Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “attack detection”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 307 records · Page 17
All sourcesNASA NTRSDOE OSTI
DOE OSTI2023

Autonomous Cyber Defense Against Dynamic Multi-strategy Infrastructural DDoS Attacks

Dynamic Infrastructural Distributed Denial of Service (I-DDoS) attacks constantly change attack vectors to congest core backhaul links and disrupt critical network availability while evading end-system defenses. To effectively counter these highly dynamic attacks, defense mechanisms need to exhibit adaptive decision strategies for real-time mitigation. This paper presents a novel Autonomous DDoS Defense framework that employs model-based reinforcement agents. The framework continuously learns attack strategies, predicts attack actions, and dynamically determines the optimal composition of defense tactics such as filtering, limiting, and rerouting for flow diversion. Our contributions include extending the underlying formulation of the Markov Decision Process (MDP) to address simultaneous DDoS attack and defense behavior, and accounting for environmental uncertainties. We also propose a fine-grained action mitigation approach robust to classification inaccuracies in Intrusion Detection Systems (IDS). Additionally, our reinforcement learning model demonstrates resilience against evasion and deceptive attacks. Evaluation experiments using real-world and simulated DDoS traces demonstrate that our autonomous defense framework ensures the delivery of approximately 96 - 98% of benign traffic despite the diverse range of attack strategies.

Dutta, Ashutosh↗
DOE OSTI2026

The Double-edged Sword of Data-driven Super-Resolution: Adversarial Super-resolution Models

Data-driven super-resolution (SR) methods are often integrated into imaging pipelines as preprocessing steps to improve downstream tasks such as classification and detection. However, these SR models introduce a previously unexplored attack surface into imaging pipelines. In this paper, we present AdvSR, a framework demonstrating that adversarial behavior can be embedded directly into SR model weights during training, requiring no access to inputs at inference time. Unlike prior attacks that perturb inputs or rely on backdoor triggers, AdvSR operates entirely at the model level. By jointly optimizing for reconstruction quality and targeted adversarial outcomes, AdvSR produces models that appear benign under standard image quality metrics while inducing downstream misclassification. We evaluate AdvSR on three SR architectures (SRCNN, EDSR, SwinIR) paired with a YOLOv11 classifier and demonstrate that AdvSR models can achieve high attack success rates with minimal quality degradation. These findings highlight a new model-level threat for imaging pipelines, with implications for how practitioners source and validate models in safety-critical applications.

Sullivan, Haley [ORNL] (ORCID:0000000274069217)↗
NASA NTRS1979

The geographical distribution of lightning: Forestry and range requirements and interests

In an attempt to reduce the response time of the initial attack forces to lightning-caused fire, a lightning detection system that effectively locates accurate directions to lightning discharges to over 200 miles from the detection equipment was developed. The system was first tested in Alaska in 1975. Since that time, further development and operational testing led to the implementation of wide area networks. For the 1979 fire season an eight station network in Alaska is to be implemented that will cover virtually all of the lightning-caused fire areas in the state. In the western United States, an eighteen station network that will cover approximately 85% of eleven states is to be implemented. For the first time, large scale ground discharge lightning distribution information is to be available.

Vance, D. L.↗
DOE OSTI2020

Attack on Grid Event Cause Analysis: An Adversarial Machine Learning Approach

With the ever-increasing reliance on data for data-driven applications in power grids, such as event cause analysis, the authenticity of data streams has become crucially important. The data can be prone to adversarial stealthy attacks aiming to manipulate the data such that residual-based bad data detectors cannot detect them, and the perception of system operators or event classifiers changes about the actual event. This paper investigates the impact of adversarial attacks on convolutional neural network-based event cause analysis frameworks. We have successfully verified the ability of adversaries to maliciously misclassify events through stealthy data manipulations. The vulnerability assessment is studied with respect to the number of compromised measurements. Furthermore, a defense mechanism to robustify the performance of the event cause analysis is proposed. The effectiveness of adversarial attacks on changing the output of the framework is studied using the data generated by real-time digital simulator (RTDS) under different scenarios such as type of attacks and level of access to data.

