Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “anomaly detection (AD)”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2

Process Anomaly Detection for Sparsely Labeled Events in Nuclear Power Plants

An essential aspect of online monitoring, subtle anomaly detection increases the detection lead time for equipment failure and enables a nuclear power plant (NPP) to mitigate unexpected partial or full outages, resulting in significant cost saving to the plant. Once an anomaly is detected by plant staff, its cause and severity are investigated. Because the vast majority of anomalies require some level of investigation, including some that require time-consuming examination, before they are passed over to the engineering organization for further analysis, plants are often equipped with tools to assist the staff in performing anomaly detection. Those tools operate as a black box and are often based on statistical methods that establish sensor correlations using preconfigured mathematical models and flag correlation deviations as anomalies. Due to the number of anomalies detected at a given NPP on a daily basis, a significant number of flagged anomalies usually await examination for days or weeks. A primary cause of this backlog is that the methods used by the tools generate many false positives. Though this is usually attributed to oversensitive model settings due to very narrow normal operation bands, it can also be associated with the model development being inadequate for the process being monitored, or with missing model inputs that could have explained misclassified positives. The performance of anomaly detection tools impacts their plant acceptance and utilization, especially when the effort to address false positives generated by the tool depletes the value or cost saved by using that tool. Thus, means to advance anomaly detection performance have been investigated by the Department of Energy’s Light Water Reactor Sustainability program. Previous and ongoing efforts have targeted unsupervised machine-learning (ML) methods, which do not require the labeling of any data fed into the ML model. By contrast, in supervised anomaly detection methods, every data point is labeled as either a normal or abnormal process condition, and the model is trained to replicate the classification process. Supervised methods usually outperform unsupervised methods, due to the added value in differentiating normal from anomalous states of the monitored process. An NPP’s corrective action program requires it to track and document, via a dedicated report, the resolution of any issues that occur within the plant. Once created, each report is reviewed by a plant screening committee, and several classifications and decisions are made. Recently, a collaborating NPP developed an artificial intelligence and ML-based classifier to categorize a condition report (CR) into classes that can serve to label the data as normal or anomalous. Applying CRs as labels represents a semi-supervised use case. Semi-supervised ML assumes that labels exist for some data points (i.e., labeled anomalies, in this case) but not for the rest. In this effort, semi-supervised ML methods were used to fuse data from CRs with anomaly detection methods in order to test the hypothesis that partially labeled anomalies would improve the accuracy of the anomaly detection methods. Specifically, two methods were used. The first is the deep Semi-supervised Anomaly Detection (deep SAD) method, which can handle labels ranging from fully unsupervised to fully supervised cases. The second is a newly designed ML method developed specifically for this effort and referred to as the high-order feature (HOF)-based method. To evaluate these two methods in controlled environments, synthetic data generators were developed and used. The first datasets used a spring-mass-damper (SMD) system simulator commonly found in mechanical engineering references. This was used to create two use cases: a one- and a three-mass system. Anomalies were introduced by changing the spring and damper coefficients while the system was actuated by random forces. The second datasets used the commercial Dymola-Modelica software to build a simplified nuclear reactor model. Anomalies were added in the form of corrupted sensor readings and/or control commands. The deep SAD method was tested using the SMD system, while the HOF method was tested using both datasets. Application of the deep SAD semi-supervised ML method demonstrated that labels can generate increased confidence in detecting true anomalies. This helped increase the number of true positives and decrease the number of false negatives—something that would aid in addressing the backlog of possible anomalies. Application of the HOF method demonstrated that labels can aid in down selecting from a candidate set of features to a more optimal subset in order to better differentiate between normal and anomalous conditions.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗

Efficient Client Selection in Federated Learning

Federated Learning (FL) enables decentralized machine learning while preserving data privacy. This paper proposes a novel client selection framework that integrates differential privacy and fault tolerance. The adaptive client selection adjusts the number of clients based on performance and system constraints, with noise added to protect privacy. Evaluated on the UNSW-NB15 and ROAD datasets for network anomaly detection, the method improves accuracy by 7% and reduces training time by 25 % compared to baselines. Fault tolerance enhances robustness with minimal performance trade-offs.

