Robust Dynamic Watermarking for Cyber-Physical Security of Inverter-Based Resources in Power Distribution Systems
Not provided.
Automation & Control Systems↗
SEARCH · Engineering Papers
Results for “attack identification”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
SeqMask: Behavior Extraction Over Cyber Threat Intelligence Via Multi-Instance Learning
Abstract Identification and extraction of Tactics, Techniques and Procedures (TTPs) for Cyber Threat Intelligence (CTI) restore the full picture of cyber attacks and guide the analysts to assess the system risk. Existing frameworks can hardly provide uniform and complete processing mechanisms for TTPs information extraction without adequate knowledge background. A multi-instance learning approach named SeqMask is proposed in this paper as a solution. SeqMask extracts behavior keywords from CTI evaluated by the semantic impact, and predicts TTPs labels by conditional probabilities. Still, the framework has two mechanisms to determine the validity of keywords. One using expert experience verification. The other verifies the distortion of the classification effect by blocking existing keywords. In the experiments, SeqMask reached 86.07% and 73.99% in F1 scores for TTPs classifications. For the top 20% of keywords, the expert approval rating is 92.20%, where the average repetition of keywords whose scores between 100% and 90% is 60.02%. Particularly, when the top 65% of the keywords were blocked, the F1 decreased to about 50%; when removing the top 50%, the F1 was under 31%. Further, we also validate the possibility of extracting TTPs from full-size CTI and malware whose F1 are improved by 2.16% and 0.81%.
Ge, Wenhan↗
On the Abuse and Detection of Polyglot Files
A polyglot is a file that is valid in two or more formats. Polyglot files pose a problem for file-upload and generative AI web interfaces that rely on format identification to determine how to securely handle incoming files. In this work we found that existing file-format and embedded-file detection tools, even those developed specifically for polyglot files, fail to reliably detect polyglot files used in the wild. To address this issue, we studied the use of polyglot files by malicious actors in the wild, finding 30 polyglot samples and 15 attack chains that leveraged polyglot files. Using knowledge from our survey of polyglot usage in the wild---the first of its kind---we created a novel data set based on adversary techniques. We then trained a machine learning detection solution, PolyConv, using this data set. PolyConv achieves a precision-recall area-under-curve score of 0.999 with an F1 score of 99.20% for polyglot detection and 99.47% for file-format identification, significantly outperforming all other tools tested. We developed a content disarmament and reconstruction tool, ImSan, that successfully sanitized 100% of the tested image-based polyglots, which were the most common type found via the survey. Our work provides concrete tools and suggestions to enable defenders to better defend themselves against polyglot files, as well as directions for future work to create more robust file specifications and methods of disarmament.
Oesch, T [ORNL] (ORCID:0000000269091022)↗
Implementation Aspects of Smart Grids Cyber-Security Cross-Layered Framework for Critical Infrastructure Operation
Communication networks in power systems are a major part of the smart grid paradigm. It enables and facilitates the automation of power grid operation as well as self-healing in contingencies. Such dependencies on communication networks, though, create a roam for cyber-threats. An adversary can launch an attack on the communication network, which in turn reflects on power grid operation. Attacks could be in the form of false data injection into system measurements, flooding the communication channels with unnecessary data, or intercepting messages. Using machine learning-based processing on data gathered from communication networks and the power grid is a promising solution for detecting cyber threats. In this paper, a co-simulation of cyber-security for cross-layer strategy is presented. The advantage of such a framework is the augmentation of valuable data that enhances the detection as well as identification of anomalies in the operation of the power grid. The framework is implemented on the IEEE 118-bus system. The system is constructed in Mininet to simulate a communication network and obtain data for analysis. A distributed three controller software-defined networking (SDN) framework is proposed that utilizes the Open Network Operating System (ONOS) cluster. According to the findings of our suggested architecture, it outperforms a single SDN controller framework by a factor of more than ten times the throughput. This provides for a higher flow of data throughout the network while decreasing congestion caused by a single controller’s processing restrictions. Furthermore, our CECD-AS approach outperforms state-of-the-art physics and machine learning-based techniques in terms of attack classification. The performance of the framework is investigated under various types of communication attacks.
