Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “attack modeling”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 343 records · Page 19
All sourcesNASA NTRSDOE OSTI
DOE OSTI2023

Pest suppression potential varies across 10 bioenergy cropping systems

Abstract Top‐down suppression of herbivores is a fundamental ecological process and a critical service in agricultural landscapes. Adoption of bioenergy cropping systems is likely to become an increasingly important driver causing loss or gain of this service in coming decades. We measured natural pest suppression potential in ten model bioenergy crops in a long‐term experimental array by deploying plasticine sentinel caterpillar mimics, which record imprints from predator attacks. Cropping systems included three intensive annual row crop systems and a range of simple perennial monocultures and more complex polycultures. We compared attack rates across the ten cropping systems and assessed differences over time within a growing season and between the ground level and canopy. We found strong differences in attack rates across cropping systems, usually with more attacks in perennial crops than annuals. However, outcomes varied in space and time, both within and among cropping systems. Birds and small mammals were responsible for most, and sometimes all, attacks in annual crops and were most important early in the season. Chewing arthropod attacks increased over the course of the growing season and were responsible for most attack events in perennial systems. In late summer there were almost no attacks in annual crop canopies, while attack rates in perennial canopies at the same time were quite high and were carried out almost entirely by chewing arthropods. Our results underscore the lack of trophic complexity in annual bioenergy cropping systems relative to perennials. They also illustrate the dramatic changes in predator activity and predation intensity that occur both seasonally and between the ground and plant canopy. Policies and practices that increase the footprint of annual crops for bioenergy are likely to cause a deficit in pest suppression services at local and landscape scales.

60 APPLIED LIFE SCIENCES↗
DOE OSTI2025

Integration and Validation of Multi-Layer Mitigation Strategies for Cyber Physical Systems Resilience (RD2C Capstone I Project) (Technical Report)

This project demonstrated the effectiveness of RD2C-developed, resilience-driven control strategies on high-fidelity system models with high penetrations of inverter-based resources, under the impacts of unexpected natural events and cyber-physical attacks. Controller performance and overall system resilience were quantified using data from a comprehensive suite of scenarios, and provided a clear understanding on how to operate and deploy these mitigation strategies.

42 ENGINEERING↗
DOE OSTI2024

Federated Machine Learning-Based Anomaly Detection System for Synchrophasor Network Using Heterogeneous Data Sets: Preprint

Synchrophasor technology is widely deployed in the energy management system to monitor the grid health at micro level and perform necessary corrective actions in real time; however, integrated phasor devices and data aggregators are exposed to several cybersecurity threats. This paper proposes a federated ML(FML)-based ADS to detect several data integrity attacks in the synchrophasor network. The proposed approach integrates the horizontal FML technique and consists of substation-based local models and a control center-based global model. The proposed methodology includes training local models using heterogeneous data sets that include network and grid information and updating the global model through multiple iterations by sharing model gradients. Finally, the trained global model is applied to identify cyberattacks, normal operation, and physical events. To validate the proof of concept, we used synthetic data sets generated by Mississippi State University and Oak Ridge National Laboratory for training and testing the classification models using the National Renewable Energy Laboratory's high performance computing resources. Our experimental results, computed through several performance measures, reveal that the proposed approach shows consistent performance during the binary, three-class, and multiclass classifications while ensuring privacy of synchrophasor data.

anomaly detection system↗
DOE OSTI2025

PSA 2025 DPRA for Cyber Optimization

Cyberattacks can have many different attack paths, durations, and goals. There are also many different mitigation options involving hardware, software, and/or humans. Evaluating defense options should include quantitative evaluation of overall effectiveness to make cost and risk-informed decisions. Typical cyberattack modeling methods only provide a qualitative evaluation and have difficulty with time dependent scenarios. The main areas of cybersecurity are confidentiality, integrity, and availability. For companies with cyber-physical systems such as advanced nuclear reactors, cyber-related integrity is a requirement set by the U.S. Nuclear Regulatory Commission. But companies are also concerned about availability or reliability as a business case. As cyber threats are evolving to a business-for-hire structure, more attacks focus on disrupting business success and reliability, causing financial and economic stability risk. Companies want reliability analysis while optimizing cost, which requires more than safety modeling methods. Dynamic-state-based and Markov-based modeling provides a method for better cyber scenario modeling with timing and conditional features not found in other numerical evaluation methods. EMRALD (Event Modeling Risk Assessment using Lined Diagrams) is a dynamic risk analysis modeling and simulation tool and has features that reduce modeling issues such as state-base explosion found in Markov-based tools. It has been used to model different time-dependent events including plant behavior and operator procedures. As a general modeling tool, EMRALD can also be used to model cyberattack scenarios with varying mitigation options and quantify effectiveness, producing numerical data for risk-informed decisions. This paper uses EMRALD to demonstrate that dynamic risk analysis can be used for cyber threat modeling to provide insights for design decision-making and optimize defense strategies.

