Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “data security defense”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 235 records · Page 13
All sourcesNASA NTRSDOE OSTI
DOE OSTI2026

Securing The Future: 2026 Manufacturing & Critical Infrastructure Threat Landscape

This report outlines the current state of manufacturing weaknesses introduced by the complexities of modern environments, including cloud services and Internet of Things (IoT) devices, with particular attention paid to the unique vulnerabilities encountered by SMMs. It also highlights CyManII’s strategic initiatives and collaborative solutions to mitigate these risks and strengthen the cybersecurity posture of the manufacturing ecosystem. Utilizing data from 2025 to inform forward-looking mitigation strategies, this report provides manufacturers with a clear understanding of both current and emerging cybersecurity threats, as well as practical opportunities to strengthen their cyber ecosystems. The following sections detail key vulnerabilities and threat vectors, along with actionable mitigation strategies, many of which have been developed or piloted through CyManII-led efforts. A thorough understanding of these risks and mitigation strategies is essential for manufacturers seeking to strengthen the security and resilience of their manufacturing operations.

3D Printing↗
DOE OSTI2025

Along-Trajectory Acoustic Signal Variations Observed During the Hypersonic Re-Entry of the OSIRIS-REx Sample Return Capsule

The re-entry of the Origins, Spectral Interpretation, Resource Identification, and Security-Regolith Explorer (OSIRIS-REx) sample return capsule (SRC) on 24 September 2023 presented a rare opportunity to study atmospheric entry dynamics through a dense network of ground-based infrasound sensors. As the first interplanetary capsule to re-enter over the United States since Stardust in 2006, this event allowed for unprecedented observations of infrasound signals generated during hypersonic descent. We deployed 39 single-sensor stations across Nevada and Utah, strategically distributed to capture signals from distinct trajectory points. Infrasound data were analyzed to examine how signal amplitude and period vary with altitude and propagation path for a nonablating hypersonic object with well-defined physical and aerodynamic properties. Raytracing simulations incorporated atmospheric specifications from the ground-2-space model to estimate source altitudes for observed signals. Results confirmed ballistic arrivals at all stations, with source altitudes ranging from 44 to 62 km along the trajectory. Signal period and amplitude exhibited strong dependence on source altitude, with higher altitudes corresponding to lower amplitudes, longer periods, and reduced high-frequency content. Regression analysis demonstrated strong correlations between signal characteristics and both altitude and propagation geometry. Our results suggest, when attenuation is considered, the amplitude is primarily determined by the source, with the propagation path playing a secondary role over the distances examined. These findings emphasize the utility of controlled SRC re-entries for advancing our understanding of natural meteoroid dynamics, refining atmospheric entry models, and improving methodologies for planetary defense. The OSIRIS-REx SRC campaign represents the most comprehensive infrasound study of a hypersonic re-entry to date, showcasing the potential of coordinated geophysical observational networks for high-energy atmospheric phenomena, including space debris re-entries.

58 GEOSCIENCES↗
DOE OSTI2025

Measurement of Close-in Ground Motion from an Underground Chemical Explosion

Understanding the geophysical response near an underground explosion is crucial for generating insights into the source and emplacement conditions that produce distinct observations in monitoring scenarios occurring at greater distances. Recently, Shot A of the Low Yield Nuclear Monitoring (LYNM) Physics Experiment 1 (PE1) series was conducted at the Nevada National Security Site to provide ground truth for subsurface explosion signal models. This experiment resulted in measuring near-source ground motion at distances ranging from 70 to 1000 m/kt with a 99% success rate, yielding high-fidelity knowledge of the near-field response that can serve as benchmarks for future numerical modeling and experiment planning. However, technical challenges exist in observing near-source phenomena while safeguarding sensitive data acquisition components from the detrimental effects of ground motion in the subsurface. This report outlines tools and techniques to address challenges associated with observing near-source accelerations and within the tunnel drift of the PE1 test bed. Additionally, we describe key systems designed with both modern advancements and legacy guidance to maximize the collection of high-quality ground motion data, which may be applied to constitutive and computational models, leading to new or improved understanding of the near- and far-field signals produced by underground explosions.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2015

Data Release Report for Source Physics Experiments 2 and 3 (SPE-2 and SPE-3) Nevada National Security Site