Marfo, William [University of Texas at El Paso,Dep↗

A Wavelet Analysis Approach for Categorizing Air Traffic Behavior

In this paper two frequency domain techniques are applied to air traffic analysis. The Continuous Wavelet Transform (CWT), like the Fourier Transform, is shown to identify changes in historical traffic patterns caused by Traffic Management Initiatives (TMIs) and weather with the added benefit of detecting when in time those changes take place. Next, with the expectation that it could detect anomalies in the network and indicate the extent to which they affect traffic flows, the Spectral Graph Wavelet Transform (SGWT) is applied to a center based graph model of air traffic. When applied to simulations based on historical flight plans, it identified the traffic flows between centers that have the greatest impact on either neighboring flows, or flows between centers many centers away. Like the CWT, however, it can be difficult to interpret SGWT results and relate them to simulations where major TMIs are implemented, and more research may be warranted in this area. These frequency analysis techniques can detect off-nominal air traffic behavior, but due to the nature of air traffic time series data, so far they prove difficult to apply in a way that provides significant insight or specific identification of traffic patterns.

wavelet analysis↗

Integrated System Health Management: Foundational Concepts, Approach, and Implementation

A sound basis to guide the community in the conception and implementation of ISHM (Integrated System Health Management) capability in operational systems was provided. The concept of "ISHM Model of a System" and a related architecture defined as a unique Data, Information, and Knowledge (DIaK) architecture were described. The ISHM architecture is independent of the typical system architecture, which is based on grouping physical elements that are assembled to make up a subsystem, and subsystems combine to form systems, etc. It was emphasized that ISHM capability needs to be implemented first at a low functional capability level (FCL), or limited ability to detect anomalies, diagnose, determine consequences, etc. As algorithms and tools to augment or improve the FCL are identified, they should be incorporated into the system. This means that the architecture, DIaK management, and software, must be modular and standards-based, in order to enable systematic augmentation of FCL (no ad-hoc modifications). A set of technologies (and tools) needed to implement ISHM were described. One essential tool is a software environment to create the ISHM Model. The software environment encapsulates DIaK, and an infrastructure to focus DIaK on determining health (detect anomalies, determine causes, determine effects, and provide integrated awareness of the system to the operator). The environment includes gateways to communicate in accordance to standards, specially the IEEE 1451.1 Standard for Smart Sensors and Actuators.

Figueroa, Fernando↗

Detecting Satellite Laser Ranging Station Data and Operational Anomalies with Machine Learning Isolation Forests at NASA's CDDIS

The International Laser Ranging Service (ILRS) is currently composed of 45 active satellite laser ranging (SLR) stations with several more set to join the network over the next several years. Station changes and histories are logged to files, but not always in real time. Sometimes these details are not added until long after changes have been made to the station –on occasion, years later. This in addition to unexpected hardware errors and other system issues that are not immediately detected impact the products generated by analysts. The ILRS Central Bureau (CB) and NASA’s Crustal Dynamics Data Information System (CDDIS) have worked to provide tools for station engineers to use. This includes the creation of station plots which contain temperature and pressure information along with LAser GEOdynamic Satellite (LAGEOS) and LAser RElativity Satellite (LARES) tracking information that enable the monitoring of station performance and todetermine whether the station has undergone any changes. As next steps, the CDDIS is working to enhance these station performance monitoring tools through machine learning. Isolation forest is an unsupervised machine learning algorithm commonly applied to anomaly detection. In this poster, the CDDIS details the steps taken to track anomalies within SLR station performance using isolation forest with LAGEOS and LARES satellite data.

Benjamin P Michael↗

Evaluation of a Surface Spill Operation to Return Adult Steelhead Overshoots Downstream of McNary Dam