Niazazari, Iman↗
NASA NTRS2005

Fault-Detection Tool Has Companies 'Mining' Own Business

A successful launching of NASA's Space Shuttle hinges heavily on the three Space Shuttle Main Engines (SSME) that power the orbiter. These critical components must be monitored in real time, with sensors, and compared against expected behaviors that could scrub a launch or, even worse, cause in- flight hazards. Since 1981, SSME faults have caused 23 scrubbed launches and 29 percent of total Space Shuttle downtime, according to a compilation of analysis reports. The most serious cases typically occur in the last few seconds before ignition; a launch scrub that late in the countdown usually means a period of investigation of a month or more. For example, during the launch attempt of STS-41D in 1984, an anomaly was detected in the number three engine, causing the mission to be scrubbed at T-4 seconds. This not only affected STS-41D, but forced the cancellation of another mission and caused a 2-month flight delay. In 2002, NASA s Kennedy Space Center, the Florida Institute of Technology, and Interface & Control Systems, Inc., worked together to attack this problem by creating a system that could automate the detection of mechanical failures in the SSMEs fuel control valves.

Source record↗
DOE OSTI2021

Security proof of practical quantum key distribution with detection-efficiency mismatch

Quantum key distribution (QKD) protocols with threshold detectors are driving high-performance QKD demonstrations. The corresponding security proofs usually assume that all physical detectors have the same detection efficiency. However, the efficiencies of the detectors used in practice might show a mismatch depending on the manufacturing and setup of these detectors. A mismatch can also be induced as the different spatial-temporal modes of an incoming signal might couple differently to a detector. Here we develop a method that allows to provide security proofs without the usual assumption. Our method can take the detection-efficiency mismatch into account without having to restrict the attack strategy of the adversary. Especially, we do not rely on any photon-number cutoff of incoming signals such that our security proof is directly applicable to practical situations. We illustrate our method for a receiver that is designed for polarization encoding and is sensitive to a number of spatial-temporal modes. In our detector model, the absence of quantum interference between any pair of spatial-temporal modes is assumed. For a QKD protocol with this detector model, we can perform a security proof with characterized efficiency mismatch and without photon-number cutoff assumption. Our method also shows that in the absence of efficiency mismatch in our detector model, the key rate increases if the loss due to detection inefficiency is assumed to be outside of the adversary's control, as compared to the view where for a security proof this loss is attributed to the action of the adversary.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

Cognitive IoT and Edge Computing for Intrusion Detection with Federated TinyML

Internet of Things (IoT) and Edge Computing (EC) are rapidly becoming an integral part of the modern society. By 2030, there is estimated to be over 40 billion active and connected IoT devices [1]. This rapid progress also comes with a significant implication on cybersecurity. Back-end infrastructure and systems have a much broader attack than they did previously due to vulnerable IoT/EC devices being connected to wireless networks. This expanding attack surface is a growing concern because IoT/EC are increasingly being used in critical systems such as power grids, health care, and smart homes. To effectively address a problem of this scale, cognitive cyber methods—which can autonomously detect and react to cyber attacks as they develop—are needed. To address this, we bring Artificial Intelligence (AI) and Machine Learning (ML) to IoT/EC devices, using tinyML to monitor voluminous IoT data against cyber threats, and using Federated Learning (FL) to share local detection knowledge across the system while preserving privacy. We propose a novel three-layer architecture: (1) an IoT layer for tinyML-based inference, (2) an edge layer for ML model training, and (3) a cloud layer for FL operations. Using the publicly available 11-class N-BaIoT dataset [2], we demonstrate that this architecture mitigates resource constraints at the IoT layer while improving detection accuracy over standard two-layer designs. An outlier-resistant scaler, feature reduction, and quantization enable the tinyML model to maintain detection accuracy with a reduced model size. Additionally, federated learning that only utilizes the intersection (across heterogenous devices) of the reduced feature set achieves superior detection accuracy compared to locally trained models.