97 - MATHEMATICS AND COMPUTING↗
DOE OSTI2024

Multiphysics Time-Integration for Turbulent Combustion at the Exascale

Turbulent reacting flow systems are often modeled with coupled time-dependent partial differential equations (PDEs). Solving such equations can easily tax the world's largest supercomputers. One pragmatic strategy for attacking such problems is to split the PDEs into components that can more easily be solved in isolation. This generic operator-splitting strategy leads to a set of ordinary differential equations (ODEs) that need to be solved as part of an "outer-loop" time-stepping approach. In many combustion applications, the ODEs to be solved can be very stiff, exhibiting timescales that span many orders of magnitude. The SUNDIALS library provides a plethora of robust time integration algorithms for solving these ODEs on exascale-capable computing hardware, yet for many complex applications (such multicomponent fuels or emissions predictions), the chemical models remain too complex to solve using reasonable resources. The Quasi-Steady State Approximation (QSSA) can be an effective tool for reducing the size and stiffness of the simulations. In this talk, I will discuss the use of the SUDIALS library of ODE solvers together with automatic code generation tools to solve complex turbulent reacting flow problems using QSSA models.

chemistry↗
DOE OSTI2024

Beyond Binary: Automated PLC Memory Forensics through RGB Image Analysis and Deep Learning

The introduction of Industry 4.0 and the evolution of industrial control systems (ICS) to adopt Internet-based technologies enhanced productivity, but have inadvertently increased their vulnerability to cyber-based malicious attacks. When an ICS system is compromised, security analysts need to identify the root cause quickly to start the recovery process and develop mitigation strategies to safeguard against future instances. Memory forensics is critical in the analysis process to ascertain what occurred. To date, approaches to analyze the persistent memory in ICS devices are limited, and almost nonexistent for volatile memory. This paper proposes an automated methodology, COMA, for PLC memory dump analysis using computer vision and deep learning techniques. Specifically, COMA converts the sequences of bytes in a PLC memory dump to RGB pixels and creates a deep learning model that learns the underlying patterns and features of pre-labeled forensic artifacts in images and segments them into distinct regions. COMA then uses the trained model to automatically segment new memory images and extract forensic artifacts. We evaluate COMA on a Schneider Electric Modicon M221 PLC involving two cyber-based attack scenarios: (i) code injection and (ii) code modification. The empirical results show that COMA can successfully detect attack artifacts in memory dumps in both scenarios.

Asmar Awad, Rima↗
DOE OSTI2021

Recommendations for Distributed Energy Resource Access Control

Cybersecurity for internet - connected Distributed Energy Resources (DER) is essential for the safe and reliable operation of the US power system. Many facets of DER cybersecurity are currently being investigated within different standards development organizations, research communities, and industry committees to address this critical need. This report covers DER access control guidance compiled by the Access Controls Subgroup of the SunSpec/Sandia DER Cybersecurity Workgroup. The goal of the group was to create a consensus - based technical framework to minimize the risk of unauthorized access to DER systems. The subgroup set out to define a strict control environment where users are authorized to access DER monitoring and control features through three steps: (a) user is identified using a proof-of-identity, (b) the user is authenticated by a managed database, (c) and the user is authorized for a specific level of access. DER access control also provides accountability and nonrepudiation within the power system control environment that can be used for forensic analysis and attribution in the event of a cyber-attack. This paper covers foundational requirements for a DER access control environment as well as offering a collection of possible policy, model, and mechanism implementation approaches for IEEE 1547-mandated communication protocols.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2024

Observing one-divalent-metal-ion-dependent and histidine-promoted His-Me family I-PpoI nuclease catalysis in crystallo

Metal-ion-dependent nucleases play crucial roles in cellular defense and biotechnological applications. Time-resolved crystallography has resolved catalytic details of metal-ion-dependent DNA hydrolysis and synthesis, uncovering the essential roles of multiple metal ions during catalysis. The histidine-metal (His-Me) superfamily nucleases are renowned for binding one divalent metal ion and requiring a conserved histidine to promote catalysis. Many His-Me family nucleases, including homing endonucleases and Cas9 nuclease, have been adapted for biotechnological and biomedical applications. However, it remains unclear how the single metal ion in His-Me nucleases, together with the histidine, promotes water deprotonation, nucleophilic attack, and phosphodiester bond breakage. By observing DNA hydrolysis in crystallo with His-Me I-PpoI nuclease as a model system, we proved that only one divalent metal ion is required during its catalysis. Moreover, we uncovered several possible deprotonation pathways for the nucleophilic water. Interestingly, binding of the single metal ion and water deprotonation are concerted during catalysis. Our results reveal catalytic details of His-Me nucleases, which is distinct from multi-metal-ion-dependent DNA polymerases and nucleases.