This study, funded by the U.S. Army Corps of Engineers (USACE), was conducted by the Pacific Northwest National Laboratory to evaluate the efficacy of operating one Top Spill Weir (TSW) at McNary Dam outside the normal TSW operation dates for juvenile salmon passage. Of interest is whether the TSW is an effective downstream passage route for adult steelhead overshoots. Overshoots are fish which, having passed upstream at McNary Dam, must pass downstream to return to their natal stream to spawn. This report covers Fall (2019) and Spring (2020) study periods. The study design arranged the available 24 hours of TSW spill per week into weekly blocks with sub-blocks differentiated into day and night operations with TSW discharge periods of 4- and 8-hours duration. Hydroacoustic techniques were used to sample adult fish passage at the TSW and at turbine units 1 and 10. The experimental design contrasted TSW spill periods of differing duration and at different times of the day. The small number of fish detected passing the TSW, and the smaller number of fish detected passing the turbine units, were best suited to an ad hoc, exploratory approach to evaluating the effect of TSW spill. It is worthwhile to note that the operations data obtained for the fall study period had a greater than expected number of gaps and apparent anomalies that we believe were a result of how the data were aggregated. These problems are not particularly problematic for the present study, because the available data still provide a good indication of whether the TSW was operating at each point in time. TSW flows in both fall and spring data sets were able to be cleaned up using the established relationship between forebay elevation and TSW discharge rate. Additional cleanup of operations data would be needed, however, if more quantitative evaluation of dam-wide flow and passage relationships were needed. This study contrasted TSW spill periods of differing duration and at different times of the day. The small number of fish detected passing the TSW, and the smaller number of fish detected passing the turbine units were best suited to an ad hoc, exploratory approach to evaluating the effect of TSW spill. Spring adult steelhead passage numbers estimated using hydroacoustics were notably lower than during the fall study period, and that was consistent with our analysis of PIT tagged fish likely to be in the vicinity during each study period. Detections of fish in BlueView sampling areas upstream of the TSW and powerhouse were not correlated with detections of fish passing hydroacoustic sampling areas, which suggests that fish approaching the face of the dam can move around the forebay before passing. Other fish detected in the forebay in large numbers, such as shad, were able to be filtered out of steelhead passage counts and did not appear to be influencing hydroacoustic passage rate estimates. A pulse of passage at the initial TSW opening was weakly evident, but trends across 4- and 8-hour operational periods did not show a distinct decline in passage over time as TSW operation continued. Our findings do not indicate a reason to choose one 8-hour period over two 4-hour periods, or vice versa. This suggests that the duration of spill periods can be chosen based on operational or other considerations. Passage rates were consistently higher during the daytime TSW discharge periods, relative to nighttime TSW discharge periods. The experimental design of the current study used start times near dawn for day periods and near dusk for night periods.

59 BASIC BIOLOGICAL SCIENCES↗

Federated Machine Learning-Based Anomaly Detection System for Synchrophasor Network Using Heterogeneous Data Sets: Preprint

Synchrophasor technology is widely deployed in the energy management system to monitor the grid health at micro level and perform necessary corrective actions in real time; however, integrated phasor devices and data aggregators are exposed to several cybersecurity threats. This paper proposes a federated ML(FML)-based ADS to detect several data integrity attacks in the synchrophasor network. The proposed approach integrates the horizontal FML technique and consists of substation-based local models and a control center-based global model. The proposed methodology includes training local models using heterogeneous data sets that include network and grid information and updating the global model through multiple iterations by sharing model gradients. Finally, the trained global model is applied to identify cyberattacks, normal operation, and physical events. To validate the proof of concept, we used synthetic data sets generated by Mississippi State University and Oak Ridge National Laboratory for training and testing the classification models using the National Renewable Energy Laboratory's high performance computing resources. Our experimental results, computed through several performance measures, reveal that the proposed approach shows consistent performance during the binary, three-class, and multiclass classifications while ensuring privacy of synchrophasor data.

anomaly detection system↗

TDCOSMO. VII. Boxyness/discyness in lensing galaxies: Detectability and impact on H 0

