Search NASA⌕ Search

SEARCH · Search NASA

Results for “vulnerability detection”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records
All sourcesNASA NTRSDOE OSTI
NASA NTRS2010

Modeling Regular Replacement for String Constraint Solving

Bugs in user input sanitation of software systems often lead to vulnerabilities. Among them many are caused by improper use of regular replacement. This paper presents a precise modeling of various semantics of regular substitution, such as the declarative, finite, greedy, and reluctant, using finite state transducers (FST). By projecting an FST to its input/output tapes, we are able to solve atomic string constraints, which can be applied to both the forward and backward image computation in model checking and symbolic execution of text processing programs. We report several interesting discoveries, e.g., certain fragments of the general problem can be handled using less expressive deterministic FST. A compact representation of FST is implemented in SUSHI, a string constraint solver. It is applied to detecting vulnerabilities in web applications

Fu, Xiang↗
NASA NTRS2024

Freddie Software Security Patching

Software applications become more complicated over time as they depend on many third-party, open-source libraries. The Freddie Platform Services team actively improves software security by addressing software bugs and vulnerabilities that negatively impact software applications, especially those providing real-time operations and services for the federal partners and industries. In order to detect bugs and patch vulnerabilities in software development and maintenance cycles, an automated and systematic approach is needed. This document describes what bugs and vulnerabilities are, and how they can be detected by using static code analyzers and software composition analysis tools. Once vulnerabilities are detected, the patching approaches, such as upgrading direct and transitive dependencies and loading custom classes first, are presented together with their strengths and weaknesses. In addition, patching walkthrough, example code, lessons learned throughout the vulnerability patching process and the recommended practices are discussed.

Chok Fung Lai↗
NASA NTRS2011

Automated Test Case Generation for an Autopilot Requirement Prototype

Designing safety-critical automation with robust human interaction is a difficult task that is susceptible to a number of known Human-Automation Interaction (HAI) vulnerabilities. It is therefore essential to develop automated tools that provide support both in the design and rapid evaluation of such automation. The Automation Design and Evaluation Prototyping Toolset (ADEPT) enables the rapid development of an executable specification for automation behavior and user interaction. ADEPT supports a number of analysis capabilities, thus enabling the detection of HAI vulnerabilities early in the design process, when modifications are less costly. In this paper, we advocate the introduction of a new capability to model-based prototyping tools such as ADEPT. The new capability is based on symbolic execution that allows us to automatically generate quality test suites based on the system design. Symbolic execution is used to generate both user input and test oracles user input drives the testing of the system implementation, and test oracles ensure that the system behaves as designed. We present early results in the context of a component in the Autopilot system modeled in ADEPT, and discuss the challenges of test case generation in the HAI domain.

Giannakopoulou, Dimitra↗
NASA NTRSDate not supplied

Spaceborne Passive-Microwave Hail Detection: Global Climatologies, Validation, and Challenges Going Forward

In addition to the myriad threats that severe hailstorms pose to society, infrastructure and agriculture, severe hail is difficult to measure in situ, and surface-based hail reporting and detection methods are inconsistent and vulnerable to nonmeteorological biases. This motivates the use of spaceborne remote-sensing platforms to retrieve hail and construct climatologies in a globally uniform way. We have developed a hail detection algorithm that leverages the sensitivity of spaceborne passive-microwave radiometers to scattering by hail, particularly in the channels from 10 to 89 GHz. We use this retrieval to construct global passive-microwave climatologies of severe hail using the Tropical Rainfall Measuring Mission (TRMM) Microwave Imager (TMI), Global Precipitation Measurement Mission (GPM) Microwave Imager, Advanced Microwave Scanning Radiometer for EOS (AMSR-E), and Advanced Microwave Scanning Radiometer 2 (AMSR2) sensors and are working to extend into the pre-TRMM era to the Special Sensor Microwave Imager/Sounder (SSMI/(S)) data. Using coincident Global Precipitation Measurement (GPM) Ku-band precipitation radar, we assessed this retrieval and several others in the literature for their effectiveness and regional variability. We find that this retrieval, which leverages a signature in the Minimum 19-GHz polarization corrected temperature (PCT) combined with the 37-GHz PCT depression normalized by tropopause height constrains the radar reflectivity most tightly, and gives the least appearance of regional biases compared to other passive-microwave approaches in the literature. Satellite platforms offer consistent observations, even in remote, data-sparse, and oceanic regions that ground-based networks exclude. There are, however, potential disconnects between the processes identified aloft by the satellite and the resultant weather at the ground, leading to uncertainties in the retrievals that may propagate into satellite-based climatologies, particularly in the Tropics, where there are abundant strong - but not necessarily hailing - storms that are strongly represented in the current satellite climatologies. We will discuss ongoing efforts to assess and mitigate the contributing factors to these uncertainties, chiefly among them the effects of non-uniform beam filling in the passive-microwave footprint, and the relationships between the size distributions of hailstones aloft and the dynamic processes and environments with which they interact throughout their trajectories.

