SEARCH · Engineering Papers

Results for “detection network”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 271 records · Page 15

All sources NASA NTRS DOE OSTI

NASA NTRS2012

Particle Filtering for Model-Based Anomaly Detection in Sensor Networks

A novel technique has been developed for anomaly detection of rocket engine test stand (RETS) data. The objective was to develop a system that postprocesses a csv file containing the sensor readings and activities (time-series) from a rocket engine test, and detects any anomalies that might have occurred during the test. The output consists of the names of the sensors that show anomalous behavior, and the start and end time of each anomaly. In order to reduce the involvement of domain experts significantly, several data-driven approaches have been proposed where models are automatically acquired from the data, thus bypassing the cost and effort of building system models. Many supervised learning methods can efficiently learn operational and fault models, given large amounts of both nominal and fault data. However, for domains such as RETS data, the amount of anomalous data that is actually available is relatively small, making most supervised learning methods rather ineffective, and in general met with limited success in anomaly detection. The fundamental problem with existing approaches is that they assume that the data are iid, i.e., independent and identically distributed, which is violated in typical RETS data. None of these techniques naturally exploit the temporal information inherent in time series data from the sensor networks. There are correlations among the sensor readings, not only at the same time, but also across time. However, these approaches have not explicitly identified and exploited such correlations. Given these limitations of model-free methods, there has been renewed interest in model-based methods, specifically graphical methods that explicitly reason temporally. The Gaussian Mixture Model (GMM) in a Linear Dynamic System approach assumes that the multi-dimensional test data is a mixture of multi-variate Gaussians, and fits a given number of Gaussian clusters with the help of the wellknown Expectation Maximization (EM) algorithm. The parameters thus learned are used for calculating the joint distribution of the observations. However, this GMM assumption is essentially an approximation and signals the potential viability of non-parametric density estimators. This is the key idea underlying the new approach.

Solano, Wanda↗

DOE OSTI2014

Network Algorithms for Detection of Radiation Sources

In support of national defense, Domestic Nuclear Detection Office’s (DNDO) Intelligent Radiation Sensor Systems (IRSS) program supported the development of networks of radiation counters for detecting, localizing and identifying low-level, hazardous radiation sources. Industry teams developed the first generation of such networks with tens of counters, and demonstrated several of their capabilities in indoor and outdoor characterization tests. Subsequently, these test measurements have been used in algorithm replays using various sub-networks of counters. Test measurements combined with algorithm outputs are used to extract Key Measurements and Benchmark (KMB) datasets. We present two selective analyses of these datasets: (a) a notional border monitoring scenario that highlights the benefits of a network of counters compared to individual detectors, and (b) new insights into the Sequential Probability Ratio Test (SPRT) detection method, which lead to its adaptations for improved detection. Using KMB datasets from an outdoor test, we construct a notional border monitoring scenario, wherein twelve 2”*2” NaI detectors are deployed on the periphery of 21*21meter square region. A Cs-137 (175 uCi) source is moved across this region, starting several meters from outside and finally moving away. The measurements from individual counters and the network were processed using replays of a particle filter algorithm developed under IRSS program. The algorithm outputs from KMB datasets clearly illustrate the benefits of combining measurements from all networked counters: the source was detected before it entered the region, during its trajectory inside, and until it moved several meters away. When individual counters are used for detection, the source was detected for much shorter durations, and sometimes was missed in the interior region. The application of SPRT for detecting radiation sources requires choosing the detection threshold, which in turn requires a source strength estimate, typically specified as a multiplier of the background radiation level. A judicious selection of this source multiplier is essential to achieve optimal detection probability at a specified false alarm rate. Typically, this threshold is chosen from the Receiver Operating Characteristic (ROC) by varying the source multiplier estimate. ROC is expected to have a monotonically increasing profile between the detection probability and false alarm rate. We derived ROCs for multiple indoor tests using KMB datasets, which revealed an unexpected loop shape: as the multiplier increases, detection probability and false alarm rate both increase until a limit, and then both contract. Consequently, two detection probabilities correspond to the same false alarm rate, and the higher is achieved at a lower multiplier, which is the desired operating point. Using the Chebyshev’s inequality we analytically confirm this shape. Then, we present two improved network-SPRT methods by (a) using the threshold off-set as a weighting factor for the binary decisions from individual detectors in a weighted majority voting fusion rule, and (b) applying a composite SPRT derived using measurements from all counters.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