In the context of gravitational lensing, the density profile of lensing galaxies is often considered to be perfectly elliptical. Potential angular structures are generally ignored, except to explain flux ratios of point-like sources (i.e. flux ratio anomalies). Surprisingly, the impact of azimuthal structures on extended images of the source has not been characterised, nor has its impact on the H 0 inference. We address this task by creating mock images of a point source embedded in an extended source and lensed by an elliptical galaxy on which multipolar components are added to emulate boxy or discy isodensity contours. Modelling such images with a density profile free of angular structure allows us to explore the detectability of image deformation induced by the multipoles in the residual frame. Multipole deformations are almost always detectable for our highest signal-to-noise ratio (S/N) mock data. However, the detectability depends on the lens ellipticity and Einstein radius, on the S/N of the data, and on the specific lens modelling strategy. Multipoles also introduce small changes to the time-delays. We therefore quantify how undetected multipoles would impact H 0 inference. When no multipoles are detected in the residuals, the impact on H 0 for a given lens is in general less than a few k ms -1 Mpc -1 , but in the worst-case scenario, combining low S/N in the ring and large intrinsic boxyness or discyness, the bias on H0 can reach 10-12 km s -1 Mpc -1 . If we now look at the inference on H 0 from a population of lensing galaxies with a distribution of multipoles representative of what is found in the light profile of elliptical galaxies, we find a systematic bias on H 0 of less than 1%. A comparison of our mock systems to the state-of-the-art time-delay lens sample studied by the H0LiCOW and TDCOSMO collaborations indicates that multipoles are currently unlikely to be a source of substantial systematic bias on the inferred value of H 0 from time-delay lenses.

79 ASTRONOMY AND ASTROPHYSICS↗

Scientific and Technical Assistance for the Deployment of a Flexible Airborne Spectrometer System During C-MAPExp and COMEX: COMEX Version - 1.9T

The COMEX (CO2 and MEthane eXperiment) campaign supports the mission definition of CarbonSat and HyspIRI (Hyperspectral Infrared Imager) by providing representative airborne remote sensing data ‐ MAMAP (Methane Airborne MAPper) for CarbonSat; the Airborne Visual InfraRed Imaging Spectrometer (Classic & Next Generation) AVIRIS‐C/AVIRIS‐NG for HyspIRI ‐ as well as ground-based and airborne in‐situ data. The objectives of the COMEX campaign activities are (see Campaign Implementation Plan (RD‐4)): 1. Investigate spatial/spectral resolution trade‐offs for CH4 anomaly detection and flux inversion by comparison of MAMAP‐derived emission estimates with AVIRIS/AVIRIS‐NG derived data. 2. Evaluate sun‐glint observation geometry on CH4 retrievals for marine sources. 3. Characterize the effect of Surface Spectral Reflectance (SSR) heterogeneity on trace gas retrievals of CO2 and CH4 for medium and low‐resolution spectrometry. 4. Identify benefits from joint SWIR/TIR (ShortWave InfraRed/Thermal InfraRed ) data for trace gas detection and retrieval by comparison of MAMAP and AVIRIS/AVIRIS‐NG NIR/SWIR data with MAKO (Aerospace Corp.)TIR data. The ability to derive emission source strength for a range of strong emitting targets by remote sensing will be evaluated from combined AVIRIS‐NG and MAMAP data, adding significant value to the HyspIRI campaign AVIRIS‐NG dataset. The data will be used to quantify anomalies in atmospheric CO2 and CH4 from strong local greenhouse gas sources e.g. localized industrial complexes, landfills, etc. and to derive CO2 and CH4 emissions estimates from atmospheric gradient measurements. The original campaign concept was developed by University of Bremen and BRI. The COMEX campaign is funded bilaterally by NASA and ESA (European Space Agency). Whereas NASA funds the US part of the project via a contract with Dr. Ira Leifer, BRI (Bubbleology Research International), the contribution of MAMAP to the COMEX campaign is funded by ESA within the COMEX‐E project and NASA with respect to a 50 percent contribution to the flight-related costs of flying MAMAP on a US aircraft. The Data Acquisition Report (RD‐9) describes the instrumentation used, the measurements made by the team during the COMEX campaign in May/June 2014 and August/September 2014 in California, and an initial assessment of the data quality.