The second Source Physics Experiment shot (SPE-2) was conducted in Nevada on October 25, 2011, at 1900:00.011623 Greenwich Mean Time (GMT). The explosive source was 997 kilograms (kg) trinitrotoluene (TNT) equivalent of sensitized heavy ammonium fuel oil (SHANFO) detonated at a depth of 45.7 meters (m). The third Source Physics Experiment shot (SPE-3) was conducted in Nevada on July 24, 2012, at 1800:00.44835 GMT. The explosive source was 905 kg TNT equivalent of SHANFO detonated at a depth of 45.8 m. Both shots were recorded by an extensive set of instrumentation that includes sensors both at near-field (less than 100 m) and far-field (100 m or greater) distances. The near-field instruments consisted of three-component accelerometers deployed in boreholes at 15, 46, and 55 m depths around the shot and a set of single-component vertical accelerometers on the surface. The far-field network was composed of a variety of seismic and acoustic sensors, including short-period geophones, broadband seismometers, three-component accelerometers, and rotational seismometers at distances of 100 m to 25 kilometers. This report coincides with the release of these data for analysts and organizations that are not participants in this program. This report describes the second and third Source Physics Experiment shots and the various types of near-field and far-field data that are available.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Machine Learning Based Resilience Testing of an Address Randomization Cyber Defense

Moving target defenses (MTDs) are widely used as an active defense strategy for thwarting cyberattacks on cyber-physical systems by increasing diversity of software and network paths. Recently, machine Learning (ML) and deep Learning (DL) models have been demonstrated to defeat some of the cyber defenses by learning attack detection patterns and defense strategies. It raises concerns about the susceptibility of MTD to ML and DL methods. Here, in this article, we analyze the effectiveness of ML and DL models when it comes to deciphering MTD methods and ultimately evade MTD-based protections in real-time systems. Specifically, we consider a MTD algorithm that periodically randomizes address assignments within the MIL-STD-1553 protocol—a military standard serial data bus. Two ML and DL-based tasks are performed on MIL-STD-1553 protocol to measure the effectiveness of the learning models in deciphering the MTD algorithm: 1) determining whether there is an address assignments change i.e., whether the given system employs a MTD protocol and if it does 2) predicting the future address assignments. The supervised learning models (random forest and k-nearest neighbors) effectively detected the address assignment changes and classified whether the given system is equipped with a specified MTD protocol. On the other hand, the unsupervised learning model (K-means) was significantly less effective. The DL model (long short-term memory) was able to predict the future addresses with varied effectiveness based on MTD algorithm's settings.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2024

Deep Learning for Full Waveform Inversion of Elastic Active-Source Seismic Data to Estimate P-Wave Velocity Models

Seismic imaging methods are critical for Global Security and Energy & Homeland Security missions and activities that rely on subsurface characterization, but traditional methods remain computationally expensive and require significant labor hours and expertise to execute. Within the past few years, machine learning (ML), namely deep learning (DL), has been used to develop data-driven end-to-end full waveform inversion (FWI) methods to estimate 2D P-wave velocity (Vp) models in a fraction of the time as conventional FWI. These methods, however, are trained on simplistic acoustic wave seismic data and Vp models that are not realistic nor representative of real-world observations, leaving a large gap between the state-of-the-art and deployable, feasible, and practical DL FWI methods. Here, we generate a synthetic active-source, 3D, elastic wave seismic data set and a variety of Vp models with realistic geologic structure for training DL FWI methods. We evaluate six different methods that have performed well for acoustic DL FWI or medical imaging tasks using our more realistic dataset. We find that these six trained models do not match the performance of published acoustic end-to-end DL FWI methods, indicating more training data may be needed, physics may need to be incorporated to achieve good accuracy at the sacrifice of the end-to-end advantage, and/or novel methods need to be developed to enable end-to-end DL FWI methods to perform well for real-world seismic data.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Precursor Analysis Report: Doppelpaymer Ransomware Attack on Petroleos Mexicanos (PEMEX) 2019

