Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “attack detection”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 289 records · Page 16
All sourcesNASA NTRSDOE OSTI
DOE OSTI2021

Security proof of practical quantum key distribution with detection-efficiency mismatch

Quantum key distribution (QKD) protocols with threshold detectors are driving high-performance QKD demonstrations. The corresponding security proofs usually assume that all physical detectors have the same detection efficiency. However, the efficiencies of the detectors used in practice might show a mismatch depending on the manufacturing and setup of these detectors. A mismatch can also be induced as the different spatial-temporal modes of an incoming signal might couple differently to a detector. Here we develop a method that allows to provide security proofs without the usual assumption. Our method can take the detection-efficiency mismatch into account without having to restrict the attack strategy of the adversary. Especially, we do not rely on any photon-number cutoff of incoming signals such that our security proof is directly applicable to practical situations. We illustrate our method for a receiver that is designed for polarization encoding and is sensitive to a number of spatial-temporal modes. In our detector model, the absence of quantum interference between any pair of spatial-temporal modes is assumed. For a QKD protocol with this detector model, we can perform a security proof with characterized efficiency mismatch and without photon-number cutoff assumption. Our method also shows that in the absence of efficiency mismatch in our detector model, the key rate increases if the loss due to detection inefficiency is assumed to be outside of the adversary's control, as compared to the view where for a security proof this loss is attributed to the action of the adversary.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

Cognitive IoT and Edge Computing for Intrusion Detection with Federated TinyML

Internet of Things (IoT) and Edge Computing (EC) are rapidly becoming an integral part of the modern society. By 2030, there is estimated to be over 40 billion active and connected IoT devices [1]. This rapid progress also comes with a significant implication on cybersecurity. Back-end infrastructure and systems have a much broader attack than they did previously due to vulnerable IoT/EC devices being connected to wireless networks. This expanding attack surface is a growing concern because IoT/EC are increasingly being used in critical systems such as power grids, health care, and smart homes. To effectively address a problem of this scale, cognitive cyber methods—which can autonomously detect and react to cyber attacks as they develop—are needed. To address this, we bring Artificial Intelligence (AI) and Machine Learning (ML) to IoT/EC devices, using tinyML to monitor voluminous IoT data against cyber threats, and using Federated Learning (FL) to share local detection knowledge across the system while preserving privacy. We propose a novel three-layer architecture: (1) an IoT layer for tinyML-based inference, (2) an edge layer for ML model training, and (3) a cloud layer for FL operations. Using the publicly available 11-class N-BaIoT dataset [2], we demonstrate that this architecture mitigates resource constraints at the IoT layer while improving detection accuracy over standard two-layer designs. An outlier-resistant scaler, feature reduction, and quantization enable the tinyML model to maintain detection accuracy with a reduced model size. Additionally, federated learning that only utilizes the intersection (across heterogenous devices) of the reduced feature set achieves superior detection accuracy compared to locally trained models.

Li, Mingyan [ORNL] (ORCID:0009000569532640)↗
DOE OSTI2020

HIDES: Hybrid Intrusion Detector for Energy Systems

The establishment of a resilient electric grid accompanied by a secure communications network is an ongoing battle as advanced persistent threats continue to exploit existing vulnerabilities in legacy supervisory control and data acquisition system (SCADA) infrastructure. Traditional intrusion detection systems (IDSs) lack consistent performance because of the continuously evolving attack surface of SCADA systems. These shortcomings can be overcome by integrating logical system behavior, protocol-specific knowledge, and data-based learning to develop a comprehensive IDS solution. In this paper, we present a Hybrid Intrusion Detector for Energy Systems by integrating a network-based IDS, state-of-the-art machine learning-based IDS, and model-based IDS to detect unknown and stealthy cyberattacks targeting the SCADA networks. The proposed IDS uses synchrophasor measurements and cyber logs to learn patterns of different scenarios based on spatiotemporal behaviors of power systems. As a proof of concept, we implement and validate the proposed IDS by leveraging resources available at the National Renewable Energy Laboratory's Energy Systems Integration Facility test bed. Experimental results show promising performance in detecting cyberattacks while providing realtime visualization of power system measurements and cyber logs.