Point Sources↗

Potential of Pest and Host Phenological Data in the Attribution of Regional Forest Disturbance Detection Maps According to Causal Agent

Near real time forest disturbance detection maps from MODIS NDVI phenology data have been produced since 2010 for the conterminous U.S., as part of the on-line ForWarn national forest threat early warning system. The latter has been used by the forest health community to identify and track many regional forest disturbances caused by multiple biotic and abiotic damage agents. Attribution of causal agents for detected disturbances has been a goal since project initiation in 2006. Combined with detailed cover type maps, geospatial pest phenology data offer a potential means for narrowing the candidate causal agents responsible for a given biotic disturbance. U.S. Aerial Detection Surveys (ADS) employ such phenology data. Historic ADS products provide general locational data on recent insect-induced forest type specific disturbances that may help in determining candidate causal agents for MODIS-based disturbance maps, especially when combined with other historic geospatial disturbance data (e.g., wildfire burn scars and drought maps). Historic ADS disturbance detection polygons can show severe and extensive regional forest disturbances, though they also can show polygons with sparsely scattered or infrequent disturbances. Examples will be discussed that use various historic disturbance data to help determine potential causes of MODIS-detected regional forest disturbance anomalies.

Spruce, Joseph↗

A comprehensive guide to CAN IDS data and introduction of the ROAD dataset

Although ubiquitous in modern vehicles, Controller Area Networks (CANs) lack basic security properties and are easily exploitable. A rapidly growing field of CAN security research has emerged that seeks to detect intrusions or anomalies on CANs. Producing vehicular CAN data with a variety of intrusions is a difficult task for most researchers as it requires expensive assets and deep expertise. To illuminate this task, we introduce the first comprehensive guide to the existing open CAN intrusion detection system (IDS) datasets. We categorize attacks on CANs including fabrication (adding frames, e.g., flooding or targeting and ID), suspension (removing an ID’s frames), and masquerade attacks (spoofed frames sent in lieu of suspended ones). We provide a quality analysis of each dataset; an enumeration of each datasets’ attacks, benefits, and drawbacks; categorization as real vs. simulated CAN data and real vs. simulated attacks; whether the data is raw CAN data or signal-translated; number of vehicles/CANs; quantity in terms of time; and finally a suggested use case of each dataset. State-of-the-art public CAN IDS datasets are limited to real fabrication (simple message injection) attacks and simulated attacks often in synthetic data, lacking fidelity. In general, the physical effects of attacks on the vehicle are not verified in the available datasets. Only one dataset provides signal-translated data but is missing a corresponding “raw” binary version. This issue pigeon-holes CAN IDS research into testing on limited and often inappropriate data (usually with attacks that are too easily detectable to truly test the method). The scarcity of appropriate data has stymied comparability and reproducibility of results for researchers. As our primary contribution, we present the Real ORNL Automotive Dynamometer (ROAD) CAN IDS dataset, consisting of over 3.5 hours of one vehicle’s CAN data. ROAD contains ambient data recorded during a diverse set of activities, and attacks of increasing stealth with multiple variants and instances of real (i.e. non-simulated) fuzzing, fabrication, unique advanced attacks, and simulated masquerade attacks. To facilitate a benchmark for CAN IDS methods that require signal-translated inputs, we also provide the signal time series format for many of the CAN captures. Our contributions aim to facilitate appropriate benchmarking and needed comparability in the CAN IDS research field.

97 MATHEMATICS AND COMPUTING↗

An Analysis of the Statistics and Systematics of Limb Anomaly Detections in HST/STIS Transit Images of Europa

Several recent studies derived the existence of plumes on Jupiter’s moon Europa. The only technique that provided multiple detections is the far-ultraviolet imaging observations of Europa in transit of Jupiter taken by the Space Telescope Imaging Spectrograph (STIS) on the Hubble Space Telescope (HST). In this study, we reanalyze the three HST/STIS transit images in which Sparks et al. identified limb anomalies as evidence for Europa’s plume activity. After reproducing the results of Sparks et al., we find that positive outliers are similarly present in the images as the negative outliers that were attributed to plume absorption. A physical explanation for the positive outliers is missing. We then investigate the systematic uncertainties and statistics in the images and identify two factors that are crucial when searching for anomalies around the limb. One factor is the alignment between the actual and assumed locations of Europa on the detector. A misalignment introduces distorted statistics, most strongly affecting the limb above the darker trailing hemisphere where the plumes were detected. The second factor is a discrepancy between the observation and the model used for comparison, adding uncertainty in the statistics. When accounting for these two factors, the limb minima (and maxima) are consistent with random statistical occurrence in a sample size given by the number of pixels in the analyzed limb region. The plume candidate features in the three analyzed images can be explained by purely statistical fluctuations and do not provide evidence for absorption by plumes.