DOE OSTI2021

Preliminary Assessment of Qiskit Quantum Simulator Capabilities for Development of Quantum Hopfield Neural Network for Anomaly Detection Applications (Q4 Report)

Quantum information processing offers potentially faster performance compared to the classical counterpart. The goal of this work is to investigate performance of Quantum Hopfield Neural Network for applications to anomaly detection. Preliminary study consist of assessment of computational capabilities of Qiskit quantum simulator. Eventual objective is to implement Quantum Hopfield Network algorithm for detection of weak nuisance and anomaly signal in the presence of strong and highly varying background in gamma radiation data measured during environmental screening.

73 NUCLEAR PHYSICS AND RADIATION PHYSICS↗

DOE OSTI2012

Real-time method for establishing a detection map for a network of sensors

A method for establishing a detection map of a dynamically configurable sensor network. This method determines an appropriate set of locations for a plurality of sensor units of a sensor network and establishes a detection map for the network of sensors while the network is being set up; the detection map includes the effects of the local terrain and individual sensor performance. Sensor performance is characterized during the placement of the sensor units, which enables dynamic adjustment or reconfiguration of the placement of individual elements of the sensor network during network set-up to accommodate variations in local terrain and individual sensor performance. The reconfiguration of the network during initial set-up to accommodate deviations from idealized individual sensor detection zones improves the effectiveness of the sensor network in detecting activities at a detection perimeter and can provide the desired sensor coverage of an area while minimizing unintentional gaps in coverage.

47 OTHER INSTRUMENTATION↗

DOE OSTI2021

Convolutional Neural Networks for Signal Detection

Currently, traditional methods such as short-term average/long-term average (STA/LTA) are used to detect arrivals in three-component seismic waveform data. Accurately establishing the identity and arrival of these waves is helpful in detecting and locating seismic events. Convolutional Neural Networks (CNNs) have been shown to significantly improve performance at local distances. This work will expand the use of CNNs to more remote distances and lower magnitudes. Sandia National Labs (SNL) will explore the advantages and limits of a particular approach and investigate requirements for expanding this technique to different types, distances, and magnitudes of events in the future. The team will describe detailed performance results of this method tuned on a curated dataset from Utah with its expert-defined arrival picks.

58 GEOSCIENCES↗

DOE OSTI2025

Machine Learning for Anomaly Detection in Neural Network Security and SRF Cavities

This dissertation explores the development and deployment of machine learning approaches to address critical challenges in anomaly detection across two distinct domains: neural network security in federated learning settings and cavity behavior analysis in particle accelerator operations at Jefferson Lab in Newport News, Virginia. Anomaly detection identifies deviations from expected patterns, safeguarding systems in cybersecurity, industry, and research against malicious activities and failures. This dissertation demonstrates how our machine learning approaches enhance detection accuracy and efficiency in both neural network security and industrial applications. First, we investigate vulnerabilities in deep neural networks deployed in federated learning. Although federated learning preserves user privacy by training models locally, it remains vulnerable to backdoor attacks, in which malicious participants embed hidden triggers that induce targeted misbehavior. We propose a self-supervised contrastive learning framework to detect and mitigate such backdoor attacks. In our experiments, this method achieves higher detection accuracy and lower false positive rates than existing defenses, while operating without access to local model updates or original training data and thus preserving the privacy guarantees of the federated setting. Second, we address the operational reliability of superconducting radio-frequency (SRF) cavities at the Continuous Electron Beam Accelerator Facility (CEBAF). Our research leverages an unsupervised learning approach, combined with Principal Component Analysis (PCA) and k-means clustering, to identify anomalous behaviors in SRF cavities. Our method detects subtle anomalous behavior by analyzing SRF signal data. This knowledge allows for the early detection and resolution of potential faults, significantly improving the efficiency and reliability of operations. Third, we extend these insights to time-series anomaly detection more broadly. We design a contrastive-learning based model tailored to increasingly dynamic environments and academic research. This model improves detection accuracy in settings that require real-time monitoring and predictive maintenance. Our research underscores the broader applicability and impact of advanced machine learning techniques in anomaly detection. By extracting meaningful patterns from complex data, machine learning can significantly enhance security in distributed neural networks and improve the efficiency of particle accelerator operations. This dissertation serves as a stepping stone for future investigations into the vast possibilities of anomaly detection, inspiring further exploration and development of machine learning techniques in this field.

