Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “THREAT”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2
All sourcesNASA NTRSDOE OSTI
NASA NTRSDate not supplied

Estimating Tropical Cyclone Threats to Floating Rigs in the Gulf of Mexico

Offshore drilling operations in the Gulf of Mexico are particularly vulnerable during hurricane season. When a weather threat arises, a decision to evacuate the rig and/or move to a safe location may need to be made. Depending on the activities in progress at the time of the threat, securing the well, evacuating, and/or moving to a safe location can take a considerable amount of time. This transition time is called T-time. T-time is not only rig dependent, but also depends on the activity being performed at the time of the threat. For these reasons it is important to assess tropical cyclone threats and the time it takes for them to reach the rig location. The objective of this study is to use the available 50 years of past cyclone history to estimate cyclone threats at any location in the Gulf of Mexico. The cyclone threat is estimated based on the rig location as well as the start date and duration of the offshore activity. By threat, it is meant the likelihood that a specific location with an associated offshore activity would be exposed to an upcoming cyclone whose forecasted track cone and storm size lies within that location. Three representative rig locations in the Gulf of Mexico were selected as assessment sites to evaluate the threat of incoming cyclones for different T-times. To conduct this tropical cyclone study, an Excel spreadsheet tool was developed to automate the analysis of the tropical cyclone data from the Best Track Archive for Climate Stewardship (IBTrACS) Version 4. The spreadsheet tool allows the user to input any location (i.e., longitude and latitude) in the Gulf of Mexico and displays a list of historical cyclones that have passed within 150 nautical miles of that location during the activity period selected by the user. Also, the tool allows the user to input a T-time to assess the threat of cyclones that would not provide adequate time to secure the well, evacuate, and/or move to a safe location.

Risk↗
NASA NTRS2021

The spatial distribution of ionospheric threats to WAAS integrity, 2000 – 2019: a systematic analysis

The United States’ Wide Area Augmentation System (WAAS) broadcasts data to facilitate aircraft navigation. This paper examines the spatial dependence of ionospheric disturbances that have threatened the accuracy and reliability of position estimates derived from these data over the period 2000 – 2019. We address two distinct aspects of this spatial dependence: (1) the geographic distribution of these threats, in particular, in relation to geomagnetic latitude, and (2) the geometric dependence of threats relative to the locations of the receiver sites that comprise the WAAS network. We analyze threat distributions in terms of the various means that WAAS employs to mitigate these threats, including the Extreme Storm Detector, the Moderate Storm Detector, local irregularity detectors, and the ionospheric threat model. Distinct distributions are presented for threats occurring in Solar Cycle 23 and those of Solar Cycle 24. To study the geometric dependence of threats on receiver locations, we use as a metric the distance separating a threat from the centroid of the nearest Ncentroid receivers. Large values of this metric identify threats at or beyond the edge of coverage. We conclude by discussing the implications of our results for WAAS operations.

Altshuler, Eric↗
NASA NTRS2022

Estimating Tropical Cyclone Threats to Floating Rigs in the Gulf of Mexico

Offshore drilling operations in the Gulf of Mexico are particularly vulnerable during hurricane season. When a weather threat arises, a decision to evacuate the rig and/or move to a safe location may need to be made. Securing the well, evacuating, and/or moving to a safe location can take a considerable amount of time. This transition time is called T-time. T-time is not only rig dependent, but also depends on the activity being performed at the time of the threat. For these reasons, it is important to assess tropical cyclone threats and the estimated time it will take the storm to reach the rig location from the time it is first detected. The objective of this study is to use 50 years of cyclone history from a National Oceanic and Atmospheric Administration’s (NOAA) database, the International Best Track Archive for Climate Stewardship (IBTrACS) to estimate cyclone threats at any location in the Gulf of Mexico. The cyclone threat is estimated based on the rig location as well as the start date and duration of the offshore activity. By threat, it is meant the likelihood that a specific location with an associated offshore activity lies within the forecasted track cone and storm size of the upcoming cyclone. Three representative rig locations in the Gulf of Mexico were selected as assessment sites to evaluate the threat of incoming cyclones for different T-times. To conduct this tropical cyclone study, an Excel spreadsheet tool was developed to automate the analysis of the tropical cyclone data. The spreadsheet tool allows the user to input any location (i.e., longitude and latitude) in the Gulf of Mexico and displays a list of historical cyclones that have passed within 150 nautical miles of that location during the activity period selected by the user. In addition, the tool allows the user to input any T-time to assess the threat of cyclones that would not provide adequate time to secure the well, evacuate, and/or move to a safe location.