cross-layered↗
Towards Software Bill of Materials in the Nuclear Industry
Large, modern industrial facilities often incorporate thousands of digital assets in their operational technology. Regulated facilities, such as nuclear power plants (NPPs), maintain robust cybersecurity and configuration management programs that often use bills of materials (BOMs) for these assets, including make, model, and version of hardware, firmware, and software. However, these BOMs typically capture only first- or second-tier information provided by the original equipment manufacturer (OEM). Unfortunately, as indicated by the increasing number and sophistication of software supply chain attacks, this level of detail is insufficient for identifying all the potential vulnerabilities and risks in software applications. Software BOMs (SBOMs) provide detailed enumeration of components and dependencies within the product or devices, including firmware. SBOMs can be combined with vulnerability data sources and vendor vulnerability attestations to improve vulnerability management and enable rapid identification of affected components when new software vulnerabilities are discovered. Ideally, SBOMs are created by the OEM prior to installation. However, since this practice is not yet commonplace and since NPPs are typically slow to adopt new technology, most NPPs do not incorporate SBOMs into their asset or configuration management programs. Fortunately, SBOMs can be generated by NPPs on existing digital assets to provide further insight into risk management decisions. This report provides an overview of the current SBOM ecosystem and recommends guidance on how to get started in a “crawl, walk, run” manner to develop and implement a sustainable SBOM program for digital assets in an NPP.
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
Equipment Assessment Guide: A Technical Inspection and Hardening Guide for Devices in Power Grid Operations
This Equipment Assessment Guide, developed by Idaho National Laboratory (INL), provides a comprehensive framework designed to enhance the security of operational technology (OT) devices within power grid operations. The guide outlines essential steps for asset owners to conduct technical inspections and harden vulnerable hardware and firmware components commonly found in embedded systems. It focuses on components frequently targeted by cyber threats, offering valuable identification techniques for locating and recognizing critical components on devices. Additionally, the guide presents recommended secure configurations aimed at minimizing exposure and reinforcing defenses, along with impact analysis that highlights the potential consequences for grid operations if components are compromised. By implementing the recommendations outlined in this guide, asset owners can significantly enhance their cybersecurity posture, reduce the attack surface of field-deployed devices, and improve the resilience of grid services against emerging cyber threats.
42 - ENGINEERING↗
Verification and Validation of Performance with Dissemination of Best Practices in District Energy and CHP for Enhanced Resiliency, Energy Efficiency, and Cybersecurity
This report contains the results of the International District Energy Association’s work to analyze, validate, and verify performance data of existing district energy systems and identify industy best practices for the purpose of improving system reliability, resiliency, and efficiency, and to accellerate decarbonization. In addition to a technical evaluation of the surveyed systems and identification of a series of technical performance metrics, the report illustrates the accompanying operations and financial best practices employed by surveyed systems to fully serve their customer base. Additionally, the third chapter of the report describes the current landscape of cybersecurity threats and counteracting measures, and recommends a series of steps for effectively guarding highly networked district energy systems against cybersecurity attacks.
96 KNOWLEDGE MANAGEMENT AND PRESERVATION↗
Combined Experimental and Computational Efforts to Establish Ion Mobility, Solubility and Stability of Functional Liquids for Electrochemical Energy Storage
This work provides a computation-driven investigation of the stability of organic electrolytes for lithium-air batteries. Electrolyte instability is currently a key challenge that limits practical use of aprotic Li-air batteries, and the chemical processes that cause this instability are often kinetically-driven. Computational screening for kinetic stability involves the determination of reaction barriers for the numerous potential reaction mechanisms, barriers that are challenging to calculate due to the difficulty of locating transition state structures. Here we screen a broad set of substituted electrolytes for susceptibility to nucleophilic attack by superoxide. We find that carbonates are not typically expected to be stable and that sulfones are generally stable, validating literature trends. We study the effects of chemical functionalization with electron-donating and withdrawing groups and their interplay with steric factors, identifying functional groups and other chemical modifications that increase stability in these groups. User-input driven transition state identification is used for these initial calculations, and an automated computational pipeline is subsequently presented and validated as a means to perform further high-throughput searches across mechanisms and chemistries. The pipeline integrates cheminformatics-based reaction encoding, relaxed potential energy scans, and nudged elastic band calculations for an end-to-end approach to barrier calculations. We review this automated search approach and its current limitations, and discuss challenges and further work.