The DoppelPaymer Ransomware Attack on Petroleos Mexicanos (PEMEX) 2019 Precursor Analysis Report leverages publicly available information about the PEMEX cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. The 2019 DoppelPaymer ransomware attack on PEMEX, Mexico’s nationalized petroleum corporation, highlights a unique threat that ransomware and cybercriminal extortion poses to Operational Technology (OT) environments in critical infrastructure. The incident began with an employee downloading commodity malware that allowed adversaries to gain initial access to PEMEX’s enterprise environment. After conducting privilege escalation, tool ingress, and data exfiltration, the adversaries deployed DoppelPaymer ransomware throughout the PEMEX enterprise environment, resulting in the company having to take dozens of systems offline for at least several days. Although PEMEX stated that their operations were not affected, the data exfiltrated from PEMEX was made available for download on DoppelPaymer’s leak site, as well as on other illicit criminal forums. This stolen data included not only company information, but also sensitive OT-specific configuration data. This incident showcases how cybercriminal exfiltration and posting of sensitive OT architecture documentation can pose security concerns for the targeted organization for years due to the long lifespan of OT assets and architectures. Researchers and analysts identified 18 unique techniques utilized during the attack with a total of 190 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Fifteen of the identified techniques used during the DoppelPaymer ransomware attack were precursors to the triggering event. Analysis identified 163 observables associated with these precursor techniques, 34 of which were assessed to have an increased likelihood of being perceived in the 60 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2016

Accomplishments in the Trident Laser Facility

Trident has been an extremely productive laser facility, despite its modest size and operating cost in the firmament of high-energy, high-power laser facilities worldwide. More than 150 peer-reviewed journal articles (in 39 different journals) have been published using Trident experimental data, many in high-impact journals such as Nature, Nature Physics, Nature Communications, and Physical Review Letters. More than 230 oral presentations involving research at Trident have been presented at national and international conferences. Trident publications have over 5000 citations in the literature with an h-index of 38. AT least 23 Los Alamos postdoctoral researchers have worked on Trident. In the period since its inception in 1992-2007, despite not issuing formal proposal calls for access nor functioning explicitly as a user facility until later, Trident has 170 unique users from more than 30 unique institutions, such as Los Alamos, Lawrence Livermore, and Sandia national laboratories, various University of California campuses, General Atomic, Imperial College, and Ecole Polytechnique. To reinforce its role as an important Los Alamos point of connection to the external research community, at least 20 PhD students did a significant fraction of their thesis work on Trident. Such PhD students include Mike Dunne (Imperial College, 1995) - now director of LCLS and professor at Stanford; David Hoarty (IC, 1997) - scientist at Atomic Weapons Establishment, UK; Dustin Froula (UC Davis, 2002) - Plasma and Ultrafast Physics Group leader at the Laboratory for Laser Energetics and assistant professor at the Physics and Astronomy Department at the University of Rochester; Tom Tierney (UC Irvine, 2002) - scientist at Los Alamos; Eric Loomis (Arizona State U., 2005) - scientist at Los Alamos; and Eliseo Gamboa (University of Michigan, 2013) - scientist at the Linac Coherent Light Source. The work performed on Trident, besides its scientific impact, has also supported the Inertial Confinement Fusion and Weapons research programs at the Laboratory. It also has advanced technologies and techniques that hold significant promise for Los Alamos initiatives, such as MaRIE (the proposed Matter-Radiation Interactions in Extremes experimental facility), and more generally for important societal applications, such as defense, global security, advanced accelerators, fusion energy, radiotherapy, and laser technology. Specific research contributions based on Trident experiments are listed below.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
NASA NTRS2011

Flying Unmanned Aircraft: A Pilot's Perspective

The National Aeronautics and Space Administration (NASA) is pioneering various Unmanned Aircraft System (UAS) technologies and procedures which may enable routine access to the National Airspace System (NAS), with an aim for Next Gen NAS. These tools will aid in the development of technologies and integrated capabilities that will enable high value missions for science, security, and defense, and open the door to low-cost, extreme-duration, stratospheric flight. A century of aviation evolution has resulted in accepted standards and best practices in the design of human-machine interfaces, the displays and controls of which serve to optimize safe and efficient flight operations and situational awareness. The current proliferation of non-standard, aircraft-specific flight crew interfaces in UAS, coupled with the inherent limitations of operating UAS without in-situ sensory input and feedback (aural, visual, and vestibular cues), has increased the risk of mishaps associated with the design of the "cockpit." The examples of current non- or sub- standard design features range from "annoying" and "inefficient", to those that are difficult to manipulate or interpret in a timely manner, as well as to those that are "burdensome" and "unsafe." A concerted effort is required to establish best practices and standards for the human-machine interfaces, for the pilot as well as the air traffic controller. In addition, roles, responsibilities, knowledge, and skill sets are subject to redefining the terms, "pilot" and "air traffic controller", with respect to operating UAS, especially in the Next-Gen NAS. The knowledge, skill sets, training, and qualification standards for UAS operations must be established, and reflect the aircraft-specific human-machine interfaces and control methods. NASA s recent experiences flying its MQ-9 Ikhana in the NAS for extended duration, has enabled both NASA and the FAA to realize the full potential for UAS, as well as understand the implications of current limitations. Ikhana is a Predator-B/Reaper UAS, built by General Atomics, Aeronautical Systems, Inc., and modified for research. Since 2007, the aircraft has been flown seasonally with a wing-mounted pod containing an infrared scanner, utilized to provide real-time wildfire geo-location data to various fire-fighting agencies in the western U.S. The multi-agency effort included an extensive process to obtain flight clearance from the FAA to operate under special provisions, given that UAS in general do not fully comply with current airspace regulations (e.g. sense-and-avoid requirements).