Li, Mingyan [ORNL] (ORCID:0009000569532640)↗
DOE OSTI2020

HIDES: Hybrid Intrusion Detector for Energy Systems

The establishment of a resilient electric grid accompanied by a secure communications network is an ongoing battle as advanced persistent threats continue to exploit existing vulnerabilities in legacy supervisory control and data acquisition system (SCADA) infrastructure. Traditional intrusion detection systems (IDSs) lack consistent performance because of the continuously evolving attack surface of SCADA systems. These shortcomings can be overcome by integrating logical system behavior, protocol-specific knowledge, and data-based learning to develop a comprehensive IDS solution. In this paper, we present a Hybrid Intrusion Detector for Energy Systems by integrating a network-based IDS, state-of-the-art machine learning-based IDS, and model-based IDS to detect unknown and stealthy cyberattacks targeting the SCADA networks. The proposed IDS uses synchrophasor measurements and cyber logs to learn patterns of different scenarios based on spatiotemporal behaviors of power systems. As a proof of concept, we implement and validate the proposed IDS by leveraging resources available at the National Renewable Energy Laboratory's Energy Systems Integration Facility test bed. Experimental results show promising performance in detecting cyberattacks while providing realtime visualization of power system measurements and cyber logs.

machine-learning intrusion detection system↗
NASA NTRSDate not supplied

Characterization of Naturally-Occurring Particles in the Nasa Langley 0.3-m Transonic Cryogenic Tunnel Using PTV

Naturally-occurring particles within the NASA Langley 0.3-m Transonic Cryogenic Tunnel are characterized for their aerodynamic performance using particle tracking velocimetry. Two sets of experiments were conducted to observe different behaviors of the particles. The normal shockwave emanating from the top surface of a supercritical airfoil was used to induce velocity lag in the particles, and the subsequent spatial decay of the velocity was used to estimate the effective diameter of the particles. Mean particle diameters between 1.6 and 1.9 𝝁m were measured, with sizes ranging from 0.2 to 3.5 𝝁m over the entire ensemble. The response of particles to separated flow was investigated. By operating in “high-lift” (low Mach number, high angle of attack) conditions with a semi-span airfoil, the ability of particles to detect separated flow on the upper surface of the airfoil was assessed. Transition from fully attached flow to fully separated flow was observed on the top surface of the airfoil accompanying a variation of angle of attack from 8° to 12°. Examination of velocity distributions indicates less than 10 percent of particle trajectories did not respond to the regions of separated flow. These results are promising, but further facility-specific work is needed to answer the broader question of particle tracking reliability.

Transonic↗
NASA NTRSDate not supplied

Characterization of Naturally-Occurring Particles in the NASA Langley 0.3-m Transonic Cryogenic Tunnel Using PTV

Naturally-occurring particles within the NASA Langley 0.3-m Transonic Cryogenic Tunnel are characterized for their aerodynamic performance using particle tracking velocimetry. Two sets of experiments were conducted to observe different behaviors of the particles. The normal shockwave emanating from the top surface of a supercritical airfoil was used to induce velocity lag in the particles, and the subsequent spatial decay of the velocity was used to estimate the effective diameter of the particles. Mean particle diameters between 1.6 and 1.9 𝝁m were measured, with sizes ranging from 0.2 to 3.5 𝝁m over the entire ensemble. The response of particles to separated flow was investigated. By operating in “high-lift” (low Mach number, high angle of attack) conditions with a semi-span airfoil, the ability of particles to detect separated flow on the upper surface of the airfoil was assessed. Transition from fully attached flow to fully separated flow was observed on the top surface of the airfoil accompanying a variation of angle of attack from 8° to 12°. Examination of velocity distributions indicates less than 10 percent of particle trajectories did not respond to the regions of separated flow. These results are promising, but further facility-specific work is needed to answer the broader question of particle tracking reliability.