25 ENERGY STORAGE↗
Electrical Fault Detection, Power Quality, Distributed Energy Resource Use Cases, and Cyber Event Applications with the Cyber Grid Guard System Using Distributed Ledger Technology
Electrical utilities continue to deploy more intelligent electronic devices (IEDs) inside and outside electrical substation and are associated with distributed energy resources (DERs). The integrity and confidentiality of data from IEDs is crucial, and distributed ledger technology (DLT) could improve the resilience of microgrids by helping to make these data more secure. The most popular applications using blockchain technology for electrical utilities is in the field is based on energy trading. However, the dynamism of the penetration of customer owned DERs and the deployment of sensors with IEDs have led to the identification of new applications using DLT that are focused on other areas, such as monitoring, operation and management of the grid and its assets. In addition, the majority of studies on electrical grid applications with blockchain were validated with software simulations. Although general monitoring of power systems for using DLT could be evaluated in operational electric grids, other DLT research applications such as defense against cyber-attacks and/or electrical fault detection are not likely to be performed in a real infrastructure because of possible risks to the network/equipment security. This report summarizes the application of power system applications using distributed ledger technology (DLT), providing a secure DLT framework for collecting data from IEDs like power meters and protective relays inside and outside of an electrical substation and/or between two different electrical utilities. In this study, the use case scenarios were created and assessed for different power system application by using DLT. The electrical fault detection for faulted phases (1), power quality monitoring of phase voltage magnitudes, frequency levels and load power factor (2), DERs use case monitoring (3), and cyber-event applications (4) were performed in a test bed with a Cyber-Grid Guard (CGG) system using DLT. It had a real-time simulator with power meters and protective relays in-the-loop. The first section of this report presents a literature review of power system applications using blockchain at research level. The second section shows the theory and equations used on this report. The third section shows the description of the test bed, equipment, architecture, and electrical grid diagrams. The fourth section shows the experimental models and use case scenarios that were performed for the electrical fault detection, power quality, DERs use case, and cyber event applications with the CGG system using DLT. The fifth section shows the results collected from the tests based on comparing the time stamped events of the analog signals from the IEDs, DLT computer and real time simulator. The sixth section performed the discussion of the results for the use case scenarios. Finally, section seven presents the conclusions for this report were presented.
24 POWER TRANSMISSION AND DISTRIBUTION↗
Strengthening Cybersecurity for Industrial Control Systems: Innovations in Protecting PLC-Based Infrastructure
In this paper, we propose two new approaches aimed at enhancing the security of industrial control systems (ICS) that utilize programmable logic controllers (PLCs) for the control of critical processes. The first approach involves the addition of a unique digital watermark to the PWM control that adjusts the motor speed to control the critical process. This enables efficient detection and identification of any unauthorized modifications to the sensor signals responsible for controlling the plant. The second approach focuses on monitoring the input current (i.e power) drawn by the PLC during the execution of critical process control tasks. Malicious intrusions to change the PLC parameters and/or unauthorized firmware updates can be rapidly detected. Both approaches demonstrate a substantial improvement in the security of ICS, effectively safeguarding against potential cyber-attacks. Experimental results from a laboratory scale water tank level controlled via PLC showcases rapid intrusion detection capabilities.
Huang, Peng-Hao↗
Systematic review of type 1 diabetes biomarkers reveals regulation in circulating proteins related to complement, lipid metabolism, and immune response
Type 1 diabetes (T1D) results from an autoimmune attack of the pancreatic β cells that progresses to dysglycemia and symptomatic hyperglycemia. Current biomarkers to track this evolution are limited, with development of islet autoantibodies marking the onset of autoimmunity and metabolic tests used to detect dysglycemia. Therefore, additional biomarkers are needed to better track disease initiation and progression. Multiple clinical studies have used proteomics to identify biomarker candidates. However, most of the studies were limited to the initial candidate identification, which needs to be further validated and have assays developed for clinical use. Here we curate these studies to help prioritize biomarker candidates for validation studies and to obtain a broader view of processes regulated during disease development. This systematic review was registered with Open Science Framework (https://doi.org/10.17605/OSF.IO/N8TSA). Using PRISMA guidelines, we conducted a systematic search of proteomics studies of T1D in the PubMed to identify putative protein biomarkers of the disease. Studies that performed mass spectrometry-based untargeted/targeted proteomic analysis of human serum/plasma of control, pre-seroconversion, post-seroconversion, and/or T1D-diagnosed subjects were included. For unbiased screening, 3 reviewers screened all the articles independently using the pre-determined criteria. A total of 13 studies met our inclusion criteria, resulting in the identification of 266 unique proteins, with 31 (11.6%) being identified across 3 or more studies. The circulating protein biomarkers were found to be enriched in complement, lipid metabolism, and immune response pathways, all of which are found to be dysregulated in different phases of T1D development. We found 2 subsets: 17 proteins (C3, C1R, C8G, C4B, IBP2, IBP3, ITIH1, ITIH2, BTD, APOE, TETN, C1S, C6A3, SAA4, ALS, SEPP1 and PI16) and 3 proteins (C3, CLUS and C4A) have consistent regulation in at least 2 independent studies at post-seroconversion and post-diagnosis compared to controls, respectively, making them strong candidates for clinical assay development. Biomarkers analyzed in this systematic review highlight alterations in specific biological processes in T1D, including complement, lipid metabolism, and immune response pathways, and may have potential for further use in the clinic as prognostic or diagnostic assays.
