Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Event precursors”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2
All sourcesNASA NTRSDOE OSTI
DOE OSTI2025

Precursor Analysis Report: Blackmatter Ransomware Attack on New Cooperative 2021

The BlackMatter Ransomware Attack on New Cooperative 2021 Precursor Analysis Report leverages publicly available information about the New Cooperative cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. The BlackMatter ransomware was first identified in July 2021 and is reported to have infected more than 50 corporations around the world. , The Iowa-based grain cooperative, New Cooperative, was impacted by the BlackMatter ransomware on or before 18 September 2021. The adversary likely resided on New Cooperative’s networks for 15 days prior to encrypting its network and demanding New Cooperative pay $5.9 million in ransom by 25 September to unlock systems and prevent 1 terabyte (TB) of sensitive data from being publicly released. It is not clear if New Cooperative paid the ransom. The full impact of the ransomware attack is not known; however, according to New Cooperative’s general manager, the attack caused the company’s automated processes to revert back to processes used in the 1970s. , As of 6 October, only 50 percent of New Cooperative’s operations were utilizing automated processes. The company took eight weeks to rebuild the entire network and information technology (IT) systems from the ground up, which puts the date of fully recovery around 13 November. Researchers and analysts identified 20 unique techniques utilized during the attack with a total of 404 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Seventeen of the identified techniques used during the New Cooperative cyber attack were precursors to the triggering event. Analysis identified 360 observables associated with these precursor techniques, 284 of which were assessed to have an increased likelihood of being perceived in the 15 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: JBS Foods Ransomware Attack 2021

The JBS Foods 2021 Ransomware Attack Precursor Analysis Report leverages publicly available information about the JBS ransomware cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. In late May 2021, one of the world’s largest meat producers, JBS Foods, announced they had fallen victim to a worldwide ransomware attack, later found to be REvil ransomware. In the United States alone, JBS Foods accounts for nearly 25% of beef and roughly 20% of pork production. Adversaries initially launched a Distributed Denial of Service (DDoS) attack on the company’s Information Technology (IT) networks in Australia, but the attack impacted operations in Brazil, Canada, and the United States, as well. The attack caused plant operations in all four countries to shut down for at least one day. All nine of the U.S. meatpacking plants temporarily shut down because of the attack. The adversaries initially demanded a $\$$22 million ransom for the company’s data, but later negotiated the ransom down to $\$$11 million even after JBS Foods restored most of their systems. JBS Foods eventually paid the $\$$11 Million for reassurance from the adversaries that none of their customers’ data would be compromised in the future. Despite its short duration, the attack still caused large stocks of meat to spoil. The incident also underscored how adversaries can simultaneously compromise and move laterally through global subsidiaries of an organization. Researchers and analysts identified 22 unique techniques (in a sequence of 21 steps) utilized during the attack with a total of 361 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Sixteen of the identified techniques used during the JBS Foods cyber attack were precursors to the triggering event. Analysis identified 308 observables associated with these precursor techniques, 163 of which were assessed to have an increased likelihood of being perceived in the 75 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003

The SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003 Precursor Analysis Report leverages publicly available information about Davis-Besse’s 2003 cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. On 25 January 2003, the SQL Slammer worm infected more than 90% of vulnerable hosts and crashed the internet in 10 to 15 minutes, making it one of the fastest spreading worms in history. SQL Slammer is a fileless, memory-resident worm that remotely exploits a stack-based buffer overflow vulnerability on local hosts to intensively scan and rapidly self-propagate across the internet. The worm infected approximately 300,000 unpatched hosts running Microsoft Structured Query Language (SQL) Server 2000 or Microsoft Desktop Engine (MSDE) 2000 with SQL Server Resolution Service. The SQL Slammer worm indirectly infected FirstEnergy’s Davis-Besse nuclear power plant by first infecting a consultant’s company network server and then propagating through an external misconfigured connection into Davis-Besse’s site network. The infection caused major network congestion, slow performance, data overloads, and the inability of local hosts to communicate with each other, which eventually caused a loss of availability and a loss of view when the Safety Parameter Display System (SPDS) and Plant Process Computer (PPC) crashed. At the time of the infection, the plant was already offline, the digital monitoring systems had redundant analog backups, and the plant control and safety functions were not affected, so there were no concerns of a safety breach. However, this incident resulted in many lessons learned and spawned important discussions about cybersecurity’s role in nuclear safety and electric power reliability regulation, policy, and guidance. Researchers and analysts identified 10 unique techniques utilized during the attack with a total of 640 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Eight of the identified techniques used during Davis-Besse cyber attack were precursors to the triggering event. Analysis identified 596 observables associated with these precursor techniques, 428 of which were assessed to have an increased likelihood of being perceived in the 331 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: Industroyer2 and Wiper Malware Targeting Ukrainian Energy Provider 2022

