Cyberattack Monitoring Architectures for Resilient Operation of Connected and Automated Vehicles
Not Available
Khattak, Zulqarnain H.↗
SEARCH · Engineering Papers
Results for “Cyberattack”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Cyberattack Defense With Cyber-Physical Alert and Control Logic in Industrial Controllers
Not provided.
Engineering↗
Outer Space Cyberattacks: Seven Factors Driving Space-Cybersecurity Concerns
Explore the source record for details and available documents.
Justin W Jackson↗
Cyberattack Forecasting System (CAFS)
Explore the source record for details and available documents.
97 MATHEMATICS AND COMPUTING↗
Dynamic probabilistic risk assessment for electric grid cybersecurity
Electric grid cybersecurity risk has become a significant concern of industries and governments. This paper proposes a dynamic probabilistic risk assessment method for electric grid cybersecurity risk analysis. The proposed method helps reduce the reliance on expert judgment, capture a broad range of components and system dynamics, and model the interactions between various contributing entities (e.g., attacker, operator). In addition, the scenarios with multiple events, such as the occurrence of both cyberattacks and failures of physical components, the occurrence of both cyberattacks and operators’ (in)correct reactions, are considered and analyzed. Further, for each cyberattack scenario, Monte Carlo simulations are used to obtain possible sequences of the system's evolution under study and then derive risk estimates. As an application of the proposed method, the risk assessment method serves as the basis of risk-informed defense resource allocation to improve electric grid cybersecurity. The proposed method is verified using the IEEE 14-bus system by evaluating different security resource allocations for selected cyberattack scenarios.
24 POWER TRANSMISSION AND DISTRIBUTION↗
Resilience of the Electric Grid Through Trustable IoT-Coordinated Assets
The electricity grid has evolved from a physical system to a cyberphysical system with digital devices that perform measurement, control, communication, computation, and actuation. The increased penetration of distributed energy resources (DERs) including renewable generation, flexible loads, and storage provides extraordinary opportunities for improvements in efficiency and sustainability. However, they can introduce new vulnerabilities in the form of cyberattacks, which can cause significant challenges in ensuring grid resilience. We propose a framework in this paper for achieving grid resilience through suitably coordinated assets including a network of Internet of Things devices. A local electricity market is proposed to identify trustable assets and carry out this coordination. Situational Awareness (SA) of locally available DERs with the ability to inject power or reduce consumption is enabled by the market, together with a monitoring procedure for their trustability and commitment. With this SA, we show that a variety of cyberattacks can be mitigated using local trustable resources without stressing the bulk grid. Multiple demonstrations are carried out using a high-fidelity cosimulation platform, real-time hardware-in-the-loop validation, and a utility-friendly simulator.
distributed energy resources↗
Peer-to-peer communication control for resilient operations of networked cyberphysical systems
This report includes two main accomplishments of the peer-to-peer communication control for resilient operation of networked microgrids project in FY24, which include a scheme for cyberattack-aware coordination of networked microgrids for supporting voltages of bulk power systems and a scheme for price signal-based operations of EV-rich networked microgrids with mixed ownership. First, the cyberattack-aware scheme enables networked microgrids to distributedly determine the amount of reactive power injection to support the voltage of bulk power system (BPS) in a fair manner. In this scheme, a risk-informed algorithm is presented to generate the peer-to- peer (P2P) communication graph with minimal risk of attack on communication links. To deal with cyberattacks on MG controllers, the resilient consensus algorithm (CA) is utilized for MG controllers to robustly estimate the total reactive power headroom, from which the MGs can accurately provide the needed amount of reactive power injection for supporting the voltage of BPS. The CA implementation and performance within the P2P communication framework are demonstrated on the IEEE 39-bus system with 6 microgrids contained in the distribution feeder under different cyberattack scenarios. Second, the price-based scheme enables the usage of the real-time price signal for the operations of electric vehicle (EV)-rich networked-microgrids with mixed ownership, in which not all the microgrids can communicate with the distribution system operator (DSO). In this scheme, a max consensus is introduced to enable the real-time price signal to be propagated from the DSO to all the microgrids, from which each microgrid controller will manage the DERs to balance the load demand and the power injection from the EV charging stations within its microgrid. Numerical results over one day with 288 slots of 5-minute intervals on the modified 123-node test feeder including 3 microgrids with high penetration of EV are presented to evaluate how the price signal affects the operations of networked microgrids under different charging strategies of the EV charging stations. The result indicates that our proposed EVCS (dis)charging strategy, which leverages the flexibility of EVs to support the grid through discharging during peak demand, proves to be a cost-effective solution that reduces operational costs while improving the social welfare of EV charging.
