Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Attack Tree”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2
All sourcesNASA NTRSDOE OSTI
DOE OSTI2022

Evaluation of Joint Cyber/Safety Risk in Nuclear Power Systems

This report presents an analysis of the Emergency Core Cooling System (ECCS) for a generic Boiling Water Reactor (BWR)-4 NPP. The Electric Power Research Institute (EPRI) developed Hazards and Consequences Analysis for Digital Systems (HAZCADS) process is applied to the ECCS and its subsystems to identify unsafe control actions (UCAs) which act as possible cyber events of concern. The analysis is performed for two design basis events: Small-break Loss of Coolant Accident (SLOCA) and general transients (TRANS), such as unintended reactor trip. In previous work, HAZCADS UCAs were combined with other cyber-attack analysis to develop a risk-informed approach; however, this was for a single system. This report explores advanced systems engineering modeling approaches to model the interactions between digital assets across multiple systems which may be targeted by cyber adversaries. The complex and interdependent design of digital systems has the potential to introduce emergent cyber properties that are generally not covered by hazard analyses nor formal nuclear Probabilistic Risk Assessment (PRA). The R&D and supporting analysis presented here explores approaches to predict and manage how interdependent system properties effect risk. To show the potential impact of a successful cyber-attack to formal PRA event tree probabilities, HAZCADS analysis was also used. HAZCADS was also used to model the automatic depressurization system (ADS) automatic actuation. This analysis extended to an integrated system analysis for common-cause failure (CCF). In this aspect, the HAZCADS analysis continued by analyzing plant design details for system connectivity in support of critical plant functions. A dependency matrix was developed to depict the integrated functionality of the interconnected systems. Areas of potential CCF are indicated. Future work could include adversary attack development to show how CCF could be caused, resulting in PRA events. Across the multiple systems that comprise the ECCS, the analysis shows that the change in such probabilities was very different between systems. This indicates that some systems have a larger potential risk impact from successful cyber-attack or digital failure, which indicates a need for these systems to have a higher priority for design and defensive measures. Furthermore, we were able to establish that a risk analysis using any arbitrary threat model establishes an ordering of components with regard to cyber-risk. This ordering can be used to influence the overall system design with an eye to lowering risk, or as a way to understand real-time risk to operational systems based on a current threat landscape. Expert knowledge of both the analysis process and the system being analyzed is required to perform a HAZCADS analysis. The need for a tiered risk analysis is demonstrated by the results of this report.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
DOE OSTI2024

Local carbon reserves are insufficient for phloem terpene induction during drought in Pinus edulis in response to bark beetle–associated fungi

Stomatal closure during drought inhibits carbon uptake and may reduce a tree's defensive capacity. Limited carbon availability during drought may increase a tree's mortality risk, particularly if drought constrains trees' capacity to rapidly produce defenses during biotic attack. We parameterized a new model of conifer defense using physiological data on carbon reserves and chemical defenses before and after a simulated bark beetle attack in mature Pinus edulis under experimental drought. Attack was simulated using inoculations with a consistent bluestain fungus (Ophiostoma sp.) of Ips confusus, the main bark beetle colonizing this tree, to induce a defensive response. Trees with more carbon reserves produced more defenses but measured phloem carbon reserves only accounted for c. 23% of the induced defensive response. Our model predicted universal mortality if local reserves alone supported defense production, suggesting substantial remobilization and transport of stored resin or carbon reserves to the inoculation site. Our results show that de novo terpene synthesis represents only a fraction of the total measured phloem terpenes in P. edulis following fungal inoculation. Without direct attribution of phloem terpene concentrations to available carbon, many studies may be overestimating the scale and importance of de novo terpene synthesis in a tree's induced defense response.