60 APPLIED LIFE SCIENCES↗
Driver Identification Dataset
The ORNL Driver Identification Dataset was created to collect and analyze driving behavior data from 50 different drivers. Each driver operated a 2014 Kenworth T270 Class 6 truck around Fort Collins, Colorado while various data sources recorded their driving behavior and vehicle performance. The dataset includes CANbus (Controller Area Network) data, GPS data, inertial measurement data, and biometric data from a heart rate monitor. A cyberattack was executed during each drive, which caused multiple dashboard warning lights to illuminate and set the tachometer and speedometer to zero, regardless of actual speed. The attack was stopped either after one minute or if the driver pulled over. By downloading the dataset, you agree to the following: 1) I will not use or disclose the data for any purpose other than Research as that term is defined in 10 CFR 745.102. 2) I will not, under any circumstances, request or accept private or linking identifiers for the data used. 3) I will not attempt to determine the identity of the individuals associated with the data. 4) I will use appropriate safeguards to prevent the use or disclose of the data for any purpose other than Research.
99 GENERAL AND MISCELLANEOUS↗
A Novel Authentication Management for the Data Security of Smart Grid
Bidirectional wireless communication is employed in various smart grid components such as smart meters and control and monitoring applications where security is vital. The Trusted Third Party (TTP) and wireless connectivity between the smart meter and the third party in the key management-based encryption techniques for the smart grid are expected to be totally trustworthy and dependable. In a wired/wireless medium, however, a man-in-the-middle may seek to disrupt, monitor and manipulate the network, or simply execute a replay attack, revealing its vulnerability. Recognizing this, this study presents a novel authentication management (model) comprised of two layer security schema. The first layer implements an efficient novel encryption method for secure data exchange between meters and control center with the help of two partially trusted simple servers (constitutes the TTP). In this setting, one server handles the data encryption between the meter and control center/central database, and the other server administers the random sequence of data transmission. The second layer monitors and verifies exchanged data packets among smart meters. It detects abnormal packets from suspicious sources. To implement this node-to-node authentication, One class support vector machine algorithm is proposed which takes advantages of the location information as well as the data transmission history (node identification, packet size, and data transmission frequency). This schema secures data communication, and imposes a comprehensive privacy throughout the system without considerably extending the complexity of the conventional key management scheme.