Pestana, Mark E.↗
NASA NTRS2019

Development of a Point of Care Technology for Military Medical Applications in Austere Environments

NASA, Lawrence Livermore National Laboratory (LLNL) and the Department of Defense (DoD) share a common interest in compact medical diagnostic technologies—also known as “point of care testing” (POCT) technologies. For NASA, the need is to take care of astronauts on deep space missions. For LLNL, the focus is on technologies needed to support homeland security applications. For DoD, the need is to support warfighters in military theaters of operation, especially for prolonged field care and en route care. A recently patented technology, “Portable Medical Diagnosis Instrument” (U.S. Patent 9824870), co-invented by NASA and LLNL, is being developed further in a partnership between NASA, LLNL and Travis Air Force Base, with a focus on military applications. This instrument, the NASA-LLNL Medical Tricorder, can be used for a wide range of clinical samples including breath, saliva and blood. One component of the Tricorder is the NASA E-Nose, a carbon nanotube-based chemical sensor, integrated into a hand-held smart phone, that can detect and measure “breath biomarkers” in the gas phase of exhaled breath. The response of the NASA E-Nose is rapid, which makes it possible to detect various gas-phase substances in real time. The NASA E-Nose, with modification, can also be used for breath condensate analysis. Another component of the Tricorder is a miniaturized microfluidic analyzer, under development by LLNL, that does not require any pumps. The microfluidic analyzer can detect and measure biomarkers in liquid samples, such as blood, saliva and breath condensate. This microfluidic system requires small quantities of liquid sample and can perform analysis very rapidly (seconds to minutes), which makes it possible to detect relevant biomarkers in near real time in the field. The Clinical Investigation Facility (CIF) at Travis Air Force Base is currently conducting research with the goal to develop improved field-able technologies and procedures for the emergency response to life threatening injuries soldiers may receive in theater. This work includes experimental large animal systems and comprehensive collection of clinical specimens and physiological data. NASA and LLNL are partnering with Travis to test and further develop the Tricorder technology for high priority military applications, initially focused on lung injury models and traumatic brain injury.

Loftus, David J.↗
DOE OSTI2025

Draft Prototype Microreactor Transportation Safety Program

Microreactors are compact reactors capable of producing less than 50 megawatts of electrical energy. Typically, these reactors are factory-fabricated and designed to be easily transportable by truck, rail, vessel, or air. Microreactor designs often assume that the unit can be transported containing either unirradiated or irradiated fuel. The interest in microreactors is driven by several factors, including the need to generate power on at remote locations, at military installations, at facilities such as data centers, and in areas recovering from natural disasters. The U.S. Department of Defense is actively pursuing the microreactor concept to meet the increasing energy demands of military operations that require portable and dense power sources. Commercial vendors are also exploring microreactor concepts. The report Microreactor Transportation Emergency Planning Challenges (Maheras et al. 2024) outlined the emergency planning challenges associated with the transportation of microreactors by road, rail, and by barge/ship. The successful commercial deployment and redeployment of microreactors will also require the development of microreactor transportation safety programs. The elements in these safety programs are not specific to microreactors; however, the transport of microreactors may pose unique challenges in these areas. This report builds on the report Microreactor Transportation Emergency Planning Challenges (Maheras et al. 2024) and develops the elements of a prototype microreactor transportation safety program that describes the elements that should be contained vendor-developed microreactor transportation safety programs, identifying the unique elements associated with microreactor transport. This will provide vendors and their transportation contractors a basis for their transportation planning and will accelerate the commercial deployment and redeployment of microreactors by identifying those issues unique to microreactor transport. The emphasis of this report is on highway transport of microreactors. This is based on a U.S. Nuclear Regulatory Commission transportation package approval strategy of crawl-walk-run, where transport by highway is evaluated first (Coles et al. 2021, 2024, Maheras et al. 2021), then other surface modes (rail and barge/ship), and finally air transport. Evaluation of maritime transport of microreactors was recently initiated (Rigato et al. 2024, Maheras et al. 2025). The report first discusses microreactors in general and microreactor transportation safety program planning assumptions. The report then provides a description of the transportation safety planning process and provides an extensive discussion of the elements of transportation safety programs. Specific elements examined included transportation roles and responsibilities, transportation planning, transportation mode and route selection, carrier selection, transportation packaging, advance notification of shipments, public information and communications, emergency response plans and procedures, inspections, security, safe parking, shipment tracking, weather and road conditions, medical preparedness, training and exercises, and program evaluation. The report then identifies the unique elements of a transportation safety program associated with microreactor transport. These unique elements were in the areas of: the unusual nature of microreactor designs, compensatory measures, increased radiation dose rates in the vicinity of microreactors, transportation package approval versus 10 CFR 50.59, and the use of a risk-informed transportation package approval process.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
NASA NTRS2016