Ferguson, Hal [Old Dominion University]↗

NASA NTRS1991

Space shuttle main engine fault detection using neural networks

A method for on-line Space Shuttle Main Engine (SSME) anomaly detection and fault typing using a feedback neural network is described. The method involves the computation of features representing time-variance of SSME sensor parameters, using historical test case data. The network is trained, using backpropagation, to recognize a set of fault cases. The network is then able to diagnose new fault cases correctly. An essential element of the training technique is the inclusion of randomly generated data along with the real data, in order to span the entire input space of potential non-nominal data.

Bishop, Thomas↗

NASA NTRS1998

OPAL: Network for the Detection of Stratospheric Change Ozone Profiler Assessment at Lauder, New Zealand. II. Intercomparison of Revised Results

Following a blind intercomparison of ozone profiling instruments in the Network for the Detection of Stratospheric Change at Lauder, New Zealand, revisions to the analyses were made resulting in a new dataset.

OPAL↗

NASA NTRS2006

Long-term Evolution of Upper Stratospheric Ozone at Selected Stations of the Network for the Detection of Stratospheric Change (NDSC)

The long-term evolution of upper stratospheric ozone has been recorded by lidars and microwave radiometers within the ground-based Network for the Detection of Stratospheric Change (NDSC), and by the space-borne Solar Backscatter Ultra-Violet instruments (SBUV), Stratospheric Aerosol and Gas Experiment (SAGE), and Halogen Occultation Experiment (HALOE). Climatological mean differences between these instruments are typically smaller than 5% between 25 and 50 km. Ozone anomaly time series from all instruments, averaged from 35 to 45 km altitude, track each other very well and typically agree within 3 to 5%. SBUV seems to have a slight positive drift against the other instruments. The corresponding 1979 to 1999 period from a transient simulation by the fully coupled MAECHAM4-CHEM chemistry climate model reproduces many features of the observed anomalies. However, in the upper stratosphere the model shows too low ozone values and too negative ozone trends, probably due to an underestimation of methane and a consequent overestimation of ClO. The combination of all observational data sets provides a very consistent picture, with a long-term stability of 2% or better. Upper stratospheric ozone shows three main features: (1) a decline by 10 to 15% since 1980, due to chemical destruction by chlorine; (2) two to three year fluctuations by 5 to 10%, due to the Quasi-Biennial Oscillation (QBO); (3) an 11-year oscillation by about 5%, due to the 11-year solar cycle. The 1979 to 1997 ozone trends are larger at the southern mid-latitude station Lauder (45 S), reaching 8%/decade, compared to only about 6%/decade at Table Mountain (35 N), Haute Provence/Bordeaux (approximately equal to 45 N), and Hohenpeissenberg/Bern(approximately equal to 47 N). At Lauder, Hawaii (20 N), Table Mountain, and Haute Provence, ozone residuals after subtraction of QBO- and solar cycle effects have levelled off in recent years, or are even increasing. Assuming a turning point in January 1997, the change of trend is largest at southern mid-latitude Lauder, +11%/decade, compared to +7%/decade at northern mid-latitudes. This points to a beginning recovery of upper stratospheric ozone. However, chlorine levels are still very high and ozone will remain vulnerable. At this point the most northerly mid-latitude station, Hohenpeissenberg/Bern differs from the other stations, and shows much less clear evidence for a beginning recovery, with a change of trend in 1997 by only +3%/decade. In fact, record low upper stratospheric ozone values were observed at Hohenpeissenberg/Bern, and to a lesser degree at Table Mountain and Haute Provence, in the winters 2003/2004 and 2004/2005.