59 BASIC BIOLOGICAL SCIENCES↗
DOE OSTI2022

Cyber-Attack Detection and Accommodation for the Energy Delivery System

The goals of this project were to create a software system with a suite of key algorithms for cyber-attack detection and accommodation providing domain layer protection for critical power generation assets. Example assets included gas and steam turbines, heat recovery steam generators, and electrical generators. The aggressive algorithm goals were aimed at reducing the false positive rates in threat detection to <1% using learnings from many evolving disciplines (power turbine and generator physics, power system modeling, modern control theory, system identification, machine learning, deep learning, mathematics and data science). Additional goals for the algorithms involved localizing threats on-the-fly to know in which monitoring node the effects of attacks are present, and then providing accommodation to keep the system running uninterrupted much of the time in the presence of the attack. Accommodation had a performance goal of providing resiliency when up to 50% of monitoring nodes are in an attack state.

cybersecurity, cyber-physical↗
DOE OSTI2020

Innovation in Radiological Security, Part 1 of 2 – Using a Cloud Solution to Compress the Timely Detection Model

The design and implementation of new security technologies must account for numerous and complex operational challenges. For example, traditionally isolated systems must now survive amid the proliferation of network connectivity and endure the dynamic environments created by organizations tolerating bring-your-own-device policies. When evaluating the cyber, physical, or cyber-physical security of an asset, a common practice in the security industry is to apply the Timely Detection Model (TDM)—a versatile concept that relates the security functions of detection, delay, and response to the progression of an oppositional force’s attack timeline. If implemented correctly, security enhancements can compress the TDM to offer efficiencies to the stakeholders responsible for adjudicating threat scenarios. The efficiencies gained by the response force allow for more effective protection strategies to be realized. One such enhancement, deployed within the radiological security domain—the Sentry-Remote Monitoring System (Sentry-RMS)—is a stand-alone security system that detects, assesses, and communicates priority alarms as a means of thwarting internal and external threats. The SEntry-RMS CommUnications and REsponse (Sentry-SECURE) platform—an optional feature of the Sentry-RMS—is being developed to facilitate more efficient alarm adjudication by site stakeholders and, if necessary, a faster response by law enforcement. This Cloud-hosted platform receives protected information from deployed Sentry-RMS units and relays it to stakeholders that have vested interests in maintaining an elevated level of situational awareness. Operationally, this enables real-time delivery of high-priority alarm and video imagery directly to an identified response stakeholder, such as local law enforcement or site management, via natively developed mobile applications or full platform integration. The Sentry-SECURE platform, as implemented by the U.S. Department of Energy’s Office of Radiological Security, is an example of an innovative security technology that compresses the TDM by (1) enabling a more efficient time to target and (2) better informing a response force’s predetermined tactics, techniques, and procedures. This paper explores the platform’s operational roles, highlights its principal functions, and presents a use case that demonstrates how the platform provides enhanced situational awareness when adjudicating priority alarms.

Sentry-RMS, Timely Detection Model, Sentry-SECURE↗
DOE OSTI2023

Spatio-Temporal Deep Graph Network for Event Detection, Localization, and Classification in Cyber-Physical Electric Distribution System

This work proposes a deep graph learning framework to identify, locate, and classify power, cyber, and cyber power events at the distribution system level. The proposed algorithm jointly exploits spatial, temporal, and node-level cyber and physical data features. The developed graph neural network, together with a deep autoencoder, utilizes physical measurements from distribution level phasor measurement units and cyber data from communication network logs. The spatial structure of the synchrophasor measurements and network is incorporated through a weighted adjacency matrix. The temporal structure is incorporated by defining a spatial operation in the gated recurrent unit. This spatio-temporal learning element resides inside a power event detection, localization, and classification module that provides the degree of confidence for an event label. To accurately pinpoint the location of an event to the nearest bus equipped with a measurement unit, a combination of squared error and proximity score is utilized. Also included is a cyber event detection module that employs heteroskedasticity to analyze the significance of various cyber features during different types of attacks. Finally, a dual-bit cyber-power decision table determines the nature of the event. The proposed method is validated on two distribution systems modeled in OPAL-RT/Hypersim with limited phasor measurement units for different possible physical and cyber events. Further analyses include comparison with other state-of-the-art methods and validation in the presence of measurement noise. As a result, our method outperforms existing approaches and achieves an average detection accuracy of 97.97%, F1-score of 96.88%, precision of 96.53%, and recall of 98.57%.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