UAS-NAS Flight Test Series 3: Test Environment Report

The desire and ability to fly Unmanned Aircraft Systems (UAS) in the National Airspace System (NAS) is of increasing urgency. The application of unmanned aircraft to perform national security, defense, scientific, and emergency management are driving the critical need for less restrictive access by UAS to the NAS. UAS represent a new capability that will provide a variety of services in the government (public) and commercial (civil) aviation sectors. The growth of this potential industry has not yet been realized due to the lack of a common understanding of what is required to safely operate UAS in the NAS. NASA's UAS Integration in the NAS Project is conducting research in the areas of Separation Assurance/Sense and Avoid Interoperability (SSI), Human Systems Integration (HSI), and Communications (Comm), and Certification to support reducing the barriers of UAS access to the NAS. This research is broken into two research themes namely, UAS Integration and Test Infrastructure. UAS Integration focuses on airspace integration procedures and performance standards to enable UAS integration in the air transportation system, covering Detect and Avoid (DAA) performance standards, command and control performance standards, and human systems integration. The focus of Test Infrastructure is to enable development and validation of airspace integration procedures and performance standards, including integrated test and evaluation. In support of the integrated test and evaluation efforts, the Project will develop an adaptable, scalable, and schedulable relevant test environment capable of evaluating concepts and technologies for unmanned aircraft systems to safely operate in the NAS. To accomplish this task, the Project is conducting a series of human-in-the-loop (HITL) and flight test activities that integrate key concepts, technologies and/or procedures in a relevant air traffic environment. Each of the integrated events will build on the technical achievements, fidelity, and complexity of the previous tests and technical simulations, resulting in research findings that support the development of regulations governing the access of UAS into the NAS. The integrated events started with two initial flight test used to develop and test early integrations and components of the test environment. Test subjects and a relevant test environment were brought in for the integrated HITL (or IHITL) conducted in 2014. The IHITL collected data to evaluate the effectiveness of DAA Well Clear (DWC) algorithms and the acceptability of UAS concepts integrated into the NAS. The first integrated flight test (and the subject of this report) followed the IHITL by replacing the simulation components with live aircraft. The project finishes the integrated events with a final flight test to be conducted in 2016 that provides the researchers with an opportunity to collect DWC and Collision Avoidance (CA) interoperability data during flight encounters.

flight test↗
DOE OSTI2026

Cooperative Education

Los Alamos National Laboratory (LANL) is a multidisciplinary national laboratory that conducts research and development in national security, engineering, materials science, computational modeling, and advanced manufacturing. The laboratory develops innovative technologies to address complex scientific and engineering challenges. This project focuses on the development and evaluation of high-performance absorbing structures through computational design, simulation, and engineering analysis. Absorbing structures are used in applications where damage mitigation, structural protection, and material efficiency are critical performance requirements. The increasing demand for lightweight, high-strength, and highly efficient structural systems has created a need for improved design methodologies capable of maximizing absorption while minimizing weight and material usage. The project utilizes advanced engineering software, including 3D CAD software and FEA, to generate and optimize structural concepts. Computational simulations are performed to evaluate structural behavior under loading conditions, while mathematical analyses are conducted using Python-based tools as well as established analytical equations from material and structural mechanics. The project benefits LANL by supporting the development of advanced design methodologies and improving the understanding of material and structural performance. During the internship term, a significant portion of the design development, simulation, and data analysis activities will be completed. Success of the project depends on collaboration among engineering mentors and technical staff members. Work will be conducted at Los Alamos National Laboratory using laboratory computing resources and engineering software.