machine-learning intrusion detection system↗
DOE OSTI2022

Time-Based CAN IDS Paper Results Code

Modern vehicles are complex cyber-physical systems made of hundreds of electronic control units (ECUs) that communicate over controller area networks (CANs). This inherited complexity has expanded the CAN attack surface which is vulnerable to message injection attacks. These injections change the overall timing characteristics of messages on the bus, and thus, to detect these malicious messages, time-based intrusion detection systems (IDSs) have been proposed. However, time-based IDSs are usually trained and tested on low-fidelity datasets with unrealistic, labeled attacks. This makes difficult the task of evaluating, comparing, and validating IDSs. Here we detail and benchmark four time-based IDSs against the newly published ROAD dataset, the first open CAN IDS dataset with real (non-simulated) stealthy attacks with physically verified effects. We found that methods that perform hypothesis testing by explicitly estimating message timing distributions have lower performance than methods that seek anomalies in a distribution related statistic. In particular, these “distribution-agnostic” based methods outperform “distribution-based” methods by at least 55% in area under the precision-recall curve (AUC-PR). Our results expand the body of knowledge of CAN time-based IDSs by providing details of these methods and reporting their results when tested on datasets with real advanced attacks. Finally, we develop an after-market plug-in detector using lightweight hardware, which can be used to deploy the best performing IDS method on nearly any vehicle.

Moriano, Pablo [Oak Ridge National Lab. (ORNL), Oa↗
DOE OSTI2023

Malicious Cyber Activity Detection using Zigzag Persistence

In this study we synthesize zigzag persistence from topological data analysis with autoencoder-based approaches to detect malicious cyber activity, and derive analytic insights. Cybersecurity aims to safeguard computers, networks, and servers from various forms of malicious attacks, including network damage, data theft, and activity monitoring. We focus on the cybersecurity domain and investigate the detection of malicious activity using log data. We consider the dynamics of the log data and explore the changing topology of a hypergraph representation of this data to gain insights into the underlying activity. These hypergraphs capture complex interactions between processes, together with their temporal information. To study the changing topology we use zigzag persistence, which captures how topological features persist at multiple dimensions over time. We observe that this detects malicious activity in a cyber data set. To automate this detection we implement an autoencoder trained on a vectorization of the resulting zigzag persistence barcodes. Our experimental results demonstrate the effectiveness of the autoencoder in detecting malicious activity. Overall, this study highlights the potential of zigzag persistence and its combination with temporal hypergraphs for analyzing cybersecurity log data and detecting malicious behavior.

hypergraphs, temporal hypergraph, topological data↗
DOE OSTI2020

Assessing Anomaly-Based Intrusion Detection Configurations for Industrial Control Systems

To reduce cost and ease maintenance, industrial control systems (ICS) have adopted Ethernetbased interconnections that integrate operational technology (OT) systems with information technology (IT) networks. This integration has made these critical systems vulnerable to attack. Security solutions tailored to ICS environments are an active area of research. Anomalybased network intrusion detection systems are well-suited for these environments. Often these systems must be optimized for their specific environment. In prior work, we introduced a method for assessing the impact of various anomaly-based network IDS settings on security. This paper reviews the experimental outcomes when we applied our method to a full-scale ICS test bed using actual attacks. Our method provides new and valuable data to operators enabling more informed decisions about IDS configurations.