59 BASIC BIOLOGICAL SCIENCES↗
DOE OSTI2021

Hotter droughts alter resource allocation to chemical defenses in piñon pine

Abstract Heat and drought affect plant chemical defenses and thereby plant susceptibility to pests and pathogens. Monoterpenes are of particular importance for conifers as they play critical roles in defense against bark beetles. To date, work seeking to understand the impacts of heat and drought on monoterpenes has primarily focused on young potted seedlings, leaving it unclear how older age classes that are more vulnerable to bark beetles might respond to stress. Furthermore, we lack a clear picture of what carbon resources might be prioritized to support monoterpene synthesis under drought stress. To address this, we measured needle and woody tissue monoterpene concentrations and physiological variables simultaneously from mature piñon pines ( Pinus edulis ) from a unique temperature and drought manipulation field experiment. While heat had no effect on total monoterpene concentrations, trees under combined heat and drought stress exhibited ~ 85% and 35% increases in needle and woody tissue, respectively, over multiple years. Plant physiological variables like maximum photosynthesis each explained less than 10% of the variation in total monoterpenes for both tissue types while starch and glucose + fructose measured 1-month prior explained ~ 45% and 60% of the variation in woody tissue total monoterpene concentrations. Although total monoterpenes increased under combined stress, some key monoterpenes with known roles in bark beetle ecology decreased. These shifts may make trees more favorable for bark beetle attack rather than well defended, which one might conclude if only considering total monoterpene concentrations. Our results point to cumulative and synergistic effects of heat and drought that may reprioritize carbon allocation of specific non-structural carbohydrates toward defense.

59 BASIC BIOLOGICAL SCIENCES↗
DOE OSTI2019

Evaluation of Anomaly Detection for Wide-Area Protection Using Cyber Federation Testbed

Cyber physical security research for smart grid is currently one of the nation's top R&D priorities. The existing vulnerabilities in the legacy grid infrastructure make it particularly susceptible to countless cyber-attacks. There is a growing emphasis towards building interconnected, sophisticated federated testbeds to perform realistic experiments by allowing the integration of geographically-dispersed resources in the dynamic cyber-physical environment. In this paper, we present a cyber (network) based federation testbed to validate the performance of an anomaly detector in context of a Wide Area Protection (WAP) security. Specifically, we have utilized the resources available at the Iowa State University Power Cyber (ISU PCL) Laboratory to emulate the substation and local center networks; and the US Army Research Laboratory (ARL); to emulate the regional control center network. Initially, we describe a hardware-in-the loop based experimental setup for implementing data integrity attacks on an IEEE 39 bus system. We then perform network packet analysis focusing on latency and bandwidth as well as evaluate the performance of a decision tree based anomaly detector in measuring its ability to identify different attacks. Our experimental results reveal the computed wide area network latency; bandwidth requirement for minimum packet loss; and successful performance of the anomaly detector. Our studies also highlight the conceptual architecture necessary for developing the federated testbed, inspired by the NASPI network.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2017

Identification of the accident-related critical digital assets based on probabilistic safety analysis results - 225

Digital I and C systems have been developed and installed in nuclear power plants, and due to installation of the digital I and C systems, cyber security concerns are increasing in nuclear industry. However, there are too many critical digital assets (CDAs) to be inspected in digitalized NPPs. In order to reduce the inefficiency of regulation in nuclear facilities, the critical digital assets that are directly related to an accident are elicited by using the probabilistic safety assessment results. Target initial events are selected, and their heading are analyzed through event tree analysis. Among the headings, the headings that can be proceeded directly to the core damage by the cyber-attack are finally selected as the target of deriving the minimum cut-sets. Based on success criteria of each heading, we analyze the fault trees and derive the minimum set-cuts. In terms of original PSA, the value of probability for the cut-sets is important but the probability is not important in terms of cyber security of NPPs. The important factors is the number of basic events consisting of the minimal cut-sets that is proportional to vulnerability. Finally, the process for identifying accident-related CDAs is suggested based on PSA results. The results of this study are expected to be used to derive the linkage between cyber-attack and accident, and to develop the final core digital asset identification methodology and effective regulatory method. (authors)