24 POWER TRANSMISSION AND DISTRIBUTION↗
A Cybersecurity Testbed for Smart Buildings
Smart buildings are equipped with a plethora of cyber-physical systems, such as Internet of Things (IoT) devices and building automation systems. These devices, especially in commercial buildings, use legacy communications and hardware that were not designed with cybersecurity in mind. With increasing cyber threats in recent years, smart buildings have become an increasing target for attacks, but not enough published data are available from these incidents to study or replicate the scenarios to defend buildings. As part of the U.S. Department of Energy-funded project focusing on developing the Building Intelligence with Layered Defense Using Security-Constrained Optimization and Security Risk Detection (BUILD-SOS) platform, we developed a cybersecurity test bed for smart buildings. This test bed includes a building simulation tool, virtual devices, emulated operational technology networks, and remote hardware-in-the-loop. Using this test bed, we performed different cyberattacks on the smart building model and collected both physical building data, to understand the impacts on the building, and network data, to aid in separating mechanical faults from cyberattacks during the detection. This test bed is a significant tool in protecting smart buildings from cyberattacks because it can aid in both cybersecurity analysis and the evaluation of other cyberattack detection tools by testing the tools in a secure environment without impacting the building operations.
cyber-physical systems↗
A Cybersecurity Testbed for Smart Buildings
Smart buildings are equipped with a plethora of cyber-physical systems, such as Internet of Things (IoT) devices and building automation systems. These devices, especially in commercial buildings, use legacy communications and hardware that were not designed with cybersecurity in mind. With increasing cyber threats in recent years, smart buildings have become an increasing target for attacks, but not enough published data are available from these incidents to study or replicate the scenarios to defend buildings. As part of the U.S. Department of Energy-funded project focusing on developing the Building Intelligence with Layered Defense Using Security-Constrained Optimization and Security Risk Detection (BUILD-SOS) platform, we developed a cybersecurity test bed for smart buildings. This test bed includes a building simulation tool, virtual devices, emulated operational technology networks, and remote hardware-in-the-loop. Using this test bed, we performed different cyberattacks on the smart building model and collected both physical building data, to understand the impacts on the building, and network data, to aid in separating mechanical faults from cyberattacks during the detection. This test bed is a significant tool in protecting smart buildings from cyberattacks because they can aid in both cybersecurity analysis and the evaluation of cyberattack detection tools by testing the tools in a secure environment without impacting the building operations.
alfalfa↗
Machine Learning-based False Data Injection Attack Detection and Localization in Power Grids
Cyberattacks on critical infrastructures can be catastrophic and bring nations to their knees. Therefore, detecting these attacks is crucial and challenging. This paper presents a novel approach for detecting and locating cyberattacks affecting an electrical power system. The adversary employs a man-in-the-middle technique to inject false data into the communication between distributed energy resources (DER) and Microgrid Controller (MGC) with the goal of disrupting power delivery. The approach for detection and localization is based on integrating multiple machine learning-based anomaly detection models that combine network traffic data and grid measurements. Experiments are performed to assess the method's performance using a hardware-in-the-loop real-time simulation testbed which includes Modbus TCP/IP communication. Power system topology and operating conditions are based on actual topology and real-world data provided by the Holy Cross Energy utility network. Results confirm that the method can be successfully employed for detecting and localizing cyberattacks.
Leao, Bruno P.↗
Performing Numerical Analysis of Cybersecurity Options Using Dynamic Risk Analysis Tool EMRALD
Cyberattacks can have many different attack paths, durations, and goals. There are also many different mitigation options involving hardware, software, and/or humans. Considering a cyber threat should involve defense-in-depth methods and a quantitative or numerical evaluation of overall effectiveness against dynamic, time-dependent attacks to make cost and risk-informed decisions. Typical cyberattack modeling methods only provide a qualitative evaluation. The main areas of cybersecurity are confidentiality, integrity, and availability. For companies with cyber-physical systems such as advanced nuclear reactors, cyber-related safety is a requirement set by North American Electric Reliability and the U.S. Nuclear Regulatory Commission. They are also concerned about availability or reliability as a business case. As cyber threats are evolving to a business-for-hire structure, more attacks may focus on disrupting business success and reliability, causing financial and economic stability risk. Companies want to know business reliability and recovery from those threats, and that requires modeling physical behavior of the targets. Dynamic-state-based and Markov-based modeling provides a method for better cyber scenario modeling with different tools having issues such as state-base explosion. Dynamic modeling enables time and conditional features not found in other numerical evaluation methods. EMRALD (Event Modeling Risk Assessment using Lined Diagrams) is a dynamic risk analysis modeling and simulation tool and has features that reduce modeling issues. It has been used to model different time-dependent events including plant behavior and operator procedures. As a general modeling tool, EMRALD can also be used to model cyberattack scenarios with varying mitigation options and quantify effectiveness, producing numerical data for risk-informed decisions. This paper uses EMRALD to demonstrate that dynamic numerical risk analysis can be used for cyber threat modeling to provide insights for design decision-making and optimize defense strategies. Keywords: cyber modeling; cyber-physical systems; numerical cyber modeling