Sarah D. Bang↗
NASA NTRS2010

Automatic Review of Abstract State Machines by Meta Property Verification

A model review is a validation technique aimed at determining if a model is of sufficient quality and allows defects to be identified early in the system development, reducing the cost of fixing them. In this paper we propose a technique to perform automatic review of Abstract State Machine (ASM) formal specifications. We first detect a family of typical vulnerabilities and defects a developer can introduce during the modeling activity using the ASMs and we express such faults as the violation of meta-properties that guarantee certain quality attributes of the specification. These meta-properties are then mapped to temporal logic formulas and model checked for their violation. As a proof of concept, we also report the result of applying this ASM review process to several specifications.

Arcaini, Paolo↗
NASA NTRS1998

Verification and Quantification of Single Event Effects on High Speed SRAM in Terrestrial Environments

As integrated circuits become more sensitive to charged particles and neutrons, anomalous performance due to single event effects (SEE) is a concern and requires experimental verification and quantification. The Center for Applied Radiation Research (CARR) at Prairie View A&M University has developed experiments as a participant in the NASA ER-2 Flight Program, the APEX balloon flight program and the Student Launch Program. Other high altitude and ground level experiments of interest to DoD and commercial applications are being developed. The experiment characterizes the SEE behavior of high speed and high density SRAM's. The system includes a PC-104 computer unit, an optical drive for storage, a test board with the components under test, and a latchup detection and reset unit. The test program will continuously monitor the stored checkerboard data pattern in the SW and record errors. Since both the computer and the optical drive contain integrated circuits, they are also vulnerable to radiation effects. A latchup detection unit with discrete components will monitor the test program and reset the system when necessary. The first results will be obtained from the NASA ER-2 flights, which are now planned to take place in early 1998 from Dryden Research Center in California. The series of flights, at altitudes up to 70,000 feet, and a variety of flight profiles should yield a distribution of conditions for correlating SEES. SEE measurements will be performed from the time of aircraft power-up on the ground throughout the flight regime until systems power-off after landing.

Huff, H.↗
NASA NTRS1997

Electrical alternans during rest and exercise as predictors of vulnerability to ventricular arrhythmias

This investigation was performed to evaluate the feasibility of detecting repolarization alternans with the heart rate elevated with a bicycle exercise protocol. Sensitive spectral signal-processing techniques are able to detect beat-to-beat alternation of the amplitude of the T wave, which is not visible on standard electrocardiogram. Previous animal and human investigations using atrial or ventricular pacing have demonstrated that T-wave alternans is a marker of vulnerability to ventricular arrhythmias. Using a spectral analysis technique incorporating noise reduction signal-processing software, we evaluated electrical alternans at rest and with the heart rate elevated during a bicycle exercise protocol. In this study we defined optimal criteria for electrical alternans to separate patients from those without inducible arrhythmias. Alternans and signal-averaged electrocardiographic results were compared with the results of vulnerability to ventricular arrhythmias as defined by induction of sustained ventricular tachycardia or fibrillation at electrophysiologic evaluation. In 27 patients alternans recorded at rest and with exercise had a sensitivity of 89%, specificity of 75%, and overall clinical accuracy of 80% (p <0.003). In this patient population the signal-averaged electrocardiogram was not a significant predictor of arrhythmia vulnerability. This is the first study to report that repolarization alternans can be detected with heart rate elevated with a bicycle exercise protocol. Alternans measured using this technique is an accurate predictor of arrhythmia inducibility.