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2019

Mechanisms of a coniferous woodland persistence under drought and heat

Predictions of warmer droughts causing increasing forest mortality are becoming abundant, yet fewer studies have investigated the mechanisms of forest persistence. To examine the resistance of forests to warmer droughts, we used a five-year precipitation reduction (~45% removal), heat (+4°C above ambient) and combined drought and heat experiment in an isolated stand of mature Pinus edulis-Juniperus monosperma . Despite severe experimental drought and heating, no trees died, and we observed only minor evidence of hydraulic failure or carbon starvation. Two mechanisms promoting survival were supported. First, access to bedrock water, or ‘hydraulic refugia’ aided trees in their resistance to the experimental conditions. Second, the isolation of this stand amongst a landscape of dead trees precluded ingress by Ips confusus , frequently the ultimate biotic mortality agent of piñon. These combined abiotic and biotic landscape-scale processes can moderate the impacts of future droughts on tree mortality by enabling tree avoidance of hydraulic failure, carbon starvation, and exposure to attacking abiotic agents.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2020

Data-driven Cyberattack Detection for Photovoltaic (PV) Systems through Analyzing Micro-PMU Data

With increasing exposure to software-based sensing and control, Photovoltaic (PV) systems are facing higher risks of cyber attacks. Here, to ensure the system stability and minimize potential economic losses, it is imperative to monitor operating states and detect attacks at the early stage. To meet this demand, Micro-Phasor Measurement Units (μPMU) are increasingly popular in monitoring distribution networks. However, due to the relatively low sampling rate, μPMU has not yet been used to detect and classify cyber-attacks in power electronics enabled smart grid. To our knowledge, this is one of the first attempts to use μPMU to detect cyber attacks that degrade the performance of power electronics systems. We propose to apply data-driven methods on micro-PMU data to implement attack detection. We have evaluated data-driven methods, including decision tree (DT), K-nearest neighbor (KNN), support vector machine (SVM), artificial neural network (ANN), long short-term memory (LSTM) and convolutional neural network (CNN). The proposed CNN model achieves the required performances with the highest 99.23% accuracy and 0.9963 F 1 score.

14 SOLAR ENERGY↗
DOE OSTI2018

Decision Tree Based Anomaly Detection for Remedial Action Scheme in Smart Grid using PMU Data

The advanced and persistent cyber threats facing the critical infrastructure such as the smart grid are exponentially rising which require sophisticated defense strategy. Remedial Action Scheme (RAS), also known as Special Protection Scheme (SPS), relies on the interconnected cyber physical system for automated protection which is exposed to the multitude of vulnerabilities. In this paper, we propose an innovative approach to develop an Intelligent Remedial Action Scheme (IRAS) which can detect and distinguish cyber attacks from the physical disturbances in smart grid and later take smart corrective actions as required to minimize the impact on system reliability and economy. Specifically, we have proposed the decision tree based anomaly detection methodology which can distinguish between the normal tripping during power line faults and malicious tripping attack on the physical relays in the context of RAS. The classification model is developed using differential features of voltage and current phasors. Next, as a proof of concept, we have implemented and validated the proposed methodology in cyber physical environment at Iowa State's PowerCyber testbed. Finally, the proposed methodology is tested on modified IEEE 39 bus system in offline and real-time mode. Our experimental results show that the proposed method is efficient in detecting attacks and performing corrective actions within an acceptable time frame.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

An Intelligent Distributed Ledger Construction Algorithm for IoT

Blockchain is the next generation of secure data management that creates near-immutable decentralized storage. Secure cryptography created a niche for blockchain to provide alternatives to well-known security compromises. However, design bottlenecks with traditional blockchain data structures scale poorly with increased network usage and are extremely computation-intensive. This made the technology difficult to combine with limited devices, like those in Internet of Things networks. In protocols like IOTA, replacement of blockchain's linked-list queue processing with a lightweight dynamic ledger showed remarkable throughput performance increase. However, current stochastic algorithms for ledger construction suffer distinct trade-offs between efficiency and security. This work proposed a machine-learning approach with a multi-arm bandit that resolved these issues and was designed for auditing on limited devices. This algorithm was tested in a reinforcement-learning environment simulating the IOTA ledger's construction with a decision tree. This study showed through regret analysis and experimentation that this approach was secure against impulse manipulation attacks while remaining energy-efficient. Although the IOTA protocol was a pioneer for lightweight distributed ledgers, it is expected that future blockchain protocols will adopt techniques similar to those presented in this work.