42 ENGINEERING↗
DOE OSTI2016

A likelihood ratio anomaly detector for identifying within-perimeter computer network attacks

The rapid detection of attackers within firewalls of enterprise computer networks is of paramount importance. Anomaly detectors address this problem by quantifying deviations from baseline statistical models of normal network behavior and signaling an intrusion when the observed data deviates significantly from the baseline model. But, many anomaly detectors do not take into account plausible attacker behavior. As a result, anomaly detectors are prone to a large number of false positives due to unusual but benign activity. Our paper first introduces a stochastic model of attacker behavior which is motivated by real world attacker traversal. Then, we develop a likelihood ratio detector that compares the probability of observed network behavior under normal conditions against the case when an attacker has possibly compromised a subset of hosts within the network. Since the likelihood ratio detector requires integrating over the time each host becomes compromised, we illustrate how to use Monte Carlo methods to compute the requisite integral. We then present Receiver Operating Characteristic (ROC) curves for various network parameterizations that show for any rate of true positives, the rate of false positives for the likelihood ratio detector is no higher than that of a simple anomaly detector and is often lower. Finally, we demonstrate the superiority of the proposed likelihood ratio detector when the network topologies and parameterizations are extracted from real-world networks.

97 MATHEMATICS AND COMPUTING↗
NASA NTRS2012

Towards Reliable Evaluation of Anomaly-Based Intrusion Detection Performance

This report describes the results of research into the effects of environment-induced noise on the evaluation process for anomaly detectors in the cyber security domain. This research was conducted during a 10-week summer internship program from the 19th of August, 2012 to the 23rd of August, 2012 at the Jet Propulsion Laboratory in Pasadena, California. The research performed lies within the larger context of the Los Angeles Department of Water and Power (LADWP) Smart Grid cyber security project, a Department of Energy (DoE) funded effort involving the Jet Propulsion Laboratory, California Institute of Technology and the University of Southern California/ Information Sciences Institute. The results of the present effort constitute an important contribution towards building more rigorous evaluation paradigms for anomaly-based intrusion detectors in complex cyber physical systems such as the Smart Grid. Anomaly detection is a key strategy for cyber intrusion detection and operates by identifying deviations from profiles of nominal behavior and are thus conceptually appealing for detecting "novel" attacks. Evaluating the performance of such a detector requires assessing: (a) how well it captures the model of nominal behavior, and (b) how well it detects attacks (deviations from normality). Current evaluation methods produce results that give insufficient insight into the operation of a detector, inevitably resulting in a significantly poor characterization of a detectors performance. In this work, we first describe a preliminary taxonomy of key evaluation constructs that are necessary for establishing rigor in the evaluation regime of an anomaly detector. We then focus on clarifying the impact of the operational environment on the manifestation of attacks in monitored data. We show how dynamic and evolving environments can introduce high variability into the data stream perturbing detector performance. Prior research has focused on understanding the impact of this variability in training data for anomaly detectors, but has ignored variability in the attack signal that will necessarily affect the evaluation results for such detectors. We posit that current evaluation strategies implicitly assume that attacks always manifest in a stable manner; we show that this assumption is wrong. We describe a simple experiment to demonstrate the effects of environmental noise on the manifestation of attacks in data and introduce the notion of attack manifestation stability. Finally, we argue that conclusions about detector performance will be unreliable and incomplete if the stability of attack manifestation is not accounted for in the evaluation strategy.

cyber defense↗
DOE OSTI2016

Surrogate Post-Detonation Urban Debris (SPUD): Standard Reference Materials 4600 and 4601