Offshore Oil Drilling↗
DOE OSTI2024

GraphCH: A Deep Framework for Assessing Cyber-Human Aspects in Insider Threat Detection

Insider threat is one of the most damaging cyber attacks that could cause the loss of intellectual property and enterprise data security breaches. Action sequence data such as host logs are used to investigate such threats and develop anomaly-based AI detectors. However, insider threat actions are similar to legitimate user activities, causing AI detectors to fail and suffer from high false alarm rates. Therefore, user cyber activity logs are inadequate to fully unfold insider threats. In this study, we adopt human psychological principles of risk-taking and impulsiveness along with host data to assess the influence and usefulness of human behavioral aspects in insider threat detection. Here, we hypothesize that individuals' impulsive and risk-taking behavior correlates with cyberspace activities. To validate our hypothesis, we conducted an IRB-approved study recruiting 35 participants who work in a large U.S. university and collected their cyber and psychological data for 90 days. Host and human-behavioral data analysis and mapping indicate that impulsive and risk-taking users trigger more system errors causing (un)intentional insider threats and are susceptible to attackers' social engineering and cognitive hacking. Utilizing cyber-human aspects, we introduce a Cyber-Human Graph Neural Network (GNN) based framework GraphCH to identify abnormal user behaviors and detect insider threats.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2021

Domestic Extremism: Countering the Threat Posed to Critical Assets

Domestic extremism has been a growing concern in the United States in recent months, as illustrated in multiple bulletins from the Department of Homeland Security (DHS) warning law enforcement partners of the heightened threat. As concerns about these actors grows, it is important that facilities in the U.S. and internationally that protect critical assets, such as sensitive information, hazardous materials, or critical infrastructure, have effective methods in place to secure those assets. DE has challenged security systems through the threat of insider attack and violence, creating a new threat to be countered in the Office of Radiological Security’s radiological source security mission. In this effort, we used a literature review and focus group discussions with experts in critical asset security and extremism to understand the nature of the domestic extremist threat, to identify best practices in securing assets, recognize potential gaps in security measures to be corrected, and recommend actions and next steps. Twenty-two subject matter experts participated in a series of five focus group sessions. Questions focused on definitions of domestic extremism, potential changes in the threat, best practices in securing facilities, assets, and personnel, and any perceived gaps. Upon completion of the focus groups, notes were analyzed thematically to identify any recurring patterns in the results. In addition, a review of academic, industry, and government literature was conducted to understand the threat, describe the process of radicalization to extremism, and to identify empirically informed practices in prevention and response. Results of this project demonstrated that further work is needed to define domestic extremism in law, regulation, and policy, to help the U.S. develop a consistent response to the threat within organizations. This is especially important, as SMEs emphasized the need for early intervention in prevention efforts, noting that organizations need clear guidance on when and how to intervene. In addition, the need for social media monitoring was discussed, although challenges remain to do so with appropriate respect for privacy and civil liberties concerns.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗
DOE OSTI2021

Security Self-Assessment Toolkit for Nuclear Materials Facilities: Focus on Insider Threat Mitigation

Theft or sabotage of weapons-usable nuclear materials is a global concern. To minimize this threat, establishing and maintaining an effective nuclear security regime is required to protect against criminal or other negligent acts. Use of a formalized insider threat mitigation program is one such security measure. Individuals who have or held authorized access to an organization's critical assets, such as nuclear materials, are considered "insiders." Insider threats, or insider adversaries, are motivated individuals who possess access, authority, and knowledge to conduct a malicious act or facilitate that of an external party. To thwart insider threats (both intentional and unintentional), organizations can formalize an enterprise-wide approach to identify and mitigate the unique risks presented by insiders. This report provides an approach to evaluate an insider threat mitigation program at facilities with nuclear materials. Formal program evaluations serve many purposes and can be designed using several different methods and techniques. This report presents a self-assessment approach to program evaluation whereby an organization can assess its strengths, identify key gaps, and set priorities for ongoing improvement efforts to mitigate insider threats. Results of the self-assessment can provide critical information to contribute to the continuous improvement of an organization’s insider threat mitigation program within eight specific domain areas.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗
DOE OSTI2024