Steinbrecht, W.↗

DOE OSTI2019

Detecting and Diagnosing Incipient Building Faults Using Uncertainty Information from Deep Neural Networks

Early detection of incipient faults is of significant importance to reducing maintenance costs, saving energy, and enhancing occupant comfort in buildings. Popular supervised learning models such as deep neural networks are considered promising due to their ability to directly learn from labeled fault data; however, it is known that the performance of supervised learning approaches highly relies on the availability and quality of labeled training data. In Fault Detection and Diagnosis (FDD) applications, the lack of labeled incipient fault data has posed a major challenge to applying these supervised learning techniques to commercial buildings. To address this concern, this paper proposes using Monte Carlo dropout (MC-dropout) to enhance the supervised learning pipeline, so that the resulting neural network is able to detect and diagnose unseen incipient fault examples. We also examine the proposed MC-dropout method on the RP-1043 dataset to demonstrate its effectiveness in indicating the most likely incipient fault types.

42 ENGINEERING↗

NASA NTRS1991

Network for the detection of stratospheric change (NDSC)

The notion of a ground-based long-term measuring network specifically designed to provide the earliest possible detection of changes in the composition and structure of the stratosphere and to understand the causes of those changes is examined. The network's short-term goals are: to study the temporal and spatial variability of atmospheric composition and structure; to provide the basis for ground truth and complementary measurements for satellite systems such as the NASA Upper Atmosphere Research Satellite; and to critically test multidimensional stratospheric models and provide the broad data base required for improved model development. Priorities, instrumentation, station considerations, and site requirements are also discussed.

Kurylo, Michael J.↗

NASA NTRS1990

Millimeter-wave ozone measurements for the network for the detection of stratospheric change

The primary research objective is to initiate long-term monitoring of stratospheric ozone with a ground-based millimeter-wave spectrometer, the first of several such instruments projected to be part of the Network for the Detection of Stratospheric Change. The ultimate goal of this monitoring is twofold. First, to detect any secular trend in stratospheric ozone abundance, whether of natural or anthropogenic origin and, second, to provide ground-truth validation for existing and future satellite measurements of ozone. With this goal in mind, a more immediate objective is to validate the millimeter-wave measurements by tests of the instrument, internal consistency tests on the data, and most importantly, by intercomparison with all other available ozone measurements. The validation process is expected to lead to refinements in the instrument and its operating procedures and in the data analysis. The final objective is to perform short-term scientific studies with the data, including studies of the ozone diurnal and seasonal variations, and comparison of ozone variations with changes in other geophysical parameters, notably temperature and water vapor. Routine observations are now ongoing; these will allow continuing intercomparisons with the Stratospheric Aerosol and Gas Experiment (SAGE II) and one of the lidars, which is permanently on site. The experience gained during the Stratospheric Ozone Intercomparison (STOIC) caused us to refine our calibration procedures and identify the need for internal shielding of the millimeter receiver from radio frequency interference. Installation of this shielding is planned for the near future and should allow improvements in the instrument calibration and a higher signal-to-noise ratio, both of which will result in improved measurement precision.