97 - MATHEMATICS AND COMPUTING↗
PSA 2025 DPRA for Cyber Optimization
Cyberattacks can have many different attack paths, durations, and goals. There are also many different mitigation options involving hardware, software, and/or humans. Evaluating defense options should include quantitative evaluation of overall effectiveness to make cost and risk-informed decisions. Typical cyberattack modeling methods only provide a qualitative evaluation and have difficulty with time dependent scenarios. The main areas of cybersecurity are confidentiality, integrity, and availability. For companies with cyber-physical systems such as advanced nuclear reactors, cyber-related integrity is a requirement set by the U.S. Nuclear Regulatory Commission. But companies are also concerned about availability or reliability as a business case. As cyber threats are evolving to a business-for-hire structure, more attacks focus on disrupting business success and reliability, causing financial and economic stability risk. Companies want reliability analysis while optimizing cost, which requires more than safety modeling methods. Dynamic-state-based and Markov-based modeling provides a method for better cyber scenario modeling with timing and conditional features not found in other numerical evaluation methods. EMRALD (Event Modeling Risk Assessment using Lined Diagrams) is a dynamic risk analysis modeling and simulation tool and has features that reduce modeling issues such as state-base explosion found in Markov-based tools. It has been used to model different time-dependent events including plant behavior and operator procedures. As a general modeling tool, EMRALD can also be used to model cyberattack scenarios with varying mitigation options and quantify effectiveness, producing numerical data for risk-informed decisions. This paper uses EMRALD to demonstrate that dynamic risk analysis can be used for cyber threat modeling to provide insights for design decision-making and optimize defense strategies.
97 - MATHEMATICS AND COMPUTING↗
EUREICA: Efficient UltRa Endpoint IoT-enabled Coordinated Architecture
The electricity grid has evolved from a physical system to a cyber-physical system with digital devices that perform measurement, control, communication, computation, and actuation. The increased penetration of distributed energy resources (DERs) that include renewable generation, flexible loads, and storage provides extraordinary opportunities for improvements in efficiency and sustainability. However, they can introduce new vulnerabilities in the form of cyberattacks, which can cause significant challenges in ensuring grid resilience. The purpose of this project was to develop a framework ((Efficient, Ultra-REsilient, IoT-Coordinated Assets, or EUREICA)for achieving grid resilience through suitably coordinated assets including a network of Internet of Things (IoT) devices, and a local electricity market (LEM) to identify trustable assets and carry out this coordination. Situational Awareness (SA) of locally available DERs with the ability to inject power or reduce consumption is enabled by the market, together with a monitoring procedure for their trustability and commitment. Experiments conducted during this project demonstrated that, with this SA, a variety of cyberattacks can be mitigated using local trustable resources without stressing the bulk grid. The demonstrations were carried out using a variety of high-fidelity co-simulation platforms, real-time hardware-in-the-loop validation, and a utility-friendly simulator.
14 SOLAR ENERGY↗
Adaptive anomaly detection for identifying attacks in cyber-physical systems: A systematic literature review
Modern cyberattacks in cyber-physical systems (CPS) rapidly evolve and cannot be deterred effectively with most current methods, which focus on characterizing past threats. Adaptive anomaly detection (AAD) is among the most promising techniques to detect evolving cyberattacks, with an emphasis on fast data processing and model adaptation. AAD has been researched extensively; however, to the best of our knowledge, our work is the first systematic literature review (SLR) on current research in this field. We present a comprehensive SLR, gathering 397 relevant papers and systematically analyzing 65 of them (47 research and 18 survey papers) on AAD in CPS from 2013 to November 2023. We introduce a novel taxonomy considering attack types, CPS application, learning paradigm, data management, and algorithms. Our findings show that most studies addressed either model adaptation or data processing, but rarely both simultaneously. This indicates a research gap in fully adaptive solutions. We also categorize algorithms, datasets, and attack characteristics, and summarize strengths and weaknesses across the literature. Our review provides a structured and accessible reference for researchers and practitioners, offering insights into key trends and highlighting limitations in current approaches. Finally, we outline several future research directions, including the need for integrated real-time processing and adaptive learning, explainability, and uncertainty quantification in AAD for CPS.
Adaptation↗
Assessing the Impact of Cybersecurity Attacks on Energy Systems
This paper investigates the cyber resiliency of future power systems with high penetration of distributed energy resources using advanced distributed and (or) hierarchical control architectures. Specifically, we simulate cyberattacks on three prototypical use cases, and we identify attack scenarios that are the most damaging to the overall system performance. We show that these attacks can have a significant impact on grid operation. Results provide additional insights into the robustness of the system to the most common cyberattacks.
buildings↗