Transonic↗
DOE OSTI2022

Time-Based CAN IDS Paper Results Code

Modern vehicles are complex cyber-physical systems made of hundreds of electronic control units (ECUs) that communicate over controller area networks (CANs). This inherited complexity has expanded the CAN attack surface which is vulnerable to message injection attacks. These injections change the overall timing characteristics of messages on the bus, and thus, to detect these malicious messages, time-based intrusion detection systems (IDSs) have been proposed. However, time-based IDSs are usually trained and tested on low-fidelity datasets with unrealistic, labeled attacks. This makes difficult the task of evaluating, comparing, and validating IDSs. Here we detail and benchmark four time-based IDSs against the newly published ROAD dataset, the first open CAN IDS dataset with real (non-simulated) stealthy attacks with physically verified effects. We found that methods that perform hypothesis testing by explicitly estimating message timing distributions have lower performance than methods that seek anomalies in a distribution related statistic. In particular, these “distribution-agnostic” based methods outperform “distribution-based” methods by at least 55% in area under the precision-recall curve (AUC-PR). Our results expand the body of knowledge of CAN time-based IDSs by providing details of these methods and reporting their results when tested on datasets with real advanced attacks. Finally, we develop an after-market plug-in detector using lightweight hardware, which can be used to deploy the best performing IDS method on nearly any vehicle.

Moriano, Pablo [Oak Ridge National Lab. (ORNL), Oa↗
DOE OSTI2023

Malicious Cyber Activity Detection using Zigzag Persistence

In this study we synthesize zigzag persistence from topological data analysis with autoencoder-based approaches to detect malicious cyber activity, and derive analytic insights. Cybersecurity aims to safeguard computers, networks, and servers from various forms of malicious attacks, including network damage, data theft, and activity monitoring. We focus on the cybersecurity domain and investigate the detection of malicious activity using log data. We consider the dynamics of the log data and explore the changing topology of a hypergraph representation of this data to gain insights into the underlying activity. These hypergraphs capture complex interactions between processes, together with their temporal information. To study the changing topology we use zigzag persistence, which captures how topological features persist at multiple dimensions over time. We observe that this detects malicious activity in a cyber data set. To automate this detection we implement an autoencoder trained on a vectorization of the resulting zigzag persistence barcodes. Our experimental results demonstrate the effectiveness of the autoencoder in detecting malicious activity. Overall, this study highlights the potential of zigzag persistence and its combination with temporal hypergraphs for analyzing cybersecurity log data and detecting malicious behavior.

hypergraphs, temporal hypergraph, topological data↗
DOE OSTI2020

Assessing Anomaly-Based Intrusion Detection Configurations for Industrial Control Systems

To reduce cost and ease maintenance, industrial control systems (ICS) have adopted Ethernetbased interconnections that integrate operational technology (OT) systems with information technology (IT) networks. This integration has made these critical systems vulnerable to attack. Security solutions tailored to ICS environments are an active area of research. Anomalybased network intrusion detection systems are well-suited for these environments. Often these systems must be optimized for their specific environment. In prior work, we introduced a method for assessing the impact of various anomaly-based network IDS settings on security. This paper reviews the experimental outcomes when we applied our method to a full-scale ICS test bed using actual attacks. Our method provides new and valuable data to operators enabling more informed decisions about IDS configurations.

Gillen, Rob↗
NASA NTRS1987

High angle of attack position sensing for the Southampton University magnetic suspension and balance system

An all digital five channel position detection system is to be installed in the Southampton University Magnetic Suspension and Balance System (SUMSBS). The system is intended to monitor a much larger range of model pitch attitudes than has been possible hitherto, up to a maximum of a 90 degree angle of attack. It is based on the use of self-scanning photodiode arrays and illuminating laser light beams, together with purpose built processing electronics. The principles behind the design of the system are discussed, together with the results of testing one channel of the system which was used to control the axial position of a magnetically suspended model in SUMSBS. The removal of optically coupled heave position information from the axial position sensing channel is described.