79 ASTRONOMY AND ASTROPHYSICS↗

Autonomous Cryogenic Load Operations: KSC Autonomous Test Engineer

The KSC Autonomous Test Engineer (KATE) program has a long history at KSC. Now a part of the Autonomous Cryogenic Load Operations (ACLO) mission, this software system has been sporadically developed over the past 20+ years. Originally designed to provide health and status monitoring for a simple water-based fluid system, it was proven to be a capable autonomous test engineer for determining sources of failure in. the system, As part.of a new goal to provide this same anomaly-detection capability for a complicated cryogenic fluid system, software engineers, physicists, interns and KATE experts are working to upgrade the software capabilities and graphical user interface. Much progress was made during this effort to improve KATE. A display ofthe entire cryogenic system's graph, with nodes for components and edges for their connections, was added to the KATE software. A searching functionality was added to the new graph display, so that users could easily center their screen on specific components. The GUI was also modified so that it displayed information relevant to the new project goals. In addition, work began on adding new pneumatic and electronic subsystems into the KATE knowledgebase, so that it could provide health and status monitoring for those systems. Finally, many fixes for bugs, memory leaks, and memory errors were implemented and the system was moved into a state in which it could be presented to stakeholders. Overall, the KATE system was improved and necessary additional features were added so that a presentation of the program and its functionality in the next few months would be a success.

Shrading, Nicholas J.↗

Autonomous Cryogenic Load Operations: Knowledge-Based Autonomous Test Engineer

The Knowledge-Based Autonomous Test Engineer (KATE) program has a long history at KSC. Now a part of the Autonomous Cryogenic Load Operations (ACLO) mission, this software system has been sporadically developed over the past 20 years. Originally designed to provide health and status monitoring for a simple water-based fluid system, it was proven to be a capable autonomous test engineer for determining sources of failure in the system. As part of a new goal to provide this same anomaly-detection capability for a complicated cryogenic fluid system, software engineers, physicists, interns and KATE experts are working to upgrade the software capabilities and graphical user interface. Much progress was made during this effort to improve KATE. A display of the entire cryogenic system's graph, with nodes for components and edges for their connections, was added to the KATE software. A searching functionality was added to the new graph display, so that users could easily center their screen on specific components. The GUI was also modified so that it displayed information relevant to the new project goals. In addition, work began on adding new pneumatic and electronic subsystems into the KATE knowledge base, so that it could provide health and status monitoring for those systems. Finally, many fixes for bugs, memory leaks, and memory errors were implemented and the system was moved into a state in which it could be presented to stakeholders. Overall, the KATE system was improved and necessary additional features were added so that a presentation of the program and its functionality in the next few months would be a success.

Schrading, J. Nicolas↗

Resonant anomaly detection with multiple reference datasets

An important class of techniques for resonant anomaly detection in high energy physics builds models that can distinguish between reference and target datasets, where only the latter has appreciable signal. Such techniques, including Classification Without Labels (CWoLa) and Simulation Assisted Likelihood-free Anomaly Detection (SALAD) rely on a single reference dataset. They cannot take advantage of commonly available multiple datasets and thus cannot fully exploit available information. In this work, we propose generalizations of CWoLa and SALAD for settings where multiple reference datasets are available, building on weak supervision techniques. We demonstrate improved performance in a number of settings with realistic and synthetic data. As an added benefit, our generalizations enable us to provide finite-sample guarantees, improving on existing asymptotic analyses.

72 PHYSICS OF ELEMENTARY PARTICLES AND FIELDS↗

Oak Ridge National Laboratory Pilot Demonstration of an Attestation and Anomaly Detection Framework using Distributed Ledger Technology for Power Grid Infrastructure