The Industroyer2 and Wiper Malware Targeting Ukrainian Energy Provider 2022 Precursor Analysis Report leverages publicly available information about the Industroyer2 cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. An adversary attempted to cause a blackout in Ukraine in April 2022 by using the Industroyer2 malware against a regional Ukrainian energy provider. The adversary targeted eight high-voltage electrical substations and utilized the malware in tandem with disk wipers for Windows, Linux, and Solaris operating systems in an attempt to make response and recovery efforts more difficult. The adversary reused a piece of the original Industroyer malware designed to open circuit breakers and de-energize target substations. The adversary gained initial access to the victim’s enterprise network through unknown means in February 2022 and was able to perform reconnaissance, pivot to the operations network, and reside in the system for at least 51 days. This gave the adversary a detailed understanding of the environment and allowed them to customize the Industroyer2 malware to the victim’s operations network. However, defenders detected and stopped the attack before the adversary could achieve their intended impact. Had the Industroyer2 attack been successful, it could have caused a blackout for more than two million people during the early stages of Russia’s invasion of Ukraine. Researchers and analysts identified 22 unique techniques (used in a sequence of 31 steps) utilized during the attack with a total of 297 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Twenty-three of the identified techniques used during the Industroyer2 cyber attack were precursors to the triggering event. Analysis identified 224 observables associated with these precursor techniques, 122 of which were assessed to have an increased likelihood of being perceived in the 51 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Precursor Analysis Report: Industroyer Targeting Ukraine Electric Power Transport Utility (Ukrenergo) 2016

The Industroyer Targeting Ukraine Electric Power Transport Utility (Ukrenergo) 2016 Precursor Analysis Report leverages publicly available information about the December 2016 cyber attack against the Ukrainian Ukrenergo electric transmission utility and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. Industroyer is a modular malware framework designed to deploy several Industrial Control System (ICS) protocol-specific attack payloads to disrupt electricity distribution. Adversaries deployed Industroyer within the target network on a Microsoft Windows endpoint capable of directly manipulating or communicating with ICS. Industroyer abuses the functionality of a targeted ICS’s legitimate control system to achieve its intended impact. Adversaries likely first gained access to Ukrenergo enterprise networks in early 2016 after a successful spearphishing campaign against organizations in the electric power sector. Adversaries then began capturing credentials beginning on 1 December 2016. This allowed access to the ICS environment at the Pivnichna electric transmission substation outside Kyiv through a device dual-homed on the Information Technology (IT) and ICS networks. Adversaries conducted discovery, targeting, and access to this device using information and previously captured credentials from compromised enterprise IT machines. Finally, the adversaries deployed and launched the Industroyer malware just before midnight on 17 December. By midnight, Ukrenergo had lost control of a targeted substation, resulting in electric power outages for over an hour in the city of Kyiv and the Kyiv region. Researchers and analysts identified 31 unique techniques (used in a sequence of 33 steps) utilized during the attack with a total of 846 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Twenty-nine of the identified techniques used during the Industroyer cyber attack were precursors to the triggering event. Analysis identified 548 observables associated with these precursor techniques, 353 of which were assessed to have an increased likelihood of being perceived in the 300 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2024

Zircon-to-reidite phase transition enhanced by minor radiation damage: Implications for hypervelocity impacts

