SEARCH · Engineering Papers
Results for “threat”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
DERIVING A FRAMEWORK FOR ?INSIDER RISK POTENTIAL? FROM USING ARTIFICIAL NEURAL NETWORKS FOR INSIDER THREAT DETECTION & MITIGATION.
Abstract not provided.
Electrically Small Antennas with Minimal Broadband Radio Frequency Threat Coupling.
Abstract not provided.
Regional Response Assets, DOE’s Radiological Assistance Program – Believe it or not? INL isn’t the region’s most likely threat
The Department of Energy (DOE) National Nuclear Security Administration's (NNSA) Region 6 Radiological Assistance Program (RAP) personnel respond out of Idaho National Laboratory (INL) based in Idaho Falls, Idaho. An overview of the RAP is presented describing the capabilities and related radiological response capabilities. Several recent radiological responses will be discussed to illustrate the capabilities of this national resource.
New Molecular Recognition-Based Nanoscale Sensor Platforms for Trace-Level Threat Detection
Explore the source record for details and available documents.
NASA Analysis of Space Mission Options for the 2025 Planetary Defense Conference Hypothetical Asteroid Impact Threat Scenario
Explore the source record for details and available documents.
Cyber-Physical Data Fusion & Threat Detection with LSTM-Based Autoencoders in the Grid
Explore the source record for details and available documents.
NASA Analysis of Space Mission Options for the 2025 Planetary Defense Conference Hypothetical Asteroid Impact Threat Scenario
Explore the source record for details and available documents.
Large Language Model (LLM) Driven Document Clustering: Improving Real time Security Intelligence Extraction and Threat Analysis
Explore the source record for details and available documents.
Testing the international mechanism for responding to an asteroid impact threat
Explore the source record for details and available documents.
Identifying Generational Shifts in Workplace Worldviews to Predict Changes in Insider Threat Likelihood, Risk, and Motivation
Explore the source record for details and available documents.
PoL Badge: Detecting Insider Threat Activities as well as Deviation from Workplace Patterns-of-Life (PoL) in Nuclear Reactor Facilities using Affordable Privacy-preserving Smart Badging
Explore the source record for details and available documents.
Mitigating the risk: Improving Insider Threat Mitigation, ensuring security of category 1 and 2 disused sealed radioactive sources during transport and lessons learned from implementation
Explore the source record for details and available documents.
Cyote-attack Chain Estimator
Attack Chain Estimator (ACE) Application Overview The Attack Chain Estimator (ACE) Application is a sophisticated tool designed for the ingestion, classification, sequencing, and enrichment of cybersecurity threat reports. This application leverages advanced machine learning models and extensive historical data to provide comprehensive insights into cyber threats, specifically targeting Industrial Control Systems (ICS). Purpose The primary functions of the ACE Application include: Ingestion of Cybersecurity Threat Reporting: Capable of ingesting text-based threat reports in markdown or text file format. Supports ingestion of structured data from other sources in STIX/JSON format. Classification of Report’s Text-Based Events: Utilizes a DeBERTa classifier, specifically trained on cybersecurity data, to map the events to MITRE ATT&CK for ICS Tactics and Techniques. Classification is performed using multiple Jupyter notebooks and machine learning workflows hosted as FastAPI microservices: regex_data deberta_base_35_train_hft_classifier_mlflow.ipynb hft_regex_classifier_mlflow.ipynb param_train_hft_classifier_mlflow.ipynb regex_tactic_tech.ipynb Ordering of Tactics, Techniques, and Observable Events: Sequences the identified tactics, techniques, and events to form a coherent attack chain. Enrichment with Historical Attack Chain Details: Enhances the attack chain with details from historical attacks using a Markov model developed from CyOTE Precursor Analysis Report data. The Markov model is available as a FastAPI endpoint for seamless integration. Enrichment with Adversary Emulation Capabilities Data: Integrates adversary emulation capabilities data using MITRE Caldera for OT adversary abilities UUIDs. Export of Output Files: Provides options to export the enriched attack chain in JSON or CSV formats. Routing of Output to Other Applications: Facilitates routing of output to various platforms and applications, including: Threat Intelligence Platforms COREII Scout for Threat Intelligence Analysis COREII Modeling and Simulation for Adversary Emulation Technical Description The ACE Application is an advanced cybersecurity tool designed to provide detailed threat analysis and sequence generation. It is built on a robust architecture that integrates natural language processing, machine learning, and historical data modeling. Key Components: Data Ingestion Module: Handles the input of threat reports and data from various formats, ensuring flexibility in data sources. Classification Engine: Employs DeBERTa-based classifiers hosted as FastAPI microservices to analyze and classify threat report events in accordance with the MITRE ATT&CK framework for ICS. Sequence Generator: Orders the classified events into a logical attack chain, providing clear insight into the sequence of tactics and techniques used in the threat. Enrichment Engine: Integrates historical data and adversary emulation capabilities to enhance the attack chain with valuable context and additional details. The historical data enrichment is powered by a Markov model, which is available as a FastAPI endpoint. Export and Routing Module: Facilitates the export of the enriched attack chain in multiple formats and routes the output to designated applications for further analysis or emulation.