Parker, David H.↗
DOE OSTI2024

Semantic Stealth: Crafting Covert Adversarial Patches for Sentiment Classifiers Using Large Language Models

Deep learning models have been shown to be vulnerable to adversarial attacks, in which perturbations to their inputs cause the model to produce incorrect predictions. As opposed to adversarial attacks in computer vision, where small changes introduced to pixel values can drastically alter a model's output while remaining imperceptible to humans, text-based attacks are difficult to conceal due to the discrete nature of tokens. Consequently, unconstrained gradient-based attacks often produce adversarial examples that lack semantic meaning, rendering them detectable through visual inspection or perplexity filters. In contrast to methods that rely on gradient-based optimization in the embedding space, we propose an approach that leverages a Large Language Model's ability to generate grammatically correct and semantically meaningful text to craft adversarial patches that seamlessly blend in with the original input text. These patches can be used to alter the behavior of a target model, such as a text classifier. Since our approach does not rely on gradient backpropagation, it only requires access to the target model's confidence scores, making it a grey-box attack. We demonstrate the feasibility of our approach using open-source LLMs, including Intel's Neural Chat, Llama2, and Mistral-Instruct, to generate adversarial patches capable of altering the predictions of a distilBERT model fine-tuned on the IMDB reviews dataset for sentiment classification.

Roa Carvajal, Maria↗
DOE OSTI2022

Dynamic, resilient virtual sensing system and shadow controller for cyber-attack neutralization

An industrial asset may have monitoring nodes (e.g., sensor or actuator nodes) that generate current monitoring node values. An abnormality detection and localization computer may receive the series of current monitoring node values and output an indication of at least one abnormal monitoring node that is currently being attacked or experiencing a fault. An actor-critic platform may tune a dynamic, resilient state estimator for a sensor node and output tuning parameters for a controller that improve operation of the industrial asset during the current attack or fault. The actor-critic platform may include, for example, a dynamic, resilient state estimator, an actor model, and a critic model. According to some embodiments, a value function of the critic model is updated for each action of the actor model and each action of the actor model is evaluated by the critic model to update a policy of the actor-critic platform.

Roychowdhury, Subhrajit↗
NASA NTRS1975

Airframe noise measurements on a transport model in a quiet flow facility

An experimental investigation was conducted in an anechoic flow facility to explore problems and methods of measuring the airframe (nonpropulsive) noise associated with a 1/20-scale model of a B-737 transport. The test model geometry simulated the cruise and a landing configuration. Nonpropulsive model noise was detected at various flow velocities and at various angles of attack when turbulent flow was induced over the model. Discrete tones, associated with the extended undercarriage and wheel cavities, and an increase in broadband sound pressure level were observed with the model in a landing configuration.

Shearin, J. G.↗
DOE OSTI2022

Integrated Pest Management (IPM) for Early Detection Algal Crop Protection. Final Report

During large-scale, outdoor algal biomass growth, production strain(s) are subject to attack by pathogens, predators, and non-productive competitors, compromising the biomass yield. The project team at UCSD developed and demonstrated the effectiveness of Volatile Organic Compound, VOC, analysis via mass spectrometry (MS) as an early detection system for the presence of production algal ponds infection. The MS detection can then trigger high-resolution melt analysis (HRMA) and enhanced quantitative PCR (qPCR) to identify predatory or pathogenic species precisely. This study gathered the foundational data informing how wholly automated systems monitor the health of production ponds. By detecting the presence of low molecular weight VOCs in the air space above ponds, the instrument was able to mimic “sniffing” the health of the algae pond. This early warning system will be free growers from time-consuming and costly regular surveillance of ponds with the current techniques, such as qPCR and flow-cam assays, which are slower, less sensitive, and not easily fully automated, resulting in increased production efficiency through the reduction of crop loss. This project demonstrated that Chemical Ionization Mass Spectrometry, CIMS, could serve as a real-time monitor of ponds health tracking up to 100 different VOCs simultaneously for continuous periods up to 60 days without interruption, signaling infection within an algal crop 24 to 36 hours prior to techniques such as qPCR and microscopy. While mass spectrometry is an expensive tool, this simple VOC sampling system proved not only to be sensitive and robust but could to multiplexed to monitor several ponds, lowering the overall cost serially. This technology demonstrated a reduction in biomass production cost by approximately 50% compared to growers not employing any detection methodology.

09 BIOMASS FUELS↗