Privacy policy robustness to reverse engineering

Differential privacy policies allow one to preserve data privacy while sharing and analyzing data. However, these policies are susceptible to an array of attacks. In particular, often a portion of the data desired to be privacy protected is exposed online. Access to these pre-privacy protected data samples can then be used to reverse engineer the privacy policy. With knowledge of the generating privacy policy, an attacker can use machine learning to approximate the full set of originating data. Bayesian inference is one method for reverse engineering both model and model parameters. We present a methodology for evaluating and ranking privacy policy robustness to Bayesian inference-based reverse engineering, and demonstrated this method across data with a variety of temporal trends.

Kusne, Aaron Gilad↗
DOE OSTI2024

Trust-Based Detection and Mitigation of Cyber Attacks in Distributed Cooperative Control of Islanded AC Microgrids

In this study, we address the challenge of detecting and mitigating cyber attacks in the distributed cooperative control of islanded AC microgrids, with a particular focus on detecting False Data Injection Attacks (FDIAs), a significant threat to the Smart Grid (SG). The SG integrates traditional power systems with communication networks, creating a complex system with numerous vulnerable links, making it a prime target for cyber attacks. These attacks can lead to the disclosure of private data, control network failures, and even blackouts. Unlike machine learning-based approaches that require extensive datasets and mathematical models dependent on accurate system modeling, our method is free from such dependencies. To enhance the microgrid’s resilience against these threats, we propose a resilient control algorithm by introducing a novel trustworthiness parameter into the traditional cooperative control algorithm. Our method evaluates the trustworthiness of distributed energy resources (DERs) based on their voltage measurements and exchanged information, using Kullback-Leibler (KL) divergence to dynamically adjust control actions. We validated our approach through simulations on both the IEEE-34 bus feeder system with eight DERs and a larger microgrid with twenty-two DERs. The results demonstrated a detection accuracy of around 100%, with millisecond range mitigation time, ensuring rapid system recovery. Additionally, our method improved system stability by up to almost 100% under attack scenarios, showcasing its effectiveness in promptly detecting attacks and maintaining system resilience. These findings highlight the potential of our approach to enhance the security and stability of microgrid systems in the face of cyber threats.

Computer Science↗
DOE OSTI2023

Mesh and model requirements for capturing deep-stall aerodynamics in low-Mach-number flows

Here, this work presents a comprehensive computational fluid dynamics investigation of the effects of grid resolution and turbulence-model choice for capturing the unsteady three-dimensional aerodynamic performance of NACA 0012 and 0021 airfoils, with specific focus on the deep-stall regime. At high angles of attack (α), wind turbine blades routinely experience vortex-induced vibrations, which can cause significant structural damages. Accurate predictions of post-stall aerodynamics can identify the frequencies at which such vibrations maybe triggered. In this context, the NACA 0012 airfoil simulations are conducted at a chord-based Reynolds number, Re c =2×10 6 , with the k-ω Shear-Stress Transport Reynolds-Averaged Navier-Stokes (RANS) and Improved Delayed Detached Eddy Simulation (IDDES) hybrid RANS-Large Eddy Simulation turbulence models. The effect of mesh resolution both in the wall-normal and spanwise directions is investigated. Only the IDDES model with a minimum spanwise resolution of 24 cells per chord length correctly predicts the aerodynamic forces. Spectral analysis shows the peak primary shedding frequency at α=30°, which signifies the end of the stall region. In the post-stall regime, both lift and drag frequencies drop asymptotically with increasing α. The Strouhal number, based on normalised chord length, remains nearly constant in this region. Based on this study, NACA 0021 airfoil runs are performed with IDDES for Re c =2.7×10 5 and 2.0×10 6 on the finest wall-normal mesh and three spanwise grids. Simulations conducted on the finer spanwise grids demonstrate grid independence and show good agreement with experiments. The effect of varying Rec on the airfoil frequency statistics is investigated. Additionally, comparison studies are presented to investigate the impact of airfoil thickness on the frequency content at Re c =2.0×10 6 . The results from the study provide guidance on the choice of mesh resolution with the IDDES model to accurately capture aerodynamic quantities for complex industrial applications.