MetaPoL: Immersive VR based Indoor Patterns of Life (PoL) and Anomalies Data Generation for Insider Threat Modeling in Nuclear Security

Insider threats are perhaps the most serious challenges that nuclear and radiological security systems face. Insiders pose such a great threat due to their access, authority, and knowledge, granting them opportunities to bypass dedicated nuclear and radiological security elements. For example, in one of the latest major insider threat incidents to nuclear security, the Doel-4 nuclear powerplant in Belgium suffered a shutdown, the threat of nuclear materials diversion, and long-term loss of tens of millions of dollars. Seven years of investigation concluded that it was an inside job and attempted sabotage. In this regard, there is an immediate need for R&D and technology integration in the domain of modeling indoor Patterns-of-Life (PoL) and anomaly detection. This can be achieved by using datasets of facility users’ mobility and activity, which can support the design of algorithms for insider threat modeling and detection. However, due to classification, privacy, sensitivity, and safety protocols, such datasets from real physical nuclear reactor facilities are not only hard to share, but also not always feasible to deploy and collect. Aiming to find an alternate solution, our proposed demonstration work - MetaPoL, is the first-ever (for the application space) immersive VR (virtual reality) environment of a real-world secure facility and allows users to move-and-stay through the designed indoor physical layout and also encounter NPCs (non-player characters) that emulate other facility users. In the MetaPoL an interactive user performs realistic spatio-temporal movement, dwelling and activities using a Meta Quest Pro VR headset, and that generates high-frequency (in time) high-resolution (in space) indoor spatial-temporal datasets that are valuable for PoL modeling and anomaly detection research specifically for insider threat modeling and detection mission. Such generated realistic, rich in context, and mission specific datasets can boost AI/Machine Learning based research for modeling and detecting insider threats in nuclear security and nonproliferation.

Gunaratne, Chathika↗
DOE OSTI2017

Improving Insider Threat Training Awareness and Mitigation Programs at Nuclear Facilities.

In recent years, insider threat programs have become an important aspect of nuclear security, and nuclear security training courses. However, many nuclear security insider threat programs fail to address the insider threat attack and monitoring potential that exists on information technology (IT) systems. This failure is critical because of the importance of information technology and networks in today’s world. IT systems offer an opportunity to perpetrate dangerous insider attacks, but they also present an opportunity to monitor for them and prevent them. This paper suggests a number of best practices for monitoring and preventing insider attacks on IT systems, and proposes the development of a new IT insider threat tabletop that can be used to help train nuclear security practitioners on how best to implement IT insider threat prevention best practices. The development of IT insider threat best practices and a practical tabletop exercise will allow nuclear security practitioners to improve nuclear security trainings as it integrates a critical part of insider threat prevention into the broader nuclear security system.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗
DOE OSTI2020

Automated Threat Recognition For Aviation Security Applications

We have developed a framework for automated threat recognition (ATR) of explosive threat materials for both single-energy and dual-energy X-ray CT systems. Under this framework, two different types of ATR have been developed. The first type of ATR employs supervised machine learning with statistical characterization of target materials for threat identification training. The reliance only on statistical characterization information for threat training uniquely enables this style of ATR to adapt quickly to evolving threats. The second type of ATR employs deep learning through convolutional neural networks. Convolutional neural networks are attractive due to their human-like capacity for learning and strong ability to identify trends and patterns. Although this method is more powerful than the first type, it requires large amounts of training data and therefore is less agile. Each ATR performs threat characterization at the voxel neighborhood level. This approach avoids the use of threat shape as a detection criterion, which is prohibited by DHS and TSA guidelines.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

Capability Building Progression of an Insider Threat Mitigation Program at an International Research Reactor