Reidite, a high-pressure phase of zircon, is increasingly identified at terrestrial impact sites. Despite its growing recognition, the potential applications for estimating minimum impact pressure face impediments due to existing discrepancies in the condition of zircon-reidite transformation, controversial models governing the transformation mechanism, and unclear effects of pre-existing radiation damage on reidite formation. Here, we show enhanced reidite formation by synchrotron X-ray diffraction, Raman spectroscopy, and transmission electron microscopy analyses of zircon grains that have experienced different alpha-decay doses from U and Th impurities and subsequent pressurization in diamond anvil cells. Below ~1 × 10 18 α-decay events/g, the α-decay-induced isolated point defects in the still crystalline zircon facilitate the minor atomic readjustments required for reidite formation. However, above this dose, the loss of long-range periodicity in severely damaged or even metamict zircon inhibits the transformation. The enhanced reidite formation by minor radiation damage coincides with the more common occurrence of reidite at impact sites for which the precursor zircon has a relatively lower alphadecay- event dose before the impact event. In addition, the detailed atomic-scale structures of twinned reidite provide unambiguous evidence for a characteristic internal stress-induced martensitic transition. Furthermore, these findings have important implications for interpreting the formation conditions of natural reidite due to the convergence of pressure from the static, shockwave, and natural reidite samples.

58 GEOSCIENCES↗
DOE OSTI2022

Disruptive neoclassical tearing mode seeding in DIII-D with implications for ITER

New studies identify the critical parameters and physics governing disruptive neoclassical tearing mode (NTM) onset. An m/n = 2/1 mode in DIII-D that begins to grow robustly after a seeding event (edge localized mode ELM or sawtooth precursor and crash) causes the mode rotation to drop close to the plasma's Er = 0 rest frame; this condition opens the stabilizing ion-polarization current 'gate' and destabilizes an otherwise marginally stable NTM. Our new experimental and theoretical insights and novel toroidal theory-based modeling are benchmarked and scalable to ITER and other future experiments. Here, the nominal ITER rotation at q = 2 is found to be stabilizing ('gate closed') except for MHD-induced transients that could 'open the gate'. Extrapolating from the DIII-D ITER baseline scenario (IBS) discharges, MHD transients are much more likely to destabilize problematic robustly growing 2/1 NTMs in ITER; this makes predictions of seeding and control of both ELMs and sawteeth imperative for more than just minimizing divertor pulsed-heat loading.

70 PLASMA PHYSICS AND FUSION TECHNOLOGY↗
DOE OSTI2022

Precursor Analysis Report: Conti Ransomware Attack on the Health Service Executive of Ireland 2021

The Conti Ransomware Attack on the Health Service Executive (HSE) of Ireland 2021 Precursor Analysis Report leverages publicly available information about the attack and catalogs anomalous observables for each technique employed by the adversary. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. The HSE provides public healthcare corporate services and operational services throughout Ireland, with critical functions including the acute national ambulance service, acute hospital service, and community healthcare service. On 14 May 2021, Conti ransomware encrypted 80 percent of the HSE’s Information Technology (IT) infrastructure across corporate, hospital, community, and electronic health record services. Conti is a ransomware-as-a-service operation that encrypts local files, uses double extortion against victims, and is facilitated by many intrusion tools. The attack forced the HSE to shut down its entire IT infrastructure to contain the ransomware, forcing employees to revert to pen and paper recordkeeping and leading to the cancellation of many appointments and procedures. The adversary also exfiltrated 700 GB of data, compromising the confidentiality of patients’ protected health information. Had the adversary targeted the COVID-19 cloud systems or operational technology assets, such as Internet of Medical Things medical devices or smart building management systems, the impact of the attack would almost certainly have been far more severe. Researchers and analysts identified 21 unique techniques (used in a sequence of 23 steps) likely utilized during the attack with a total of 1,185 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Twenty-one of the identified techniques used during the attack on the HSE were precursors to the triggering event. Analysis identified 1,086 observables associated with these precursor techniques, 850 of which were assessed to have an increased likelihood of being perceived in the 57 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Integrated deep learning framework for unstable event identification and disruption prediction of tokamak plasmas