Connor, Brian J.↗

DOE OSTI2022

Understanding the Seismic Ground Motion Spatial Variability Using Network Analysis Community Detection

This project is to explore ground motion spatial distribution using a new approach graph-based network analysis. In this study, we combine a large-N seismic array and graph analytics to explore spatial variability and correlation at a local scale using small local and regional earthquakes. In this method, each seismic station is modeled as a node and the similarities of the waveforms that represent ground motions between two stations are modeled as edges. By analyzing this graph network using the similarity matrices and community detection algorithm, we can group the stations spatially with similar patterns. A random forest algorithm is used to reveal the important features that affect the spatial grouping. The result suggests site conditions, and how they interact with the incident seismic wavefield, strongly condition the spatial correlation of ground motion. Future progress in characterizing ground motion spatial variability will require dense wavefield measurements, either through nodal deployments, or perhaps distributed acoustic sensing measurements of seismic wavefields.

58 GEOSCIENCES↗

DOE OSTI2020

CEEP (Cyber-Energy Emulation Platform) [SWR-20-102]

NREL's Cyber-Energy Emulation Platform (CEEP) provides the capability to realize cyber-energy security and resilience through automation and orchestration of virtualized systems and software defined networks for the electric grid. CEEP enables testing and validation of grid-security and -control methodologies as the grid evolves to include smart technologies/systems, such as virtualization and containerization of grid components, software defined networking, simulation and co-simulation frameworks, and hardware in the loop. CEEP is a modular system that can be distributed and deployed across different hardware infrastructure sizes and network architectures. For example, CEEP can visualize, emulate, and/or coordinate the Smart-Grid Network Visualization, Intrusion Detection, and Network Healing system. Using CEEP, intrusion-detection and network-self-healing solutions can be deployed at grid control centers, within secure private clouds, and in cyber-energy appliances.

Vaughan, Evan↗

DOE OSTI2022

Cyber Energy Emulation Platform (CEEP) [SWR-20-102]

Rivera, Joshua↗

DOE OSTI2010

Detecting and Blocking Network Attacks at Ultra High Speeds

Stateful, in-depth, in-line traffic analysis for intrusion detection and prevention has grown increasingly more difficult as the data rates of modern networks rise. One point in the design space for high-performance network analysis - pursued by a number of commercial products - is the use of sophisticated custom hardware. For very high-speed processing, such systems often cast the entire analysis process in ASICs. This project pursued a different architectural approach, which we term Shunting. Shunting marries a conceptually quite simple hardware device with an Intrusion Prevention System (IPS) running on commodity PC hardware. The overall design goal is was to keep the hardware both cheap and readily scalable to future higher speeds, yet also retain the unparalleled flexibility that running the main IPS analysis in a full general-computing environment provides. The Shunting architecture we developed uses a simple in-line hardware element that maintains several large state tables indexed by packet header fields, including IP/TCP flags, source and destination IP addresses, and connection tuples. The tables yield decision values the element makes on a packet-by-packet basis: forward the packet, drop it, or divert ('shunt') it through the IPS (the default). By manipulating table entries, the IPS can, on a fine-grained basis: (i) specify the traffic it wishes to examine, (ii) directly block malicious traffic, and (iii) 'cut through' traffic streams once it has had an opportunity to 'vet' them, or (iv) skip over large items within a stream before proceeding to further analyze it. For the Shunting architecture to yield benefits, it needs to operate in an environment for which the monitored network traffic has the property that - after proper vetting - much of it can be safely skipped. This property does not universally hold. For example, if a bank needs to examine all Web traffic involving its servers for regulatory compliance, then a monitor in front of one of the bank's server farms cannot safely omit a subset of the traffic from analysis. In this environment, Shunting cannot realize its main performance benefits, and the monitoring task likely calls for using custom hardware instead. However, in many other environments we find Shunting holds promise for delivering major performance gains. This arises due to the the widely documented 'heavy tail' nature of most forms of network traffic, which we might express as 'a few of the connections carry just about all the bytes.' The key additional insight is '... and very often for these few large connections, the very beginning of the connection contains nearly all the information of interest from a security analysis perspective.' We argue that this second claim holds because it is at the beginning of connections that authentication exchanges occur, data or file names and types are specified, request and reply status codes conveyed, and encryption is negotiated. Once these occur, we have seen most of the interesting facets of the dialog. Certainly the remainder of the connection might also yield some grist for analysis, but this is generally less likely, and thus if we want to lower analysis load at as small a loss as possible of information relevant to security analysis, we might best do so by skipping the bulk of large connections. In a different context, the 'Time Machine' work by Kornexl and colleagues likewise shows that in some environments we can realize major reductions in the volume of network traffic processed, by limiting the processing to the first 10-20 KB of each connection. As a concrete example, consider an IPS that monitors SSH traffic. When a new SSH connection arrives and the Shunt fails to find an entry for it in any of its tables (per-address, per-port, per-connection), it executes the default action of diverting the connection through the IPS. The IPS analyzes the beginning of the connection in this fashion. As long as it is satisified with the dialog, it reinjects the packets forwarded to it so that the connection can continue. If the connection successfully negotiates encryption, the IPS can no longer profitably analyze it, so it downloads a per-connection table entry to the Shunt specifying that the action for the connection in the future is 'forward.' For heavy-tailed connections, this means a very large majority of the connection's packets will now pass through the Shunt device without burdening the IPS with any further analysis load. On the other hand, if the IPS is dissatisfied with some element of the initial dialog, it downloads a 'drop' entry to terminate the connection. Note that by providing for reinjection, we can promote an intrusion detection system into an intrusion prevention system, one that does not merely detect attacks but can block them before they complete. Reinjection also allows the IPS to normalize traffic to remove ambiguities that attackers can leverage to evade the IPS.