The nuclear industry recognizes the difficulties involved in developing effective managerial and leadership skills in a highly technical and proficient workforce such as that found in nuclear facilities. Implementing an insider threat mitigation program (ITMP) within the nuclear industry is a complex and ongoing process that demands a comprehensive understanding of human behavior, an organization’s security culture, and rigorous regulatory requirements yet also accounts for facility characteristics, physical security, material flow, and activities involving nuclear material. Given the high-consequence nature of research reactor operations, even minor lapses can lead to safety, security, and reputational risks. An effective ITMP requires a defense-in-depth approach that incorporates behavioral analysis, robust vetting procedures, continuous monitoring, and cross-disciplinary coordination. It must also promote a culture of vigilance and accountability at all levels up to and including executive leadership but be flexible enough to adapt to evolving global threats and technological advances. Insider threat mitigation is not a one-time effort but rather a sustained commitment to excellence in safety and security. Establishing a culture in which personnel proactively report incidents and issues that could affect nuclear safety and security is vital to maintaining a safe and secure operational environment. This document was developed to guide senior management and research reactor organizations in creating comprehensive programs to effectively manage and mitigate insider threat behaviors and actions. It focuses on the key pillars of an effective ITMP, including the national legal framework, security culture, preventive and protective measures, cyber security, and performance evaluation. By using a systematic approach during implementation, facilities can foster environments conducive to insider threat detection and support long-term program sustainability. The document also provides strategies for improving communication across all levels of an organization, helping to eliminate barriers that hinder the development of robust ITMPs and enhance overall security culture. In today’s organizations, the concept of leveraging safety and security culture lessons to facilitate knowledge transfer is rapidly evolving to expedite insider threat management and security culture improvements. This document outlines the rationale for evaluating an ITMP based on national customs, culture, and stakeholders. The elements are all germane to reliability and trustworthiness and relate to security concerns that states may encounter. The document focuses not only on individual perceptions regarding security issues and capability building but also on team building and how to resolve concerns. The implementers of a facility’s ITMP may zero in on indicators of insider threats within their enterprise. This material will benefit organizations when it is applied using a systematic and structured approach as demonstrated throughout the document.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗
NASA NTRS2010

Forecasting Lightning Threat Using WRF Proxy Fields

Objectives: Given that high-resolution WRF forecasts can capture the character of convective outbreaks, we seek to: 1. Create WRF forecasts of LTG threat (1-24 h), based on 2 proxy fields from explicitly simulated convection: - graupel flux near -15 C (captures LTG time variability) - vertically integrated ice (captures LTG threat area). 2. Calibrate each threat to yield accurate quantitative peak flash rate densities. 3. Also evaluate threats for areal coverage, time variability. 4. Blend threats to optimize results. 5. Examine sensitivity to model mesh, microphysics. Methods: 1. Use high-resolution 2-km WRF simulations to prognose convection for a diverse series of selected case studies. 2. Evaluate graupel fluxes; vertically integrated ice (VII). 3. Calibrate WRF LTG proxies using peak total LTG flash rate densities from NALMA; relationships look linear, with regression line passing through origin. 4. Truncate low threat values to make threat areal coverage match NALMA flash extent density obs. 5. Blend proxies to achieve optimal performance 6. Study CAPS 4-km ensembles to evaluate sensitivities.

McCaul, E. W., Jr.↗
NASA NTRS2006

Using Flow Regime Lightning and Sounding Climatologies to Initialize Gridded Lightning Threat Forecasts for East Central Florida

Each morning, the forecasters at the National Weather Service in Melbourne, FL (NWS MLB) produce an experimental cloud-to-ground (CG) lightning threat index map for their county warning area (CWA) that is posted to their web site (http://www.srh.weather.gov/mlb/ghwo/lightning.shtml) . Given the hazardous nature of lightning in East Central Florida, especially during the warm season months of May September, these maps help users factor the threat of lightning, relative to their location, into their daily plans. The maps are color-coded in five levels from Very Low to Extreme, with threat level definitions based on the probability of lightning occurrence and the expected amount of CG activity. On a day in which thunderstorms are expected, there are typically two or more threat levels depicted spatially across the CWA. The locations of relative lightning threat maxima and minima often depend on the position and orientation of the low-level ridge axis, forecast propagation and interaction of sea/lake/outflow boundaries, expected evolution of moisture and stability fields, and other factors that can influence the spatial distribution of thunderstorms over the CWA. The lightning threat index maps are issued for the 24-hour period beginning at 1200 UTC each day with a grid resolution of 5 km x 5 km. Product preparation is performed on the AWIPS Graphical Forecast Editor (GFE), which is the standard NWS platform for graphical editing. Currently, the forecasters create each map manually, starting with a blank map. To improve efficiency of the forecast process, NWS MLB requested that the Applied Meteorology Unit (AMU) create gridded warm season lightning climatologies that could be used as first-guess inputs to initialize lightning threat index maps. The gridded values requested included CG strike densities and frequency of occurrence stratified by synoptic-scale flow regime. The intent is to improve consistency between forecasters while allowing them to focus on the mesoscale detail of the forecast, ultimately benefiting the end-users of the product. Several studies took place at the Florida State University (FSU) and NWS Tallahassee (TAE) in which they created daily flow regimes using Florida 1200 UTC synoptic soundings and CG strike densities, or number of strikes per specified area. The soundings used to determine the flow regimes were taken at Miami (MIA), Tampa (TBW), and Jacksonville (JAX), FL, and the lightning data for the strike densities came from the National Lightning Detection Network (NLDN). The densities were created on a 2.5 km x 2.5 km grid for every hour of every day during the warm seasons in the years 1989-2004. The grids encompass an area that includes the entire state of Florida and adjacent Atlantic and Gulf of Mexico waters. Personnel at FSU and NWS TAE provided this data and supporting software for the work performed by the AMU.