24 POWER TRANSMISSION AND DISTRIBUTION↗
Foundations of Molecular 'Isotomics'
The naturally occurring rare isotopes are versions of common elements, such as hydrogen, carbon and oxygen, that contain a larger than usual number of neutrons in their atomic nuclei and therefore are higher in mass than the common atoms of that element. Isotopes exist for most elements and are found in most natural and synthetic materials, but are uneven in their distribution because chemical and physical processes are isotope-selective (e.g., a chemical reaction may proceed more rapidly for one isotope than for another). For this reason, abundances of isotopes in a material of interest can provide a record, or ‘signature’ of various features of that material’s origin and history. These signatures have been used in the geo, life, chemical and physical sciences in a wide variety of ways over close to 8 decades. However, many such applications struggle to reach unique interpretations of isotopic data because multiple factors combine to control a given sample’s overall isotopic content. That is, the factors controlling isotopic content are too numerous and complex to fully constrain from a simple measurement of a material’s isotope abundances. However, the distribution of isotopes within materials, at molecular scales potentially provides a vastly larger number and diversity of constraints on the chemical and physical processes that comprise a material’s history. The rare isotopes may be concentrated into one atomic position in a molecule relative to another, some proportion of molecules in a sample may contain two or more rare isotopes, and those multiply-isotope-substituted forms of molecules may also have uneven distributions of those isotopes across individual atomic sites. For these reasons, even small, seemingly simple molecules, such as sugars, amino acids or drug compounds, actually exist in a vast number of isotopically unique forms (often millions or more), and each one of those forms is in some sense an independent ‘vote’ on that sample’s history. This project has focused on opening this rich archive of information by enabling the creation of routinely and widely applicable ways of measuring and interpreting isotopic structures of molecules. This work has included the development of core technologies and analytical methods, advancing fundamental understanding of the physical and chemical properties of isotopic versions of molecules, and conducting proof of concept studies of illustrative geochemical, cosmochemical and forensic problems in order to show how these technologies, methods and principles come together to solve problems in new ways. A key to the success of this project was the adaptation of ‘Fourier transform mass spectrometry’ (FTMS) to the task of precisely measuring proportions of the rare, naturally occurring isotopic forms of molecules. FTMS is a highly specialized form of mass spectrometry that traps ions within magnetic or electrostatic cavities and, effectively, ‘listens’ (through registering of subtle electrical signals) to the harmonic signals they make while rapidly orbiting within those cavities. These signals have periods that are a function of their mass and strength (or ‘loudness’) that is proportional to their abundances. Thus, these signals constrain relative amounts of molecules that differ in their mass due to various isotopic substitutions. This technology has been essential to the identification of organic molecules in the life, chemical and environmental sciences for over 4 decades, but generally has lacked the control, stability and precision to meaningfully measure rare isotope forms of molecules. This project’s most fundamental contribution has been to modify FTMS, both in terms of hardware and methods, to enable such measurements. The raw data of molecular isotopic structure is tremendously voluminous and complex, so another important activity of this project has been developing the theoretical and data-science tools needed to interpret the data generated by this new form of isotopic measurement. A particularly challenging part of this task has been predicting molecular isotopic structure, as only through the comparison of measurements with predictions can we make progress on hypothesis driven research questions. We have attacked this this prediction task through a combination of first-principles chemical-physics models of the effects of isotope substitution on molecule properties and data-science models that permit us to generalize that chemical physics to cases that have not yet been studied by detailed chemical physics theory. The proof of concept applications we have pursued over the course of this study include biological reactions of amino acids and other biomolecules, non-biological synthesis of organic molecules in extra-terrestrial settings such as meteorites, petroleum geoscience questions concerning the origin and evolution of natural gas, oil and kerogen compounds, and forensic questions such as the sourcing of chemical weapons. The successes of these applications have laid the groundwork for the next phase of this field’s development, which will include larger scale and more ambitious studies of molecular isotopic structure as a means of diagnosing human diseases, such as cancer, and reconstructing detailed interpretations of the origin and evolution of organic molecules in modern and geological environments.
Cesar, Jaime↗
Locating fast-varying line disturbances with the frequency mismatch
In an attempt to provide an efficient method for line disturbance identification in complex networks of diffusively coupled agents, we recently proposed to leverage the frequency mismatch. The frequency mismatch filters out the intricate combination of interactions induced by the network structure and quantifies to what extent the trajectory of each agent is affected by the disturbance. In this previous work, we provided some analytical evidence of its efficiency when the perturbation is assumed to be slow. Here we claim that the frequency mismatch performs actually well for most disturbance regimes. This is shown through a series of simulations and is backed up by an analytical argument. Therefore, we argue that the frequency mismatch is an efficient and elegant tool for line disturbance location in complex networks of diffusively coupled agents.