Gillen, Rob↗
DOE OSTI2024

Semantic Stealth: Crafting Covert Adversarial Patches for Sentiment Classifiers Using Large Language Models

Deep learning models have been shown to be vulnerable to adversarial attacks, in which perturbations to their inputs cause the model to produce incorrect predictions. As opposed to adversarial attacks in computer vision, where small changes introduced to pixel values can drastically alter a model's output while remaining imperceptible to humans, text-based attacks are difficult to conceal due to the discrete nature of tokens. Consequently, unconstrained gradient-based attacks often produce adversarial examples that lack semantic meaning, rendering them detectable through visual inspection or perplexity filters. In contrast to methods that rely on gradient-based optimization in the embedding space, we propose an approach that leverages a Large Language Model's ability to generate grammatically correct and semantically meaningful text to craft adversarial patches that seamlessly blend in with the original input text. These patches can be used to alter the behavior of a target model, such as a text classifier. Since our approach does not rely on gradient backpropagation, it only requires access to the target model's confidence scores, making it a grey-box attack. We demonstrate the feasibility of our approach using open-source LLMs, including Intel's Neural Chat, Llama2, and Mistral-Instruct, to generate adversarial patches capable of altering the predictions of a distilBERT model fine-tuned on the IMDB reviews dataset for sentiment classification.

Roa Carvajal, Maria↗
DOE OSTI2022

Dynamic, resilient virtual sensing system and shadow controller for cyber-attack neutralization

An industrial asset may have monitoring nodes (e.g., sensor or actuator nodes) that generate current monitoring node values. An abnormality detection and localization computer may receive the series of current monitoring node values and output an indication of at least one abnormal monitoring node that is currently being attacked or experiencing a fault. An actor-critic platform may tune a dynamic, resilient state estimator for a sensor node and output tuning parameters for a controller that improve operation of the industrial asset during the current attack or fault. The actor-critic platform may include, for example, a dynamic, resilient state estimator, an actor model, and a critic model. According to some embodiments, a value function of the critic model is updated for each action of the actor model and each action of the actor model is evaluated by the critic model to update a policy of the actor-critic platform.

Roychowdhury, Subhrajit↗
DOE OSTI2022

Integrated Pest Management (IPM) for Early Detection Algal Crop Protection. Final Report

During large-scale, outdoor algal biomass growth, production strain(s) are subject to attack by pathogens, predators, and non-productive competitors, compromising the biomass yield. The project team at UCSD developed and demonstrated the effectiveness of Volatile Organic Compound, VOC, analysis via mass spectrometry (MS) as an early detection system for the presence of production algal ponds infection. The MS detection can then trigger high-resolution melt analysis (HRMA) and enhanced quantitative PCR (qPCR) to identify predatory or pathogenic species precisely. This study gathered the foundational data informing how wholly automated systems monitor the health of production ponds. By detecting the presence of low molecular weight VOCs in the air space above ponds, the instrument was able to mimic “sniffing” the health of the algae pond. This early warning system will be free growers from time-consuming and costly regular surveillance of ponds with the current techniques, such as qPCR and flow-cam assays, which are slower, less sensitive, and not easily fully automated, resulting in increased production efficiency through the reduction of crop loss. This project demonstrated that Chemical Ionization Mass Spectrometry, CIMS, could serve as a real-time monitor of ponds health tracking up to 100 different VOCs simultaneously for continuous periods up to 60 days without interruption, signaling infection within an algal crop 24 to 36 hours prior to techniques such as qPCR and microscopy. While mass spectrometry is an expensive tool, this simple VOC sampling system proved not only to be sensitive and robust but could to multiplexed to monitor several ponds, lowering the overall cost serially. This technology demonstrated a reduction in biomass production cost by approximately 50% compared to growers not employing any detection methodology.

09 BIOMASS FUELS↗
DOE OSTI2020

Innovation in Radiological Security, Part 1 of 2 – Using a Cloud Solution to Compress the Timely Detection Model