multi-arm bandit↗
DOE OSTI2024

Large-Scale Hydrogen Storage Cyber Risk Assessment

Hydrogen storage systems may become more widely deployed throughout the country, and so it is possible that individual and interconnected systems will be exposed to cyber-attacks. These events can cause physical and financial harm to employees, people in the vicinity of the facility, and the company that owns the facility. The two main ways bad actors may access information or control from a hydrogen storage facility are through information technology and operations technology devices, the former of which refers to data and information from networked devices and the latter of which refers to onsite controls for the physical system. Both types of entryways into the system should be considered when companies conduct cyber risk assessments and when regulators develop or revise relevant codes and standards. This report analyzes cybersecurity risks associated with a generic hydrogen storage system by outlining the system's purpose and the importance of its cybersecurity. The hydrogen storage system architecture and communication protocols are provided to understand potential cyber vulnerabilities. Later, an event tree analysis is performed on hydrogen operation to identify system weaknesses by outlining potential attack scenarios. This report also identifies critical cyber assets related to different hydrogen operations followed by an examination of potential threats, and the impact of cyber assets on those operational assets.

08 HYDROGEN↗
DOE OSTI2024

Large-Scale Hydrogen Storage Cyber Risk Assessment

Hydrogen storage systems are becoming more widely deployed throughout the country, and as their presence continues to grow, it is possible that individual and interconnected systems will be exposed to cyber-attacks. These events can cause physical and financial harm to employees, people in the vicinity, and to the company that owns the facility. The two main mechanisms malicious actors may access information or control from a hydrogen storage facility are through information technology and operations technology devices, the former of which refers to data and information from networked devices and the latter of which refers to onsite controls for the physical system. Both types of entryways into the system should be considered when facility managers conduct cyber risk assessments and when regulators develop or revise relevant codes and standards. This report analyzes cybersecurity risks applicable to a wide variety of hydrogen storage systems by outlining the system's purpose and the importance of its cybersecurity. The hydrogen storage system architecture and communication protocols are provided to understand potential cyber vulnerabilities. Later, an event tree analysis is performed on hydrogen operation to identify system weaknesses by outlining potential attack scenarios. This report also identifies critical cyber assets related to different hydrogen operations followed by an examination of potential threats, and the impact of cyber assets on those operational assets.

08 HYDROGEN↗
DOE OSTI2022

Operation Upshot-Knothole

A thundering boom and sheet of fire announced a dramatic, once in a lifetime event – the firing of a nuclear projectile from a 280 mm cannon. Travelling seven miles downrange, the projectile detonated 500 feet over the Nevada Test Site’s Frenchman Flat with a force of fifteen kilotons. Although the test was successful, the massive cannon, designed for tactical battlefield use, had a critical flaw. It was too large and cumbersome for mobile combat. The cannon test, codenamed Grable, was part of Operation Upshot-Knothole, the fourth test series conducted in Nevada. Beginning with the Annie test on March 17, 1953, and concluding with the Climax test on June 4th, the Operation consisted of three airdrops, seven tower detonations, and the one artillery shot. As with previous Nevada tests, the demarcation between the weapon development series, Upshot, and the DOD effects tests, Knothole, was blurred. All eleven tests generated data in support of weapon development as well as tactical battlefield applications. During Upshot-Knothole, the University of California Radiation Laboratory (UCRL), conducted its first ever tests, Ruth and Ray. Although neither test was successful, these failures, along with another a year later at Operation Castle, provided the new laboratory with design data leading to future successful tests. The Federal Civil Defense Administration (FCDA) participated in a test series with the general goal of preparing for societal recovery from a nuclear attack. Known as Operation Doorstep, the FCDA’s experiments evaluated the effects of a nuclear attack on food supplies, housing and urban structures, and even a copse of trees transplanted from nearby Mt. Charleston. A contingent of the press witnessed test Annie from an outcropping of rocks, subsequently named News Nob. The presence of the news media, along with the FCDA’s participation, marked a fundamental change in the Nevada test program - a change that that now included the general populace, whose survival was, of course, the rationale for testing. The Department of Defense continued and expanded its Desert Rock exercises of troop exercises, helicopter operations, and evaluation of blast damage to military aircraft, tanks, and guns. Annie, Nancy, Badger, Simon, Encore, and Grable involved larger numbers of personnel than the other five shots. Below is an edited and condensed account of Desert Rock activities compiled by the Defense Threat Reduction Agency.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2017