97 MATHEMATICS AND COMPUTING↗
Gridtrust: Electricity Grid Root-of-Trust Decentralized Supply Chain Cyber-Security (Final Scientific/Technical Report)
GridTrust represents a departure from reliance on a single organization or a single person to multiple organizations and therefore multiple people across organizational structures. The motivating idea behind involving multiple organizations is the increase in security due to human factors. More specifically, the requirement that distinct people in different organizations sign off on a change or an update makes a cyberattack much less likely due to the inherent requirement that both organizations be penetrated and fooled. GridTrust focuses on the software update process as the primary exemplar for the research and development work. A novel hardware-based technology referred to as a Physical Unclonable Function (PUF) provides a microchip Root-of-Trust (RoT), i.e., a starting point for verifying that the hardware being communicated with is the hardware the control center believes the hardware to be. As a result, staff at power grid control centers can ensure the accurate and reliable identification of hardware devices from the outset. The GridTrust protocol introduces two key innovations, as detailed in this report. Firstly, the utilization of a PUF as a root-of-trust in the initial phase of a software or firmware update. Secondly, the application of multiple cryptographic signatures from two or more organizations to the update binary. These signatures are verified before implementing the update on a power grid device in the field. In terms of GridTrust hardware design, this report outlines two main components. The first is the GridTrust Native Device, integrating PUF technology intrinsically into the hardware device itself. The second is the GridTrust Interfacing Device, which incorporates PUF technology and multiple cryptographic signatures. These signatures are cross-checked within a separate hardware positioned between the power grid control center and the legacy power grid device, functioning as an intermediary. While the GridTrust Interfacing Device offers the advantage of being applicable to existing power grid equipment, it may have reduced security if the intermediary component is targeted. On the other hand, the GridTrust Native Device boasts increased security due to protocol integration within a unified form factor. The effectiveness of GridTrust technology has been extensively demonstrated, with multiple external red-team attackers unable to breach GridTrust's security measures. This was observed both in controlled laboratory settings during Phase 1 of the project and in real-world conditions within a City of Marietta substation during Phase 2 of the project.
24 POWER TRANSMISSION AND DISTRIBUTION↗
Quantum Key Distribution for Critical Infrastructures: Towards Cyber-Physical Security for Hydropower and Dams
Hydropower facilities are often remotely monitored or controlled from a centralized remote control room. Additionally, major component manufacturers monitor the performance of installed components, increasingly via public communication infrastructures. While these communications enable efficiencies and increased reliability, they also expand the cyber-attack surface. Communications may use the internet to remote control a facility’s control systems, or it may involve sending control commands over a network from a control room to a machine. The content could be encrypted and decrypted using a public key to protect the communicated information. These cryptographic encoding and decoding schemes become vulnerable as more advances are made in computer technologies, such as quantum computing. In contrast, quantum key distribution (QKD) and other quantum cryptographic protocols are not based upon a computational problem, and offer an alternative to symmetric cryptography in some scenarios. Although the underlying mechanism of quantum cryptogrpahic protocols such as QKD ensure that any attempt by an adversary to observe the quantum part of the protocol will result in a detectable signature as an increased error rate, potentially even preventing key generation, it serves as a warning for further investigation. In QKD, when the error rate is low enough and enough photons have been detected, a shared private key can be generated known only to the sender and receiver. We describe how this novel technology and its several modalities could benefit the critical infrastructures of dams or hydropower facilities. The presented discussions may be viewed as a precursor to a quantum cybersecurity roadmap for the identification of relevant threats and mitigation.
97 MATHEMATICS AND COMPUTING↗
Detecting Unclassified Electromagnetic Signals for Secure Wireless Communication Using Open Set Recognition
We developed multiple machine learning methods for the detection and classification of new wireless communication waveforms, which is critical for targeted attacks in wireless networks and electronic warfare. Our machine learning models are capable of dynamically detecting security threats in near real time through our advanced open set recognition (OSR) approach. This model has demonstrated significant improvements in the detection of unknown waveforms, thereby enhancing the security and reliability of mission critical communications. Our approach to detecting uncertain security threats is novel; we advanced OSR techniques by incorporating domain knowledge of wireless signals. Specifically, we combined time and frequency domain model features to enhance the model’s performance. Utilizing an OSR approach eliminates the need for training data to be distributed similarly to the deployment environment and removes the requirement for the training set to contains all possible threat classes. This is crucial because it is often infeasible to determine and characterize all potential security threats in advance. Our model were trained on simulated data, generated in partnership with the University at Albany, State of New York. The data set contained a diverse array of wireless signals, including those with additive white Gaussian noise and multipath signals, with and without line of sight. This comprehensive training set allowed us to optimize our models to detect unknown waveforms under various challenging scenarios, such as low signal-to-noise ratios. By training on various waveforms, varying signal-to-noise ratio, and different sample sizes under normal conditions, our models were fine tuned to perform effectively in challenging environments.
99 - GENERAL AND MISCELLANEOUS↗