17 WIND ENERGY↗
DOE OSTI2023

Faster-than-real-time Simulation with Demonstration for Resilient DER Integration

The US electric grid is facing operational, stability, and security challenges. Transmission system operators need some measure of visibility into distribution system renewable generation. Distribution system generation needs to support transmission system voltage. The grid is experiencing an expansion in measurement systems. How to take full advantage of this expansion and defend against attacks, both cyber and physical, poses additional challenges. The Faster-than-real-time Simulation with demonstration for Resilient DER Integration project set out to do the following: a. Flatten the voltage profile through the feeders and system for cost saving and voltage stabilization needs. b. Increase the amount of intermittent distributed energy resources (IDERs) that could be deployed on a utility feeder and provide 100% or more energy needed for the demands on that feeder, and c. based on an accurate model (Digital Twin) of the utilities system, be able to detect any abnormalities on the utilities distribution system. To manage the voltage and increase IDER penetration (a,b), Graph Trace Analysis is employed in a time-series, optimal power flow to coordinate the time-varying feedback control setpoints of a distribution feeder’s utility control devices. Under the coordinated control are a Load Tap Changing Transformer, a voltage regulator, and five switched capacitor banks. The feeder serves over 2000 customers, the feeder secondaries are modeled, and the feeder has 2.3 MW of PV generation, corresponding to a 17.4% penetration of PV generation. The feeder model has over 12,000 components, where every customer load bus and PV generator are modeled. The accuracy of the power flow solution is compared against historical meter voltage measurements, the improvement in conservation voltage reduction energy savings as a function of the coordinated control desired voltage profile is investigated, and the increase in PV penetration of the coordinated control over the existing control is presented. To achieve improved control performance while observing system operation constraints, bellwether Advanced Metering Infrastructure (AMI) voltage measurements are used to adjust the desired voltage profile used by the optimal power flow analysis. To detect and alleviate or negate attacks or failures on the distribution and transmission utility grids (c) the grid needs to be resilient and self-healing. In this project software was designed to do just that. At the center of the software is an Integrated System Model (ISM) that spans from transmission to secondary distribution. The ISM is employed in real-time abnormality detection, voltage stability forecasting, and multi-mode control. Testing results are presented for: 1—attacks on utility infrastructure; 2—energy savings from optimal control; 3—distribution system control response during a low voltage transmission system event; 4—cyber-attacks on PV inverters, where physical inverters are used in hard-ware-in-the-simulation-loop studies. Contributions of this work include real-time analysis that spans from three-phase transmission through secondary distribution; an approach for detecting abnormalities that employs measurements from three independent measurement systems; and a multi-mode distribution system control that responds to cyber-attacks, physical attacks, equipment failures, and transmission system needs.

Integrated System Model, Graph Trace Analysis, Adv↗
DOE OSTI2020

Decision system and method for separating faults from attacks

According to some embodiments, a plurality of monitoring nodes may each generate a series of current monitoring node values over time that represent a current operation of the industrial asset. A node classification computer may determine, for each monitoring node, a classification result indicating whether each monitoring node is in a normal or abnormal state. A disambiguation engine may receive the classification results from the node classification computer and associate a Hidden Markov Model (“HMM”) with each monitoring node. For each node in an abnormal state, the disambiguation engine may execute the HMM associated with that monitoring node to determine a disambiguation result indicating if the abnormal state is a result of an attack or a fault and output a current status of each monitoring node based on the associated classification result and the disambiguation result.

Giani, Annarita↗
DOE OSTI2022

Optimizing power system restoration with damaged communications

Utility procedures for power system blackstart and restoration typically assume that energization decisions can be reliably communicated across the grid. In reality, the communications and control network would likely also be affected in power outages, such as those caused by extreme weather events or cyber-attacks. This paper studies the effect of damage to the power system communications and control infrastructure on restoration operations following a blackout. We model the communications infrastructure as a graph, overlaying the power grid, and imposing the requirement that every energized element in the power grid be observable from a control center. We expand on a specialized branch-and-bound algorithm from the literature to optimize the restoration process and devise an initialization heuristic and a rounding heuristic to improve solution speed. We perform numerical experiments on synthetic systems for Illinois and Texas with outages based on a solar flare or hurricane. We compare the results of our specialized branch-and-bound algorithm to the results from (i) the initialization heuristic alone, (ii) a variation of this heuristic that we use as a baseline, and (iii) the restoration optimization for the power system without communications constraints. Here, we find that damage to the communications infrastructure significantly increases the time required to re-energize the grid. Moreover, by simultaneously optimizing communications repairs and grid energization decisions, we are able to re-energize the grid significantly faster than if communications repairs and energization decisions were made independently or with partial coordination, motivating improvements to current industry practice.

97 MATHEMATICS AND COMPUTING↗