This report summarizes the design and pilot demonstration of a framework called Grid Guard that was created to provide increased data and device trustworthiness to electric grid devices by leveraging distributed ledger technology (DLT), specifically blockchain. Grid Guard contains a combination of core cryptographic methods such as the secure hash algorithm (SHA), and asymmetric cryptography, private permissioned blockchain, baselining configuration data, consensus algorithm (Raft) and the Hyperledger Fabric (HLF) framework. The system implements a low energy, fast, and robust enhancement to system trustworthiness within and across electric grid systems such as substations, control centers and metering infrastructures. Blockchain is a distributed database structured that provides a practically unalterable (immutable) timeline of stored transactions. By relying on hashing and the Raft consensus algorithm, if an entity tries to illegitimately alter a record at one instance of the database the other ledger nodes are not altered. They work to cross-reference each other and easily locate any incorrectly added data and remove it. The bulk raw data is stored in an off-chain storage (outside of the blockchain ledger) and a hash of this baseline data is stored in the Blockchain ledger via hashing windows of time-series and configuration data, after aggregation and filtering. The bulk off-chain data repository is then considered to be trust-anchored using the hashes stored in the blockchain. To secure the electric grid testbed devices and data, device configuration baselines were compared to those baselines that had been previously stored in the ledger. Statistical baselines for device configurations, network communication patterns, and high-speed sensor data are calculated and then stored off-chain and hashes stored in the ledger. Measurements such as three-phase voltage and current, frequency, breaker status, protection scheme settings, network configuration settings (and other device configuration artifacts) and network traffic features (packet interarrival times) are compared every minute or other selected time windows. During phase 1 of the Grid Guard DLT project different DLT technologies were studies, and an assessment was performed on DLT technology vulnerabilities, uses, and key characteristics. DLT consensus protocols were studies (e.g., RAFT, named after Reliable, Replicated, Redundant, And Fault-Tolerant). Also, cryptography, public, private and permissioned or permissionless systems were assessed. Grid Guard implements a permissioned private DLT. Consensus algorithm selection and choice of DLT implementation depended heavily on the use-case. For this use-case, parameters were selected to measure performance and existing tools for assessment. Benchmarking was performed theoretically and practically. During phase 2 hashed transactions/blocks were inserted into the ledger every second. During phase 2 of the Grid Guard DLT project, a prototype framework was developed and demonstrated for attestation of critical substation devices and data using precision timing systems that use PTP and IRIG-B protocols) on a testbed of operational devices that emulated a distribution substation, control center, and power metering infrastructure using real Operational Technology (OT). The testbed includes OT devices such as protective relays, human machine interfaces (HMI), and power meters. To determine when to collect and compare system and network baselines, an initial examination of an anomaly detection capability to identify malicious manipulation of data streams was conducted. The resulting anomaly detection was demonstrated in a set of experiments and leveraged to trigger device artifact attestation checks. Attestation checks occur against device configuration baselines when compared with the immutable blockchain-stored baselines, which provided a cryptographically supported means by which to store baselines. The electrical substation-grid testbed was created to test the Grid Guard framework. The testbed emulates the operations of a portion of a power grid and SCADA systems as closely as possible. The testbed integrates real protocols, mainly IEC 61850 standard protocols, such as the Sampled Value (SV) and the GOOSE protocols. The testbed also supports DNP3 and other layer 2 and layer 3 protocols such as Telnet, SSH, SFTP/FTP and other proprietary protocols needed to connect to industrial control system equipment. The testbed emulates real power conditions using the OpalRT hardware-in-the-loop (HIL) device which can create fault situations that cannot be easily tested on real systems. The electrical substation-grid testbed was created using real measurement, communication, and protection devices that electrical utilities commonly use.

24 POWER TRANSMISSION AND DISTRIBUTION↗

A Programmable SDN+NFV Architecture for UAV Telemetry Monitoring

With the explosive growth in UAV numbers forecast worldwide, a core concern is how to manage the ad-hoc network configuration required for mobility management. As UAVs migrate among ground control stations, associated network services, routing and operational control must also rapidly migrate to ensure a seamless transition. In this paper, we present a novel, lightweight and modular architecture which supports high mobility, resilience and flexibility through the application of SDN and NFV principles on top of the UAV infrastructure. By combining SDN programmability and Network Function Virtualization we can achieve resilient infrastructure migration of network services, such as network monitoring and anomaly detection, coupled with migrating UAVs to enable high mobility management. Our container-based monitoring and anomaly detection Network Functions (NFs) can be tuned to specific UAV models providing operators better insight during live, high-mobility deployments. We evaluate our architecture against telemetry from over 80flights from a scientific research UAV infrastructure.

Resilience↗