as the protection of mission critical resources. Vanguard Enforcer was delivered in 1991 to Johnson Space Center and has been protecting systems and critical data there ever since. In August of 1999, NASA granted Vanguard exclusive rights to commercialize the Enforcer system for the private sector. In return, Vanguard continues to supply NASA with ongoing research, development, and support of Enforcer. The Vanguard Enforcer 4.2 is one of several surveillance technologies that make up the Vanguard Security Solutions line of products. Using a mainframe environment, Enforcer 4.2 achieves previously unattainable levels of automated security management.

Source record↗
NASA NTRS1990

Information Security and Integrity Systems

Viewgraphs from the Information Security and Integrity Systems seminar held at the University of Houston-Clear Lake on May 15-16, 1990 are presented. A tutorial on computer security is presented. The goals of this tutorial are the following: to review security requirements imposed by government and by common sense; to examine risk analysis methods to help keep sight of forest while in trees; to discuss the current hot topic of viruses (which will stay hot); to examine network security, now and in the next year to 30 years; to give a brief overview of encryption; to review protection methods in operating systems; to review database security problems; to review the Trusted Computer System Evaluation Criteria (Orange Book); to comment on formal verification methods; to consider new approaches (like intrusion detection and biometrics); to review the old, low tech, and still good solutions; and to give pointers to the literature and to where to get help. Other topics covered include security in software applications and development; risk management; trust: formal methods and associated techniques; secure distributed operating system and verification; trusted Ada; a conceptual model for supporting a B3+ dynamic multilevel security and integrity in the Ada runtime environment; and information intelligence sciences.

Source record↗
NASA NTRS2024

Cooperative and Non-Cooperative UAS Detection

This paper describes a system that enhances airspace situational awareness by detecting and identifying Unmanned Aerial Systems (UAS). This multi-domain solution tracks both cooperative scientific flights as well as non-cooperative intrusions from "bad actors." The system supports a critical push towards safety within NASA’s advanced air mobility mission. After surveying the existing technologies at Langley Research Center, the radar and visual systems were chosen for the primary and secondary detection mechanisms, respectively. These systems were tuned an upgraded to become more sensitive to UAS activity. Additionally, a Remote Identification receiver was procured and integrated into the flight surveillance system.

Lucas Barduson↗
NASA NTRS1993

Non-intrusive measurements in a rocket engine combustor

In recent years analytical tools to characterize combustor flow have been developed in order to support design. To facilitate anchoring of combustion related physical models and the CFD codes in which they are incorporated, considerable development and application of non-intrusive combustion diagnostic capabilities has occurred. Raman spectroscopy can be used to simultaneously detect all polyatomic molecules present in significant concentrations and to determine gas temperature. This is because all molecules possess a distinct temperature dependent Raman spectrum. A multi-point diagnostic system for non-intrusive temperature and species profiling in rocket engines has been developed at Rocketdyne. In the present effort, the system has been undergoing validation for application to rocket engine component testing. A 4 inch diameter windowed combustor with a coaxial gas-gas injector was chosen for this series of validation experiments. Initially an excimer-pumped tunable dye laser and later a solid state Nd-Yag laser served as excitation sources. The Raman signal was dispersed by a monochromator and detected by a gated, intensified Charged Coupled Device (CCD) array. Experiments were carried out prior to each series of hot fire tests to ensure that the Raman signal detected was due to a spontaneous rather than a stimulated Raman emission process. Over sixty hot fire tests were conducted during the first series of tests with the excimer/dye laser. All hot fire testing was at a mixture ratio of 0.5 and chamber pressures of approximately 100 and approximately 300 psia. The Raman spectra of hydrogen, water vapor and oxygen recorded during single element hot fire tests were reduced and analyzed. A significant achievement was the attainment of single shot Raman spectra in cold flow tests. Unfortunately, the single shot signal-to-noise ratio deteriorated to an unacceptable level during the hot fire testing. Attempts to obtain temperature data from the hydrogen Q1-branch profiles obtained in hot fire tests suggest that potentially complicating factors may render the approach of averaging data on the photodiode array invalid. A second series of hot fire tests was conducted with a 4 element coaxial injector using the Nd-Yag laser. A very compact and portable diagnostics set up was assembled for ease of alignment, relocation and flexibility. Measurements were made at several regions in the chamber in order to map concentration profiles. High spatial resolution and improved signal to noise characteristics were demonstrated.

Farhangi, S.↗