"Russians in the Grid" Enrichment Process
Threat intelligence sources are numerous, and the quality of their intelligence is equally variable. The need for quality, actionable, and shareable intelligence is becoming increasingly important as cyber-threats continue to increase. In this paper, we describe the process we used to enrich U.S. CERT’s Technical Alert entitled “Russian Government Cyber-Activity Targeting Energy and Other Critical Infrastructure Sectors,” affectionately referred to as “Russians In the Grid,” from a series of separate but related reports to a final, actionable, unified Structured Threat Information Expression (STIX) v2 representation of the report. In the process, we detail the tools and procedures we used, some of which are automated and others highly manual. We identify some of the limitations of current STIX enrichment tools and techniques, and propose enhancements to allow for more effective enrichment and better overall threat intelligence to be used for more effective threat data-sharing, as well as machine learning-based predictive threat work being conducted at Idaho National Laboratory.
Defensive Cybersecurity Architecture Design Using Force-on-Force Cyber-Physical Modeling
Currently, nuclear power plant physical security systems are highly dependent on air-gaps as a protective measure against cyber-threats. Cyber-physical threats become more likely as advanced cyber-threat capabilities to jump air-gaps transition into common use. Defending against the emerging threat of cyber-enabled physical intrusions is poorly understood. The consequence of these cyber-physical attacks has no quantitative analysis method to inform risk-informed, performance-based cybersecurity approaches. By modifying the physical security simulation tool Dante, cyber-physical threat consequence was able to be analyzed on a notional facility. The results of this analysis are used to design a Defensive Cybersecurity Architecture (DCSA) for the physical security system to produce example resilience measures for this notional facility. A DCSA defines security levels to provide a graded approach for defending plant functions, and security zones for trusted communication between systems. This approach can be applied to real world systems to produce physical protection systems and response measures that are resilient to cyber-physical threats.
SURVEILLANCE DETECTION FOR TRANSPORTATION OPERATIONS PERSONNEL TO PREVENT HIJACKING, THEFT, SABOTAGE, AND MALICIOUS SECURITY EVENTS DURING TRANSPORTING NUCLEAR MATERIAL
The secure transportation of high-consequence materials, including nuclear and radiological assets, is a critical global priority in the face of escalating terrorism, security threats, and violent protests targeting these operations. Effective surveillance detection—the ability to identify, assess, and respond to potential threats across a continuum of scenarios—is paramount in addressing these challenges. This paper outlines a phased, multi-tiered training program designed to strengthen the surveillance detection capabilities of organizations responsible for nuclear material transport. The proposed training program adopts a progressive approach, gradually increasing in technical complexity to provide participants with comprehensive knowledge and tools for implementing robust security strategies. It targets a wide spectrum of stakeholders, including competent authorities, regulators, inspectors, shippers, carriers, law enforcement, and emergency response personnel, equipping them to plan, evaluate, and safeguard nuclear material transportation effectively. Each phase of the program emphasizes distinct elements of the surveillance detection continuum and transport security, focusing on critical topics such as threat identification, adversary task timelines, protective methodologies, and attack mitigation strategies. The training framework is anchored in technical exchanges and scenario-driven courses that reflect real-world complexities and challenges. By addressing the surveillance detection continuum comprehensively—from early threat assessment to active countermeasures—the program reinforces global efforts to secure nuclear assets. It aligns with international security objectives and fosters a strong security culture within participating organizations, ensuring personnel are prepared to counter potential threats and maintain the safe, secure movement of these materials. Ultimately, this initiative aims to enhance preparedness, security, and response capabilities, supporting the global mission to safeguard high-consequence materials against evolving threats.
Health Analysis and Research for Public Events (HARPE) Tool (Final CRADA Report)
Based on its experience in building assessment tools, Argonne National Laboratory (Argonne) has demonstrated expertise in developing comparative methodologies and question sets that provide both a physical and cyber-based risk assessment for the commercial facilities sector. A high-level risk assessment tool can be beneficial for venues and organizations that fall under a wide array of facility characterizations, ultimately accommodating the evolving landscape of threats specific to these facilities. The Health Analysis and Research for Public Events (HARPE) Tool is an assessment that seeks to help facility managers assess and mitigate aspects of safety, security, and emergency management within their venues. With the pandemic featuring prominently in today’s landscape, we have adapted and extended the scope of the HARPE tool so that it offers users the ability to integrate assessments of their preparation for, response to, and recovery from threats faced at the venue arising from the COVID-19 pandemic. Traditional threats and hazards remain prevalent in today’s landscape, and the best defense is a proactive approach to preventing and mitigating these threats. At the very core of prevention and mitigation is the first step of conducting a risk assessment—this is the gap that HARPE fills. While it is obvious that the response to COVID-19 is health and sanitation driven, leaders within the commercial facilities sector must also know where to best extend their efforts in mitigating future threats arising from the pandemic. Public events and mass gatherings are directly impacted by COVID-19; however, with the help of HARPE, leaders can focus their attention on core impact areas related to the safety and security of returning to a new normal, as they assess their risks using the Argonne-developed tool. HARPE provides an important solution to the COVID-19 situation by assisting venue managers and health officials in identifying their risks.