Clinical Trial↗
NASA NTRS2023

Plant Disease Detection: Exploring Applications in Hyperspectral Imaging and Machine Learning for Agriculture

The threat of crop disease on food security and agriculture is projected to escalate, leading to reduced crop yields, global economic loss, and endangered food availability to vulnerable populations. Early identification of plant disease is crucial to combatting the crisis but traditional manual methods for disease detection are laborious and may miss early signs of infection. The proposed solution suggests equipping a drone with a hyperspectral camera to collect images and analyzing the data with neural networks trained to flag and classify infected plants. This approach offers a faster, more accurate, and potentially more cost-effective alternative to current practices. While the expensive and complex nature of hyperspectral imaging (HSI) may be an obstacle to the adoption of the drone, rapidly advancing technologies compounded with rental-based usage may make these tools simpler, cheaper, and more accessible to a wider audience. The research further discusses the potential for automated flight paths and the expansion of disease detection to a broader range of crops.

plant disease detection↗
NASA NTRS2013

Detecting Distributed SQL Injection Attacks in a Eucalyptus Cloud Environment

The cloud computing environment offers malicious users the ability to spawn multiple instances of cloud nodes that are similar to virtual machines, except that they can have separate external IP addresses. In this paper we demonstrate how this ability can be exploited by an attacker to distribute his/her attack, in particular SQL injection attacks, in such a way that an intrusion detection system (IDS) could fail to identify this attack. To demonstrate this, we set up a small private cloud, established a vulnerable website in one instance, and placed an IDS within the cloud to monitor the network traffic. We found that an attacker could quite easily defeat the IDS by periodically altering its IP address. To detect such an attacker, we propose to use multi-agent plan recognition, where the multiple source IPs are considered as different agents who are mounting a collaborative attack. We show that such a formulation of this problem yields a more sophisticated approach to detecting SQL injection attacks within a cloud computing environment.

Kebert, Alan↗
NASA NTRSDate not supplied

Unsupervised Anomaly Detection in High-Dimensional Flight Data Using Convolutional Variational Auto-Encoder

The modern National Airspace System (NAS) is an extremely safe system. The industry has experienced a steady decrease in fatalities over the years. This can be contributed to both improved flight critical systems with redundant hardware and software protections as well as an increased focus on active monitoring and response to real time and historically identified vulnerabilities by implementing more resilient procedures and protocols. The main practice for identifying vulnerabilities in operations leverages domain expertise using knowledge about how the system should behave with the expected tolerances to known safety margins. This approach works well when the system has a well-defined operating condition. However, the operations in the NAS can be highly complex with various nuances that render it difficult to clearly pre-define all known safety vulnerabilities. With the advancement of data science and machine learning techniques, the potential to automatically identify emerging vulnerabilities in the observed operations has become more practical in recent years. The state-of-the-art anomaly detection approaches in aerospace data usually rely on supervised or semi-supervised learning. However, in many real-world problems such as flight safety creating labels for the data requires huge amount of efforts and is largely expensive. As a result, in this article, we develop a Convolutional Variational Auto-Encoder (CVAE), an unsupervised learning approach for anomaly detection in high-dimensional heterogeneous time-series data. We validate performance of CVAE compared to the state-of-the-art supervised learning approach (as an upper bound) as well as an supervised clustering based on K-Means (as a lower bound) on Yahoo!'s benchmark time series anomaly detection data. Finally, we showcase performance of CVAE on a case study of identifying anomalies in the first 60 seconds of commercial flights' take-offs using Flight Operational Quality Assurance (FOQA) data.