The design and implementation of new security technologies must account for numerous and complex operational challenges. For example, traditionally isolated systems must now survive amid the proliferation of network connectivity and endure the dynamic environments created by organizations tolerating bring-your-own-device policies. When evaluating the cyber, physical, or cyber-physical security of an asset, a common practice in the security industry is to apply the Timely Detection Model (TDM)—a versatile concept that relates the security functions of detection, delay, and response to the progression of an oppositional force’s attack timeline. If implemented correctly, security enhancements can compress the TDM to offer efficiencies to the stakeholders responsible for adjudicating threat scenarios. The efficiencies gained by the response force allow for more effective protection strategies to be realized. One such enhancement, deployed within the radiological security domain—the Sentry-Remote Monitoring System (Sentry-RMS)—is a stand-alone security system that detects, assesses, and communicates priority alarms as a means of thwarting internal and external threats. The SEntry-RMS CommUnications and REsponse (Sentry-SECURE) platform—an optional feature of the Sentry-RMS—is being developed to facilitate more efficient alarm adjudication by site stakeholders and, if necessary, a faster response by law enforcement. This Cloud-hosted platform receives protected information from deployed Sentry-RMS units and relays it to stakeholders that have vested interests in maintaining an elevated level of situational awareness. Operationally, this enables real-time delivery of high-priority alarm and video imagery directly to an identified response stakeholder, such as local law enforcement or site management, via natively developed mobile applications or full platform integration. The Sentry-SECURE platform, as implemented by the U.S. Department of Energy’s Office of Radiological Security, is an example of an innovative security technology that compresses the TDM by (1) enabling a more efficient time to target and (2) better informing a response force’s predetermined tactics, techniques, and procedures. This paper explores the platform’s operational roles, highlights its principal functions, and presents a use case that demonstrates how the platform provides enhanced situational awareness when adjudicating priority alarms.

Sentry-RMS, Timely Detection Model, Sentry-SECURE↗
DOE OSTI2024

A hardware-in-the-loop (HIL) testbed for cyber-physical energy systems in smart commercial buildings

In recent years, there has been a growing trend toward the development of smart buildings that rely on cyber-physical systems (CPS) to optimize occupant comfort, safety, and energy efficiency. To ensure the reliable and efficient operation of CPS with designed control strategies, it is important to evaluate their performance under various scenarios before deploying them in the real world. This is where a Hardware-in-the-loop (HIL) testbed designed for studying sensor and control-related studies in smart buildings can be highly valuable. With the growing threat of cyber-attacks and physical faults targeting smart buildings, it is essential to ensure the security of building operations. A HIL testbed can emulate cyber-attack and physical fault scenarios, allowing researchers to develop and test threat detection and mitigation algorithms. This enables researchers to identify potential issues and optimize the algorithms in a safe and controlled environment before they are deployed in real-world settings, reducing the risk of failures that can negatively impact occupant comfort, safety, and energy efficiency. Therefore, this paper developed a HIL testbed designed for cyber-physical energy systems (e.g. buildings automation system (BAS)) in smart commercial buildings. The HIL testbed is comprised of a real-time building and Heating, Ventilation, and Air-Conditioning (HVAC) emulator using Modelica-based dynamic models, a set of BAS controllers, and a BAS computer server. The data generation capability of the HIL testbed is demonstrated by tracking normal and faulty operating data in the BAS, as well as monitoring detailed network traffic in the local BAS network. Here, this study further demonstrates the HIL testbed’s capability by conducting case studies on real-time physical fault and cyber-attack experiments using a Department of Energy (DOE) prototype commercial building. It is anticipated that the fully functional HIL testbed will be utilized for a variety of sensor and control-related studies, including but not limited to testing, developing, validating of different HVAC control strategies, fault detection & diagnosis, energy monitoring and analysis, cyber security study, etc.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗
DOE OSTI2023

Moving-horizon false data injection attack design against cyber–physical systems

Systematic attack design is essential to understanding the vulnerabilities of cyber–physical systems (CPSs), to better design for resiliency. In particular, false data injection attacks (FDIAs) are well-known and have been shown to be capable of bypassing bad data detection (BDD) while causing targeted biases in resulting state estimates. However, their effectiveness against moving horizon estimators (MHE) is not well understood. In fact, this paper shows that conventional FDIAs are generally ineffective against MHE. One of the main reasons is that the moving window renders the static FDIA recursively infeasible. Here, this paper proposes a new attack methodology, moving-horizon FDIA (MH-FDIA), by considering both the performance of historical attacks and the current system’s status. Theoretical guarantees for successful attack generation and recursive feasibility are given. Numerical simulations on the IEEE-14 bus system further validate the theoretical claims and show that the proposed MH-FDIA outperforms state-of-the-art counterparts in both stealthiness and effectiveness. In addition, an experiment on a path-tracking control system of an autonomous vehicle shows the feasibility of the MH-FDIA in real-world nonlinear systems.