Lambert, Winifred↗
NASA NTRS2007

Using Flow Regime Lightning and Sounding Climatologies to Initialize Gridded Lightning Threat Forecasts for East Central Florida

Each morning, the forecasters at the National Weather Service in Melbourne, FL (NWS MLB) produce an experimental cloud-to-ground (CG) lightning threat index map for their county warning area (CWA) that is posted to their web site (httl://www.srh.weather.gov/mlb/ghwo/lightning.shtml) . Given the hazardous nature of lightning in East Central Florida, especially during the warm season months of May September, these maps help users factor the threat of lightning, relative to their location, into their daily plans. The maps are color-coded in five levels from Very Low to Extreme, with threat level definitions based on the probability of lightning occurrence and the expected amount of CG activity. On a day in which thunderstorms are expected, there are typically two or more threat levels depicted spatially across the CWA. The locations of relative lightning threat maxima and minima often depend on the position and orientation of the low-level ridge axis, forecast propagation and interaction of sea/lake/outflow boundaries, expected evolution of moisture and stability fields, and other factors that can influence the spatial distribution of thunderstorms over the CWA. The lightning threat index maps are issued for the 24-hour period beginning at 1200 UTC each day with a grid resolution of 5 km x 5 km. Product preparation is performed on the AWIPS Graphical Forecast Editor (GFE), which is the standard NWS platform for graphical editing. Until recently, the forecasters created each map manually, starting with a blank map. To improve efficiency of the forecast process, NWS MLB requested that the Applied Meteorology Unit (AMU) create gridded warm season lightning climatologies that could be used as first-guess inputs to initialize lightning threat index maps. The gridded values requested included CG strike densities and frequency of occurrence stratified by synoptic-scale flow regime. The intent was to improve consistency between forecasters while allowing them to focus on the mesoscale detail of the forecast. Several studies took place at the Florida State University (FSU) and NWS Tallahassee (TAE) in which they created daily flow regimes using Florida 1200 UTC synoptic soundings and CG strike densities, or number of strikes per specified area. The soundings used to determine the flow regimes were taken at Miami (MIA), Tampa (TBW), and Jacksonville (JAX), FL, and the lightning data for the strike densities came from the National Lightning Detection Network (NLDN). The densities were created on a 2.5 km x 2.5 km grid for every hour of every day during the warm seasons in the years 1989-2004. The grids encompass an area that includes the entire state of Florida and adjacent Atlantic and Gulf of Mexico waters. Personnel at FSU and NWS TAE provided this data and supporting software for the work performed by the AMU.

Lambert, Winifred↗
DOE OSTI2022

Threat emulation framework

A method for emulating threats in virtual network computing environment is provided. The method comprises creating a number of virtual machines in the virtual network computing environment. A number of threat actors are emulated, wherein each threat actor comprises a number of threat artifacts that form a sequence of attack steps against the virtual network computing environment. The threat actors are then deployed against the virtual network computing environment. Behavioral data about actions of the threat actors in the virtual network computing environment is collected, as is performance data about the virtual network computing environment in response to the threat actors. The collected behavioral and performance data is then presented to a user via an interface.