Milad Memarzadeh↗
NASA NTRS2020

Unsupervised Anomaly Detection in High-Dimensional Flight Data Using Convolutional Variational Auto-Encoder

The modern National Airspace System (NAS) is an extremely safe system and the aviation industry has experienced a steady decrease in fatalities over the years. This can be attributed to both improved flight critical systems with redundant hardware and software protections, as well as an increased focus on active monitoring and response to real time and historically identified vulnerabilities by implementing more resilient procedures and protocols. The main approach for identifying vulnerabilities in operations leverages domain expertise using knowledge about how the system should behave within the expected tolerances to known safety margins. This approach works well when the system has a well-defined operating condition. However, the operations in the NAS can be highly complex with various nuances that render it difficult to clearly pre-define all known safety vulnerabilities. With the advancement of data science and machine learning techniques, the potential to automatically identify emerging vulnerabilities in the observed operations has become more practical in recent years. The state-of-the-art anomaly detection approaches in aerospace data usually rely on supervised or semi-supervised learning. However, in many real-world problems such as flight safety, creating labels for the data requires huge amount of effort and is largely impractical. To address this challenge, we developed a Convolutional Variational Auto-Encoder (CVAE), which is an unsupervised learning approach for anomaly detection in high-dimensional heterogeneous time-series data. We validate performance of CVAE compared to the state-of-the-art supervised learning approach as well as unsupervised clustering-based approach using KMeans++ and kernel-based approach using One-Class Support Vector Machine (OC-SVM) on Yahoo!'s benchmark time series anomaly detection data. Finally, we showcase performance of CVAE on a case study of identifying anomalies in the first 60 seconds of commercial flights' take-offs using Flight Operational Quality Assurance (FOQA) data.

Memarzadeh, Milad↗
NASA NTRS2005

NASA's Research in Aircraft Vulnerability Mitigation

Since its inception in 1958, the National Aeronautics and Space Administration s (NASA) role in civil aeronautics has been to develop high-risk, high-payoff technologies to meet critical national aviation challenges. Following the events of Sept. 11, 2001, NASA recognized that it now shared the responsibility for improving homeland security. The NASA Strategic Plan was modified to include requirements to enable a more secure air transportation system by investing in technologies and collaborating with other agencies, industry, and academia. NASA is conducting research to develop and advance innovative and commercially viable technologies that will reduce the vulnerability of aircraft to threats or hostile actions, and identify and inform users of potential vulnerabilities in a timely manner. Presented in this paper are research plans and preliminary status for mitigating the effects of damage due to direct attacks on civil transport aircraft. The NASA approach to mitigation includes: preventing loss of an aircraft due to a hit from man-portable air defense systems; developing fuel system technologies that prevent or minimize in-flight vulnerability to small arms or other projectiles; providing protection from electromagnetic energy attacks by detecting directed energy threats to aircraft and on/off-board systems; and minimizing the damage due to high-energy attacks (explosions and fire) by developing advanced lightweight, damage-resistant composites and structural concepts. An approach to preventing aircraft from being used as weapons of mass destruction will also be discussed.

Allen, Cheryl L.↗
NASA NTRS1987

Techniques for fire detection

An overview is given of the basis for an analysis of combustable materials and potential ignition sources in a spacecraft. First, the burning process is discussed in terms of the production of the fire signatures normally associated with detection devices. These include convected and radiated thermal energy, particulates, and gases. Second, the transport processes associated with the movement of these from the fire to the detector, along with the important phenomena which cause the level of these signatures to be reduced, are described. Third, the operating characteristics of the individual types of detectors which influence their response to signals, are presented. Finally, vulnerability analysis using predictive fire modeling techniques is discussed as a means to establish the necessary response of the detection system to provide the level of protection required in the application.

Bukowski, Richard W.↗
NASA NTRS2007

The Potential for Imaging in Situ Damage in Inflatable Space Structures

NASA is investigating the use of inflatable habitat structures for orbital transfer and planetary applications. Since space structures are vulnerable to damage from micrometeoroid and orbital debris, it is important to investigate means of detecting such damage. This study is an investigation into methods for performing non-destructive evaluation (NDE) on inflatable habitat modules. Results of this work showed that various electromagnetic imaging modalities from microwaves to terahertz imaging have the greatest potential for a viable, portable, NDE tool which could possibly be deployed aboard an inflatable habitat module.