42 ENGINEERING↗
DOE OSTI2021

Cyber Protection of Grid-Connected Devices Through Embedded Online Security

Cybersecurity research regarding the electric power grid has primarily been focused on protecting the communication layer of grid-connected devices against cyber-attack threats. Although many developed methods have greatly reduced the effects of a cyber-attack on the vulnerabilities of grid-connected devices, discovering new vulnerabilities is inevitable and a constant threat. As a result, the overall reliability and security of network communications with regard to grid-connected devices is a concern. Here, this paper proposes a method that further secures a system by focusing on the control and hardware layer of grid-connected devices. The device’s controller firmware will be validated and authenticated using integrated device emulation resources prior to being activated to control the grid-connected device. This verification process is performed while the controller is online and actively controlling power flows related to the device. Therefore, an attack to the system through a malicious firmware patch would be detected by the online security and rejected while safely maintaining continuous and stable control of the device. This method integrates the concepts of firmware hot-patching, digital twins, and active monitoring into an overall cybersecurity protection system.

cybersecurity↗
DOE OSTI2021

Review of Intrusion Detection Methods and Tools for Distributed Energy Resources

Recent trends in the growth of distributed energy resources (DER) in the electric grid and newfound malware frameworks that target internet of things (IoT) devices is driving an urgent need for more reliable and effective methods for intrusion detection and prevention. Cybersecurity intrusion detection systems (IDSs) are responsible for detecting threats by monitoring and analyzing network data, which can originate either from networking equipment or end-devices. Creating intrusion detection systems for PV/DER networks is a challenging undertaking because of the diversity of the attack types and intermittency and variability in the data. Distinguishing malicious events from other sources of anomalies or system faults is particularly difficult. New approaches are needed that not only sense anomalies in the power system but also determine causational factors for the detected events. In this report, a range of IDS approaches were summarized along with their pros and cons. Using the review of IDS approaches and subsequent gap analysis for application to DER systems, a preliminary hybrid IDS approach to protect PV/DER communications is formed in the conclusion of this report to inform ongoing and future research regarding the cybersecurity and resilience enhancement of DER systems.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2025

SURVEILLANCE DETECTION FOR TRANSPORTATION OPERATIONS PERSONNEL TO PREVENT HIJACKING, THEFT, SABOTAGE, AND MALICIOUS SECURITY EVENTS DURING TRANSPORTING NUCLEAR MATERIAL

The secure transportation of high-consequence materials, including nuclear and radiological assets, is a critical global priority in the face of escalating terrorism, security threats, and violent protests targeting these operations. Effective surveillance detection—the ability to identify, assess, and respond to potential threats across a continuum of scenarios—is paramount in addressing these challenges. This paper outlines a phased, multi-tiered training program designed to strengthen the surveillance detection capabilities of organizations responsible for nuclear material transport. The proposed training program adopts a progressive approach, gradually increasing in technical complexity to provide participants with comprehensive knowledge and tools for implementing robust security strategies. It targets a wide spectrum of stakeholders, including competent authorities, regulators, inspectors, shippers, carriers, law enforcement, and emergency response personnel, equipping them to plan, evaluate, and safeguard nuclear material transportation effectively. Each phase of the program emphasizes distinct elements of the surveillance detection continuum and transport security, focusing on critical topics such as threat identification, adversary task timelines, protective methodologies, and attack mitigation strategies. The training framework is anchored in technical exchanges and scenario-driven courses that reflect real-world complexities and challenges. By addressing the surveillance detection continuum comprehensively—from early threat assessment to active countermeasures—the program reinforces global efforts to secure nuclear assets. It aligns with international security objectives and fosters a strong security culture within participating organizations, ensuring personnel are prepared to counter potential threats and maintain the safe, secure movement of these materials. Ultimately, this initiative aims to enhance preparedness, security, and response capabilities, supporting the global mission to safeguard high-consequence materials against evolving threats.