99 GENERAL AND MISCELLANEOUS↗

NASA NTRS1990

Retrieval methods for ground-based millimeter-wave measurements for the network for the detection of stratospheric change

The fundamental objective is to determine the information available in ground-based millimeter-wave measurements of stratospheric constituent profiles, to identify the optimum method of retrieving this profile information, and to characterize the errors in the final result. A secondary objective is to produce retrieval software for operational use with Network for the Detection of Stratospheric Change (NDSC) measurements of O3, H2O, ClO, and perhaps N2O. Tests were performed on existing ozone retrieval programs in support of ongoing NDSC field measurements. The results show that if random spectral errors and retrieval bias errors are considered, accuracy of the retrieved profile is about 5 percent from 20-50 km, and about 10 percent from 50-60 km.

Connor, Brian J.↗

DOE OSTI2018

Detecting Outliers in Network Transfers with Feature Extraction

Reliable file transfers are essential for successful science computations and experiments that need large complex data files to be moved across long distances. Networks use protocols such as TCP and UDP to support file transfers, and their performance degrades under packet losses and duplications, thereby adversely affecting science applications. Hence, scientists and engineers often monitor network statistics to find and repair network problems that cause such degradations.Outliers or anomalies can be detected using statistical and machine learning methods that highlight abnormal behaviors. However, without knowing what is normal, it is very difficult and subjective to determine the anomalies. In this paper, we investigate statistical and machine learning approaches to extract unknown or unsupervised features from TCP and perfSONAR data sets, with the aim to identify anomalies such as packet loss, duplication and retransmission sequencing that affect file transfer performance. Simple statistical and feature extraction methods (e.g. PCA) have shown that detecting anomalies is simpler if labeled data sets of normal behavior are available. While perfSONAR logs record losses,they do not detect duplications and reordering. We show that PCA applied to TCP statistics is able to determine abnormal behavior in the above cases. In particular, our results show that simple feature extraction techniques provide building blocks for more advanced network monitoring tools that can quickly flag anomalies using simple measurements, thereby helping to build confidence in file transfer reliability.

Rao, Nageswara S.↗