Abstract The ability to identify underlying disruption precursors is key to disruption avoidance. In this paper, we present an integrated deep learning (DL) based model that combines disruption prediction with the identification of several disruption precursors like rotating modes, locked modes, H-to-L back transitions and radiative collapses. The first part of our study demonstrates that the DL-based unstable event identifier trained on 160 manually labeled DIII-D shots can achieve, on average, 84% event identification rate of various frequent unstable events (like H-L back transition, locked mode, radiative collapse, rotating MHD mode, large sawtooth crash), and the trained identifier can be adapted to label unseen discharges, thus expanding the original manually labeled database. Based on these results, the integrated DL-based framework is developed using a combined database of manually labeled and automatically labeled DIII-D data, and it shows state-of-the-art (AUC = 0.940) disruption prediction and event identification abilities on DIII-D. Through cross-machine numerical disruption prediction studies using this new integrated model and leveraging the C-Mod, DIII-D, and EAST disruption warning databases, we demonstrate the improved cross-machine disruption prediction ability and extended warning time of the new model compared with a baseline predictor. In addition, the trained integrated model shows qualitatively good cross-machine event identification ability. Given a labeled dataset, the strategy presented in this paper, i.e. one that combines a disruption predictor with an event identifier module, can be applied to upgrade any neural network based disruption predictor. The results presented here inform possible development strategies of machine learning based disruption avoidance algorithms for future tokamaks and highlight the importance of building comprehensive databases with unstable event information on current machines.

plasma instabilities↗
DOE OSTI2025

Going Off Grid: A Comparative Study of the Lagrangian and Eulerian Perspectives of New Particle Formation Events

New particle formation and growth (NPF&G) is the process by which ultrafine particles are formed from gas-phase precursors. NPF&G is the dominant source of global aerosol number with important influences on climate. Most observations of NPF&G events are conducted at stationary sites; however, NPF&G observed from stationary sites is influenced by gradual or rapid changes in the air masses passing over the site, complicating NPF&G analysis. In this work, we use observations and a 3D aerosol model to compare aerosol size distributions at a stationary site (Southern Great Plains [SGP] observatory, Oklahoma, USA) and along Lagrangian trajectories crossing the site. The model simulates the NPF&G events reasonably well at SGP. Using the model to compare the Lagrangian and stationary perspectives, we can explain previously unanalyzable days with some evidence of NPF&G as either non-event or analyzable NPF&G days. We find most of the unanalyzable NPF&G days are due to isolated and inhomogeneous NPF&G occurring upwind of the stationary site, often in the outflow of urban regions. Finally, we compare formation rates of 3 nm particles, growth rates, and the survival probability of 3 nm particles growing to 25 nm between the stationary and Lagrangian perspectives. Because of the much larger number of analyzable days along the Lagrangian trajectories, this perspective potentially provides more robust statistics and better characterization of NPF&G event extremes. Our method for extracting chemical/physical properties along Lagrangian trajectories from 3D models can be applied to a wide range of science questions.

O’Donnell, Samuel E. [Colorado State Univ., Fort C↗
DOE OSTI2023

Spring Regional Sea Surface Temperatures as a Precursor of European Summer Heatwaves

Different spring and early summer North Atlantic sea surface temperature anomalies (SSTAs) have been shown to precede recent European summer heatwaves (EuSHWs). So far, the limited number of observed events associated with several physical mechanisms has prevented a robust identification of SSTAs as precursors. Here, we extend beyond previous studies by combining 100 historical simulations (1850–2005) of the MPI Grand-Ensemble with an explainable neural-network method. We find that the spring tripolar North Atlantic pattern with positive SSTAs in the Subtropical Gyre is a precursor of EuSHWs. In addition, positive SSTAs west of the Iberian Peninsula, and in the North Sea, the Baltic Sea and the Mediterranean Sea relate to distinct early summer soil moisture anomaly patterns and are precursors of western and southeastern EuSHWs, respectively. While the phase of the tripolar North Atlantic pattern indicates whether a EuSHW might emerge, regional SSTAs indicate the spatial characteristics of EuSHWs.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2023

Life Cycle of Major Sudden Stratospheric Warmings in the Southern Hemisphere from a Multimillennial GCM Simulation