Zineddin, Dr. Z. [ORNL] (ORCID:0009000848740725)↗
DOE OSTI2020

Using new edges for anomaly detection in computer networks

Creation of new edges in a network may be used as an indication of a potential attack on the network. Historical data of a frequency with which nodes in a network create and receive new edges may be analyzed. Baseline models of behavior among the edges in the network may be established based on the analysis of the historical data. A new edge that deviates from a respective baseline model by more than a predetermined threshold during a time window may be detected. The new edge may be flagged as potentially anomalous when the deviation from the respective baseline model is detected. Probabilities for both new and existing edges may be obtained for all edges in a path or other subgraph. The probabilities may then be combined to obtain a score for the path or other subgraph. A threshold may be obtained by calculating an empirical distribution of the scores under historical conditions.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Complete Evaluation on Advanced Reactor Machine Learning Subversion Attacks (Final)

Navigating through the world of Artificial Intelligence (AI) in nuclear reactors and their Instrumentation and Control (I&C) systems demands a careful, deliberate journey. AI’s capability to manage massive datasets and streamline control systems has indeed carved out a significant role in various sectors, including nuclear energy. However, while AI, and particularly Large Language Models (LLMs), bring a lot to the table in terms of operational efficiency and anomaly detection, they also expose the sector to a new breed of cybersecurity threats, like Inference Attacks, Adversarial Attacks, and Trojan Attacks. This guide is designed to be a straightforward manual, diving deep into the intertwining worlds of AI and cybersecurity within nuclear reactors, and tailoring insights for three crucial audiences: I&C Vendors/Developers, Nuclear Regulators, and Nuclear Reactor Operators and Cyber Defense Teams. (1) Section 2, directed at I&C Vendors/Developers, will provide a clear and focused look at several cybersecurity attacks, offering practical recommendations and detailed scenarios related to AI cybersecurity. This section isn’t just about identifying problems but also about giving solid, usable solutions. (2) Section 3, meant for Nuclear Regulators, gets straight to the point about regulations, policy suggestions, and guidelines that are needed to lay down a robust, secure, and ethical foundation for the application of AI in nuclear operations. The focus is on making sure that everything adheres to international standards and laws while being practicable and clear-cut. (3) Section 4, aimed at Nuclear Reactor Operators and Cyber Defense Teams, offers an exhaustive exploration and technical reports, with clear recommendations and scenario analyses vital to protect operational environments and guarantee the secure application of AI in nuclear reactor operations. The goal is simple: as we step into an era where AI becomes a fundamental element of our technological and energy infrastructures, this guide is here to act as a clear, direct handbook, ensuring that AI is implemented within the nuclear sector in a manner that is secure, responsible, and practical. It’s about striking a balance – optimizing the undeniable benefits offered by AI while securing and shielding against potential cyber threats as we move through this new and complex landscape.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2022

Time Sequence Machine Learning-Based Data Intrusion Detection for Smart Voltage Source Converter-Enabled Power Grid

Smart inverters of distributed energy resources can enable cloud computing, condition monitoring, result visualization, remote control, and peer-to-peer energy trading in advanced power systems. However, the advent of data injection attacks in the communication architecture can alter measurement characteristics of power grids and have devastating consequences. In this article, we propose a time sequence machine learning-based anomaly detection methodology for detecting cyber intrusion into control signal setpoints and dc voltage signal measurement bias of the voltage source converter (VSC) in wind generators. We first investigated the effects of four types of denial of service, tampering signal, and stealthy-type data intrusion attacks on smart VSCs and overall wind farms. We then proposed a novel time sequence machine learning-based intrusion detection framework that can be implemented to detect different cyberattacks in the VSCs. The performance of the proposed framework has been compared with that of autoencoder and clustering-based intrusion detection framework. The proposed framework was validated by using the IEEE 39 bus power system in the presence of four wind farms in different locations. Using several metrics for intrusion detection performance, we validated the effectiveness of the proposed framework.

42 ENGINEERING↗