Madaras, Eric I.↗
NASA NTRS2017

Qualitative Future Safety Risk Identification an Update

The purpose of this report is to document the results of a high-level qualitative study that was conducted to identify future aviation safety risks and to assess the potential impacts to the National Airspace System (NAS) of NASA Aviation Safety research on these risks. Multiple external sources (for example, the National Transportation Safety Board, the Flight Safety Foundation, the National Research Council, and the Joint Planning and Development Office) were used to develop a compilation of future safety issues risks, also referred to as future tall poles. The primary criterion used to identify the most critical future safety risk issues was that the issue must be cited in several of these sources as a safety area of concern. The tall poles in future safety risk, in no particular order of importance, are as follows: Runway Safety, Loss of Control In Flight, Icing Ice Detection, Loss of Separation, Near Midair Collision Human Fatigue, Increasing Complexity and Reliance on Automation, Vulnerability Discovery, Data Sharing and Dissemination, and Enhanced Survivability in the Event of an Accident.

future aviation safety risk↗
NASA NTRS2023

San Joaquin Valley Health & Air Quality: Evaluating the Overlap of Social Vulnerabilities and Air Quality in the San Joaquin Valley Air Pollution Control District

Little Manila Rising (LMR) is a nonprofit in Stockton, California that has been increasingly concerned by the air pollution in their city and the neighboring San Joaquin Valley (SJV). Geographical factors, climate conditions, and anthropogenic activities, such as agriculture burning and vehicle emissions, contribute to the high levels of air pollution in this region. To visualize the distribution of air pollution and social disparities across the SJV, LMR partnered with NASA DEVELOP. The DEVELOP team used Terra and Aqua MODIS, Sentinel-5P TROPOMI, and CALIPSO CALIOP to observe Aerosol Optical Depth (AOD), Nitrogen Dioxide (NO 2 ), and the vertical distribution of pollutants at varying pollution levels, respectively. Additionally, Suomi-NPP VIIRS provided active fire data. By leveraging NASA Earth observations along with sociodemographic and public health data, the DEVELOP team created maps identifying the areas experiencing the highest vulnerabilities and disparities in pollution exposure. The team found that AOD was slightly higher in agricultural regions, while NO 2 was consistently higher along transportation corridors and urban areas. Wildfires dominated the type of detected active fires, and there was high correlation (R 2 = 0.6924) between active fires and burn permits in agricultural tracts. Furthermore, the team identified both high AOD vulnerability and high NO 2 vulnerability in census tracts in South Stockton, an area that has been historically redlined and disinvested in, and where LMR resides. There was also a moderate correlation between air quality reported from the satellites and in-situ ground monitors. These results will support LMR’s organizing strategies for stricter enforcement of air pollution regulations and increased public health equity for community members.

Agricultural Fires↗
NASA NTRSDate not supplied

Cyber Resiliency and the Implementation of a Host-Based Intrusion Detection System in an Urban Air Mobility Environment

With the growth in urban air mobility systems and the increasing reliance on interconnected technologies, ensuring the security of these complex infrastructures has become critical. As cities evolve into smart urban centers, the vulnerability to cyber threats escalates, possibly endangering citizens’ safety and the efficiency of transportation networks. In response to these challenges, this paper presents a study on implementing a Host-Based Intrusion Detection System (HIDS) tailored explicitly to urban mobility environments’ unique demands. This study explores the design, development, and deployment of the proposed HIDS, focusing on its adaptability to monitor the hybrid nature of the urban mobility environment. Leveraging machine learning algorithms and anomaly detection techniques, the HIDS is equipped to continuously monitor and analyze the behavior of individual host systems, vehicles, and devices, thereby providing a proactive approach to threat detection. Implementing a HIDS is a pivotal strategy for enhancing cyber resiliency, as it gives an organization granular visibility into internal system activities, enables rapid detection and response to anomalous behavior and cyber threats, and fortifies the organization’s overall cybersecurity posture. In conclusion, this paper highlights the significance of host-based intrusion detection in urban mobility environments and underscores the necessity of tailored security solutions to safeguard against emerging cyber threats.

UAM↗