Abstract Sudden stratospheric warmings (SSWs) are rare in the Southern Hemisphere (SH), making it difficult to study possible precursors or subsequent impacts. Using a multimillennial coupled climate model simulation producing 161 SSWs in the SH, we present a detailed study of their life cycle. We show that SH SSWs are predominantly displacement events forced by wave-1 planetary waves, and that a surface signature similar to the negative phase of the Southern Annular Mode (SAM) is detectable up to two months before the onset date, but there is a tendency for a transition from wave 1 before to zonally symmetric anomalies after onset. We identify a strong weakening of the Amundsen Sea low as one of the most prominent precursors, which weakens the climatological wave-2 and wave-3 stationary waves and strengthens wave-1 forcing. Compared to their northern counterparts, SH SSWs generally have a longer time scale, and while there is evidence of pre-onset forcing related to tropical sea surface temperatures, the Indian Ocean dipole is more important than El Niño–Southern Oscillation. Significance Statement Sudden stratospheric warmings (SSWs) are extreme events where the winter polar stratosphere warms within a few days to temperatures usually only experienced in summer. These events are rare in the Southern Hemisphere. Therefore, both the observational record and standard climate model simulations are not enough to understand how SSWs develop, or how they might change surface weather. Here we use very long global climate simulations that produce a large number of SSWs in the Southern Hemisphere to study the development and impact of these events. This includes possible precursors as well as the influence they have on surface weather after they occur.

Meteorology & Atmospheric Sciences↗
DOE OSTI2024

Developmental assembly of multi-component polymer systems through interconnected synthetic gene networks in vitro

Abstract Living cells regulate the dynamics of developmental events through interconnected signaling systems that activate and deactivate inert precursors. This suggests that similarly, synthetic biomaterials could be designed to develop over time by using chemical reaction networks to regulate the availability of assembling components. Here we demonstrate how the sequential activation or deactivation of distinct DNA building blocks can be modularly coordinated to form distinct populations of self-assembling polymers using a transcriptional signaling cascade of synthetic genes. Our building blocks are DNA tiles that polymerize into nanotubes, and whose assembly can be controlled by RNA molecules produced by synthetic genes that target the tile interaction domains. To achieve different RNA production rates, we use a strategy based on promoter “nicking” and strand displacement. By changing the way the genes are cascaded and the RNA levels, we demonstrate that we can obtain spatially and temporally different outcomes in nanotube assembly, including random DNA polymers, block polymers, and as well as distinct autonomous formation and dissolution of distinct polymer populations. Our work demonstrates a way to construct autonomous supramolecular materials whose properties depend on the timing of molecular instructions for self-assembly, and can be immediately extended to a variety of other nucleic acid circuits and assemblies.

Science & Technology - Other Topics↗
DOE OSTI2020

The influence of wintertime SST variability in the Western North Pacific on ENSO diversity

Abstract Sea surface temperature anomalies (SSTa) in the Western North Pacific (WNP) have been linked to the development of El Niño Southern Oscillation (ENSO) events a full year in advance. However, the contribution of the WNP precursor to the temporal evolution and spatial complexity of ENSO remains unclear. Using the preindustrial experiment of the Community Earth System Model as the control climate, a partially coupled experiment is conducted in which WNP SSTa are restored to the model climatology. By comparing the perturbed experiment to the control, we are able to clearly characterize ENSO’s response to WNP SST variability. We find that the WNP is predominantly linked to eastern Pacific (EP) ENSO events. Without SST variability in the WNP, central Pacific (CP) ENSO events are more likely to develop. This variation in ENSO flavor is controlled by how the WNP projects onto wind stress anomalies in the western equatorial Pacific, which in turn impacts the discharge and recharge of ocean heat during the ENSO cycle. Specifically, the removal of SSTa in the WNP weakens the buildup of ocean heat in the western equatorial Pacific, which then hinders the development of EP-type events.

Meteorology & Atmospheric Sciences↗
DOE OSTI2020

Large contribution of organics to condensational growth and formation of cloud condensation nuclei (CCN) in the remote marine boundary layer

Marine low clouds strongly influence global climate, and their radiative effects are particularly susceptible to the concentration of cloud condensation nuclei (CCN). One major source of CCN is the condensational growth of pre-CCN particles, and sulfate has long been considered the major condensing species in the remote marine boundary layer. While some studies have suggested that secondary organic species can contribute to particle growth, its importance remains unclear. Here we present the first long-term observational evidence that organics play an important role in particle growth over remote oceans. To the contrary of traditional thinking, sulfate dominated condensational growth for only a small (~18 %) fraction of the 62 observed growth events, even fewer than the organic-dominated events (24 %). During most (58 %) growth events, the major condensing species included both organics and sulfate. Potential precursors of the secondary organics are volatile organic compounds from ocean biological activities and those produced by the air–sea interfacial oxidation. Our results indicate that the condensation of secondary organics contributes strongly to the growth of pre-CCN particles and thereby the CCN population over remote oceans.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2021