Urias, Vincent↗
DOE OSTI2016

Cyber Threat and Vulnerability Analysis of the U.S. Electric Sector

With utilities in the U.S. and around the world increasingly moving toward smart grid technology and other upgrades with inherent cyber vulnerabilities, correlative threats from malicious cyber attacks on the North American electric grid continue to grow in frequency and sophistication. The potential for malicious actors to access and adversely affect physical electricity assets of U.S. electricity generation, transmission, or distribution systems via cyber means is a primary concern for utilities contributing to the bulk electric system. This paper seeks to illustrate the current cyber-physical landscape of the U.S. electric sector in the context of its vulnerabilities to cyber attacks, the likelihood of cyber attacks, and the impacts cyber events and threat actors can achieve on the power grid. In addition, this paper highlights utility perspectives, perceived challenges, and requests for assistance in addressing cyber threats to the electric sector. There have been no reported targeted cyber attacks carried out against utilities in the U.S. that have resulted in permanent or long term damage to power system operations thus far, yet electric utilities throughout the U.S. have seen a steady rise in cyber and physical security related events that continue to raise concern. Asset owners and operators understand that the effects of a coordinated cyber and physical attack on a utility’s operations would threaten electric system reliability–and potentially result in large scale power outages. Utilities are routinely faced with new challenges for dealing with these cyber threats to the grid and consequently maintain a set of best practices to keep systems secure and up to date. Among the greatest challenges is a lack of knowledge or strategy to mitigate new risks that emerge as a result of an exponential rise in complexity of modern control systems. This paper compiles an open-source analysis of cyber threats and risks to the electric grid, utility best practices for prevention and response to cyber threats, and utility suggestions about how the federal government can aid utilities in combating and mitigating risks.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2026

Digital-Threat Bias and Psychological Distance: Barriers to Foundational Digital-Security Improvement

Modern life is held together by a web of digital dependencies that enable and provide delivery of critical services and functions—think the provision of utilities such as electricity and water, as well as our dependency on digital services for social and economic services (internet, communication, etc.). As this dependency grows, the complexity related to the delivery of these critical services increases as well. As complexity increases, the understanding of the risk and impact associated with potential disruption, degradation, or destruction—due to either malicious or non-malicious events of those digitally enabled functions—decreases. One potential explanation for the difficulty to 1) understand the risks faced and 2) address them appropriately and effectively is the abstractness and psychological distance assigned to “digital threat.” The complexity of these digitally enabled services creates a perceived complicatedness; as a result, digital threats are treated differently than similarly devasting (but more easily understood) kinetic or physical threats. How we categorize these threats also matters. Acts of cyber-enabled sabotage to critical infrastructure need to be defined as irregular warfare. By inadequately defining the threat, we compound the problem. Acknowledging this digital-threat bias is foundational to improving the ability to protect critical infrastructure. Using construal-level theory and psychological-distance concepts provides an intriguing starting point to address these issues, to reframe the challenges faced, and pursue more effective critical infrastructure security and defense policy.

29 - ENERGY PLANNING, POLICY AND ECONOMY↗
DOE OSTI2026

Automated Generation of Graph-based Cyber Threat Intel

With the advancement of AI technology and tools, specifically in the cybersecurity domain, both cyber defenders and threat actors are continuously adapting the use of these capabilities to expedite their operations. With this phenomenon, threat intelligence that is up to date, refreshable, and has relevant context to a specific threat becomes more and more important as it enables cybersecurity professionals to gain insight into relevant data and relationships to guide their operations. This project enables users to frequently aggregate threat intelligence from various sources, such as vendor vulnerability advisories affecting critical infrastructure, malware reports, and adversary writeups into a centralized, standardized database. The project utilizes the Structured Threat Intelligence eXpression (STIX) for a standardized, shareable threat intelligence data format and Neo4j as a graph database solution to store STIX nodes and relationships. Initial results of the project include datasets of over 8,000 nodes and 20,000 relationships extracted from over 500 data sources that have been released within the past month.

Threat Intelligence↗
DOE OSTI2019

A Passive Network Cyber Threat Intelligence Framework for Legacy Critical Control Systems using Machine Learning

The importance of Internet and communication networks in our daily life and in any organization’s daily operations is well known and cannot be overstressed. A nation’s economy is fully reliant on its critical infrastructure. Energy sector is one of the 16 Critical Infrastructure Sectors identified by the Department of Homeland Security. Securing these critical infrastructure sectors is challenging but is also of utmost priority in this day of constant and persistent cyber threats. Threat is any circumstance or event that has the potential to adversely impact an agency's assets and operations. Cyber Threat Intelligence (CTI) is the process of collection, analysis, and identification of potential cyber threats to the organization. This goal of current research performed at the Savannah River National Laboratory (SRNL), Aiken, SC, is to develop a Cyber Threat Intelligence framework for gathering Threat Intelligence passively from the network traffic from and to a real or simulated Critical Control Systems.

97 MATHEMATICS AND COMPUTING↗