If a terrorist nuclear explosion were to occur in the United States, high-quality (accurate and precise) legally defensible nuclear forensics measurements will be required to assure the certainty and confidence needed, for conclusions drawn from these data will be coupled with law enforcement and intelligence information for the purposes of attribution and retribution. Standard Reference Materials (SRMs)/Certified Reference Materials (CRMs) establish the traceability, accuracy, and precision of nuclear forensic measurements and provide the ability to benchmark measurement methods essential to meeting the requirements of legal scrutiny. Currently there is a critical shortage of key SRMs/CRMs required for accurate and precise measurements that are fundamental to nuclear measurements supporting pre- and post-detonation nuclear forensics. Supplies either do not exist, are not good enough, are in short supply, and/or are very expensive. The radionuclide measurement techniques and data quality objectives for pre- and post-detonation nuclear forensics are quite different than the applications for which the current suite of available SRMs/CRMs was developed. Specifically, 1) modern mass spectrometry methods have largely replaced traditional activity-based measurement methods for quantifying small quantities of long-lived radionuclides and most trace radionuclide SRMs/CRMs are certified for activity and are thus not adequate for current applications, 2) modern instrumental methods are capable of higher precision than historic measurement techniques, and in some cases exceed the precision of the available SRMs/CRMs, and 3) the quality assurance requirements for pre- and post-detonation nuclear forensics are such that the existing cadre of SRMs/CRMs does not adequately support the needs for method validation. There are numerous governmental stakeholders both within the US (DOE, DoD) and internationally (IAEA, JRC-ITU) whose missions are either directly involved with nuclear forensics measurements or rely on the forensic data obtained to make the exacting policy decisions (DOJ (FBI), DHS, CIA, DIA, DoD) associated with disrupting the production of illicit nuclear materials, interdicted nuclear materials or a nuclear/radiological detonation event. Starting in 2008 the DHS NTNFC, in collaboration with NBL and NIST, took on the production of suitable SRMs/CRMs for the pre-detonation nuclear forensics community. Two CRMs have been released since the start of this effort and two more are slated for completion in 2016. More recently, NIST, as a part of its mission as the US National Metrology Institute (NMI) to deliver standards (providing traceability) and foster homeland security, has launched the first certification campaign of a measurement traceable post nuclear detonation SRM. NIST, in cooperation with partner labs (AFIT (DoD), FBI (DOJ), and NPL) and with support from the FBI, has developed two Surrogate Post-Detonation Urban Debris (SPUD) Standard Reference Materials (SRMs) - SRM 4600 and 4601. These SRMs have been developed to simulate the expected debris mixture from the detonation of an Improvised Nuclear Device (IND) in an urban environment, which is capable of producing fresh fission as well as activation products. The elemental composition of the vitrified debris materials is a composite of minerals and metals characteristic of the concrete and steel, the building materials that would be exposed to a nuclear detonation and whose resulting activation products would be found in rubble samples collected for forensics evidence and attribution. Additionally, because post-detonation samples would also contain short-lived fission products, the debris materials have been doped with Uranium (U). To create the nuclear fission products, samples of the SPUD materials can be placed in a well-characterized nuclear reactor and exposed to a set neutron flux and energy, causing the encased U atoms to split and yield short-lived fission products. Because a known amount of U is added to the SPUD materials it is feasible to determine the concentration of the resulting fission products. The subsequent irradiated SPUD glass would be chemically similar to samples that would be generated in an actual detonation, and thus can serve as a standardized reference material for nuclear forensic post detonation measurements. (authors)

61 RADIATION PROTECTION AND DOSIMETRY↗
DOE OSTI2023

Advanced Reactor Cyber Analysis and Development Environment (ARCADE) for System-Level Design Analysis

Cybersecurity is a persistent concern to the safety and security of Nuclear Power Plants (NPPs), but has lacked data-driven, evidence-based research. Rigorous cybersecurity analysis is critical for the licensing of advanced reactors using a performance-based approach. One tool that enables cybersecurity analysis is modeling and simulation. The nuclear industry makes extensive use of modeling and simulation throughout the decision process but lacks a method to incorporate cybersecurity analysis with existing models. To meet this need, the Advanced Reactor Cyber Analysis and Development Environment (ARCADE) was developed. ARCADE is a suite of publicly available tools that can be used to develop emulations of industrial control system devices and networks and integrate those emulations with physics simulators. This integration of cyber emulations and physics models enables rigorous cyber-physical analysis of cyber-attacks on NPP systems. This report provides an overview of key considerations for using ARCADE with existing physics models and demonstrates ARCADE’s capabilities for cybersecurity analysis. Using a model of the Small Modular Advanced High Temperature Reactor (SmAHTR), ARCADE was able to determine the sensitivity of the primary heat exchangers (PHX) to coordinated cyber-attacks. The analysis determined that while the PHX’s failures cause disruption to the reactor, they did not cause any safety limits to be exceeded because of the plant design, including passive safety features. Further development of ARCADE will enable rigorous, repeatable, and automated cyber-physical analysis of advanced reactor control systems. These efforts will also help reduce regulatory uncertainty by presenting similar types of cybersecurity analyses in a common format, driving standard approaches and reporting.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2018