Fires Following Bark Beetles: Factors Controlling Severity and Disturbance Interactions in Ponderosa Pine

Previous studies have suggested that bark beetles and fires can be interacting disturbances, whereby bark beetle–caused tree mortality can alter the risk and severity of subsequent wildland fires. However, there remains considerable uncertainty around the type and magnitude of the interaction between fires following bark beetle attacks, especially in drier forest types such as those dominated by ponderosa pine (Pinus ponderosa Lawson & C. Lawson). We used a full factorial design across a range of factors thought to control bark beetle-fire interactions, including the temporal phase of the outbreak, level of mortality, and wind speed. We used a three-dimensional physics-based model, HIGRAD/FIRETEC, to simulate fire behavior in fuel beds representative of 60 field plots across five national forests in northern Arizona, USA. The plots were dominated by ponderosa pine, and encompassed a gradient of bark beetle–caused mortality due to a mixture of both Ips and Dendroctonus species. Non-host species included two sprouting species, Gambel oak (Quercus gambelii Nutt.) and alligator juniper (Juniperus deppeana Steud.), as well as other junipers and pinyon pine (Pinus edulis Engelm.). The simulations explicitly accounted for the modifications of fuel mass and moisture distribution caused by bark beetle–caused mortality. We first analyzed the influence of the outbreak phase, level of mortality, and wind speed on the severity of a subsequent fire, expressed as a function of live and dead canopy fuel consumption. We then computed a metric based on canopy fuel loss to characterize whether bark beetles and fire are linked disturbances and, if they are, if the linkage is antagonistic (net bark beetle and fire severity being less than if the two disturbances occurred independently) or synergistic (greater combined effects than independent disturbances). Both the severity of a subsequent fire and whether bark beetles and fire are linked disturbances depended on the outbreak phase of the bark beetle mortality and attack severity, as well as the fire weather (here, wind). Greater fire severity and synergistic interactions were generally associated with the “red phase” (when dead needles remain on trees). In contrast, during the “gray phase” (when dead needles had fallen to the ground), fire severity was either similar to, or less than, green-phase fires and interactions were generally antagonistic, but included both synergistic and neutral interactions. The simulations also revealed that the magnitude of the linkage between these two disturbances was smaller for fires occurring during high wind conditions, especially in the red phase. This complexity might be a reason for the contrasted or controversial perception of bark beetle-fire interactions reported in the literature, since both fire severity and the type and magnitude of the linkage can vary strongly among studies. These results suggest that, for fires burning in the gray phase following moderate levels of mortality, bark beetle–caused mortality may buffer rather than exacerbate fire severity. However, for fires burning under high wind speeds, regardless of the outbreak phase or level of mortality, the near complete loss of canopy fuels may push this ecosystem into an alternative state dominated by sprouting species.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2025

Dynamic probabilistic risk assessment and game theory for cyber security risk analysis in nuclear power plants