Progress Towards Interpretable Machine Learning-based Disruption Predictors Across Tokamaks

In this paper we lay the groundwork for a robust cross-device comparison of data-driven disruption prediction algorithms on DIII-D and JET tokamaks. In order to consistently carry on a comparative analysis, we define physics-based indicators of disruption precursors based on temperature, density, and radiation profiles that are currently missing for DIII-D data. These profile-based indicators are shown to well-describe impurity accumulation events in both DIII-D and JET discharges that eventually disrupt. Thanks to the univariate analysis on the features used in such data-driven applications on both tokamaks, we are able to statistically highlight differences in the dominant disruption precursors: JET with its ITER-like wall is more prone to impurity accumulation events, while DIII-D is more subject to edge cooling mechanisms that destabilize dangerous MHD modes. Even though the analyzed datasets are characterized by such intrinsic differences, we show how data-driven algorithms trained on one device can be used to predict and interpret disruptive scenarios on the other. As long as the destabilizing precursors are diagnosed in a device-independent way, the knowledge that data-driven algorithms learn on one device can be used to explain a disruptive behavior on another device.

70 PLASMA PHYSICS AND FUSION TECHNOLOGY↗
DOE OSTI2025

Precursors to Extreme Wintertime Cold in the Midwest United States

ABSTRACT Cold air outbreaks (CAOs) are extreme weather events that affect millions of people every winter, including those in the US Midwest. Per our criteria (a sufficiently cold event over a wide area and a long period), we identified 43 wintertime CAOs in the Midwest region using data from 1980 to 2021 (approximately one per year). These occurred in the Midwest during three of five North American weather regimes. Two regimes' CAOs are related to a weak stratospheric polar vortex, consistent with previous research on CAOs in the neighbouring Great Plains region. A different regime, characterised by anomalous ridging along the west coast of North America, is the most common for Midwest CAOs, unlike in regions further to the west. Unlike the other two regimes, these so‐called West Coast Ridge CAOs have no clear stratospheric connection. West Coast Ridge CAOs are instead linked to tropospheric processes on synoptic timescales, usually preceded by a weaker than average mid‐tropospheric height gradient in the western Pacific about 10 days prior to CAO onset. Our results demonstrate a particular challenge for predicting some extreme events in the Midwest, with important implications for early warning systems.

Ryan, James M. [Department of Earth and Atmospheri↗
DOE OSTI2026

High Time Resolution Modelled and Measured New Particle Formation Rates During the 2023 Pittsburgh, PA Campaign

Particle size distributions are used to calculate nucleation rates during new particle formation (NPF). However, the low time resolution and poor sensitivity of instruments deployed to observe particle size distributions can lead to inaccurate estimates of nucleation rates. We calculated nucleation rates in Pittsburgh, PA from particle size distributions measured with the new high time resolution Condensation Particle Counters For Atmospheric Rapid Measurements (CPC FARM) and from gas precursor concentrations measured with a chemical ionization mass spectrometer. The CPC FARM nucleation rates were calculated by examining the appearance rate of particles in the smallest size bin at 1.6 nm. The nucleation rate of 1.6 nm determined every second resulted in positive and negative rates, indicating the influence of inhomogeneous mixing and advection of precursor gases and clusters. These effects are not currently considered when estimating nucleation rates from measurements. The nucleation rates from the CPC FARM were compared to the nucleation rates determined from a transient acid‐base reaction model using measured sulfuric acid concentration, strong base concentrations, and CPC detection efficiencies. The transient form of the model allowed the advection of heterogeneously mixed precursors to influence the nucleation rate. Good agreement between particle and gas‐based nucleation rates is observed during sulfuric acid‐driven NPF events. This study demonstrates that high time resolution measurements of short‐lived and rapidly formed particles are needed to accurately capture nucleation rates, which are likely influenced by advection of nucleation precursors and clusters in heterogeneous environments such as urban areas.

Cheng, D. [Carnegie Mellon Univ., Pittsburgh, PA (↗