NBIC Biofeeds: Deploying a New, Digital Tool for Open Source Biosurveillance across Federal Agencies

The National Biosurveillance Integration Center (NBIC) is deploying a scalable, flexible open source data collection, analysis, and dissemination tool to support biosurveillance operations by the U.S. Department of Homeland Security (DHS) and its federal interagency partners.IntroductionNBIC integrates, analyzes, and distributes key information about health and disease events to help ensure the nation’s responses are well-informed, save lives, and minimize economic impact. To meet its mission objectives, NBIC utilizes a variety of data sets, including open source information, to provide comprehensive coverage of biological events occurring across the globe. NBIC Biofeeds is a digital tool designed to improve the efficiency of analyzing large volumes of open source reporting and increase the number of relevant insights gleaned from this dataset. Moreover, the tool provides a mechanism to disseminate tailored, electronic message notifications in near-real time so that NBIC can share specific information of interest to its interagency partners in a timely manner. NBIC intends to implement operational use of the capability in FY 2018. The core components of the system are data collection, curation, and dissemination of information deemed important by NBIC subject matter experts. NBIC Biofeeds has captured information from more than 70,000 unique sources published from around the globe and presents, on average, 9,000 new biosurveillance-relevant articles to users each day. NBIC leverages a variety of data feeds, including third party aggregators like Google and subscription-based feeds such as HealthMap, as well as Really Simple Syndication (RSS) feeds and web-scraping of highly relevant sources. The NBIC biosurveillance taxonomy imbedded in the tool consists of more than 600 metadata targets that cover key information for understanding the significance of an active biological event, including etiologic agents, impact to humans and animals (e.g., infection severity, healthcare workers involved, type of host), social disruption, infrastructure strain, countermeasures engaged, and ‘red flag’ characteristics (e.g., pathogen appearance in a new geographic area, unusual clinical signs). This taxonomy serves as a foundation for data curation and can be tailored by NBIC partners to more directly meet their own mission objectives. At this time, metadata is predominately captured by NBIC analysts, who manually tag information, which triggers the population of three automatically-disseminated products from the tool: 1) the NBIC Daily Biosurveillance Review, 2) immediate and daily summary email notifications, and 3) custom-designed RSS feeds. These products are meant for individual recipients in the federal interagency and for consumption by other biosurveillance information technology systems, such as the Department of Defense, Defense Threat Reduction Agency (DTRA) Biosurveillance Ecosystem (BSVE). NBIC is working in partnership with DTRA to integrate NBIC Biofeeds as an application directly into the BSVE and further develop the BSVE as an all-in-one platform for biosurveillance data analytics. To improve the efficiency and effectiveness of gaining insights using NBIC Biofeeds, developers of the tool at the Pacific Northwest National Laboratory (PNNL) are researching and testing a variety of advanced analytics techniques focused on: 1) article relevancy ratings to improve the review of queried data, 2) significance ratings to elucidate the perceived severity of an event based on reported characteristics, 3) full-text article retrieval and storage for improved machine-tagging, and 4) anomaly detection for emerging threats. Testing and implementation of new analytic capabilities in NBIC Biofeeds is planned for this fiscal year. NBIC Biofeeds was developed to serve as a sophisticated and powerful open source biosurveillance technology of value to the federal government by providing information to stakeholders conducting open source biosurveillance as well as those consuming biosurveillance information. In FY 2018, NBIC Biofeeds will begin operational use by NBIC and an initial set of users in various federal agencies. User accounts for testing purposes will be available to other federal partners, and a broad scope of federal stakeholders can receive products directly from NBIC Biofeeds based on their interests. NBIC Biofeeds is expected to enable more rapid recognition and enhanced analysis of emerging biological events by NBIC analysts. NBIC anticipates other federal agencies with biosurveillance missions will find this technology of value and intends to offer use of the platform to those federal partners that can benefit from access to the tool and information generated from NBIC Biofeeds.

NBIC↗