Nuclear Power Plants and energy systems have become more prone to cyber-attacks with their digitalization and the increased use of smart equipment. Hence, it is important to quantify the risk associated with cyber-attacks in such systems. Dynamic Probabilistic Risk Assessment which involves studying the evolution of a system due to random events and operator and attacker actions during a cyber-attack by employing a physics-based model of the system is a suitable framework to quantify cybersecurity risk in nuclear power plants. In addition to the plant dynamics, it is also important to model the strategies of the attackers and plant operators for an effective cybersecurity risk assessment. Game theory provides a set of necessary tools to model such strategic interactions. In this research, a framework that integrates dynamic probabilistic risk assessment with game theory for cybersecurity risk analysis in nuclear power plants is presented. The mathematical formulation is derived based on the theory of continuous event trees. We propose a game theory based action model, that utilizes physics-based rewards to define the strategies of attackers and operators at every decision epoch. As a case study, the risk associated with cyber-attacks on the digital components in the secondary side of a pressurized water reactor is studied using a reduced order model. A set of attacker actions and a set of operator actions are defined for the system. The operator and attacker interactions were modelled using simultaneous game, their action policies were computed using the concept of mixed strategy Nash equilibrium and the evolution of the system was studied.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2017

Risk informed cyber security for nuclear power plants - 342

Nuclear power plants are increasingly adding digital components for plant operation, safety, and security. These digital components fill a gap with legacy equipment where replacement components no longer exist. They also benefit operation of the plant by increasing efficiency in power generation, monitoring of equipment and plant parameters, as well as aiding operator control. However, the addition of digital components and systems also adds cyber risks with previously unanalyzed failure modes and attack vectors are introduced with these new systems. These risks are difficult to identify, analyze, and mitigate due to the increasingly complex nature of the digital components and the integration of these components with additional plant processes and communication networks. The research presented in this paper develops a new method that addresses the cyber risk to inform appropriate levels of protection. EPRI and Sandia are working under a Cooperative Research and Development Agreement to develop an effective method of evaluating the cyber risk in production nuclear power facilities. The Cyber Hazards Analysis Risk Methodology (CHARM) focuses on ensuring adequate controls are in place for appropriate cyber protection of the plant from radiological release or generation risk. Existing plant hazards analyses (e.g., PRA, FTA) do not account for software deficiencies or adversarial intent. This method leverages existing plant analyses and MIT's Systems Theoretic Process Analysis (STPA) to create cyber informed fault trees. These new fault trees will provide the basis for comprehensive cyber risk analysis and help ensure potential gaps in cyber security controls are identified and corrected. (authors)

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2022

IViz-OT (Intrusion Detection Visualizer for Operational Technology Network) [SWR-22-63]

The Visualizer dashboard provides grid operator highly-trusted alarming environment for an ongoing or potential cyber-attack based on system anomalies and network-based verification. Once anomalies are detected by the IDS tool (HIDES, NREL SWR-19-65), this platform stores the signatures or alert logs that are generated by the intrusion detector, lays out the detailed summary of the possible alerts, and maps these attacks with high-level scenarios. These scenarios are later combined to define a final event using a decision tree approach and a final report is generated out of this tool for further forensic analysis. It also supports authentication and authorization to support roles-based access control (RBAC) for users and a group of people.

Singh, Vivek Kumar↗
DOE OSTI2020

Detection and Diagnosis of Data Integrity Attacks in Solar Farms Based on Multilayer Long Short-Term Memory Network

Photovoltaic (PV) systems are becoming more vulnerable to cyber threats. In response to this emerging concern, developing cyber-secure power electronics converters has received increased attention from the IEEE Power Electronics Society that recently launched a cyber-physical-security initiative. Here this letter proposes a deep sequence learning based diagnosis solution for data integrity attacks on PV systems in smart grids, including dc–dc and dc–ac converters. The multilayer long short-term memory networks are used to leverage time-series electric waveform data from current and voltage sensors in PV systems. The proposed method has been evaluated in a PV smart grid benchmark model with extensive quantitative analysis. As a comparison, we have evaluated classic data-driven methods, including K-nearest neighbor, decision tree, support vector machine, artificial neural network, and convolutional neural network. Comparison results verify performances of the proposed method for detection and diagnosis of various data integrity attacks on PV systems.

42 ENGINEERING↗