Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “threat analysis”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2
All sourcesNASA NTRSDOE OSTI
DOE OSTI2025

Accelerating nuclear-integrated data center pursuits in the USA: SWOT analysis, power-thermal management strategies and demonstration plan

Here, this study explores the increasing interest in leveraging nuclear power to meet the escalating energy demands of data centers in the United States (U.S.) by focusing on key factors that contribute to accelerated deployment. The study highlights the importance of N+1/N+2 power supplies (where N is the required number of units), outlines research and innovations in nuclear-integrated data center thermal management and demonstration plan. It also provides updates about status and costing of various reactor system designs. A summarized strengths, weaknesses, opportunities, and threats (SWOT) analysis shows the potential options for grid connectivity, reactors, and site selection. Suitable site discussions consider land and water availability, grid access, and optical fiber connectivity, and the study presents graded prospects for Department of Energy (DOE) sites with a specific example. Community engagement and partnerships are emphasized, particularly the roles of local government, federal agencies, utilities, and data center industry partners, which are crucial for accelerating deployment, business outreach, and approvals. The study provides actionable insights for stakeholders to accelerate the deployment of nuclear-powered data centers.

21 - SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLAN↗
DOE OSTI2022

cisagov/STOAT

Scoring Threat Objects Analysis Tool

Galloway, GreerN.↗
DOE OSTI2025

Utility-Scale Operational Consequences for Solar Grid Services

This report delves into the critical aspects of grid services provided by solar inverter-based resources (IBRs), with an emphasis on the evolving landscape of microgrids, virtual power plants (VPPs), aggregators, and distributed energy resource management systems (DERMS). As the energy sector undergoes a transformative shift towards more decentralized and resilient grid architectures, understanding the multifaceted risks associated with these technologies becomes paramount. The report categorizes these risks into organizational, technical, and procedural domains, providing a thorough risk assessment framework that stakeholders can utilize to anticipate and mitigate potential issues. In addressing the increasing complexity of grid interconnections, the report highlights the importance of Cyber-Informed Engineering (CIE). By embedding engineering controls and cybersecurity measures into the early stages of system design, this approach aims to fortify grid infrastructure against emerging cyber threats. The analysis includes an exploration of best practices and strategies for integrating CIE principles to enhance grid security and resilience. To provide practical insights, the report conducts a detailed consequence analysis of various grid services and cyber mitigations that can be applied through the interconnection process. This analysis evaluates the potential impacts of different failure modes and vulnerabilities, offering a clear understanding of the consequences that could arise from disruptions within the energy grid. The findings are further enriched by a series of case studies that illustrate real-world scenarios and lessons learned from past incidents. Through this comprehensive examination of grid services and their criticality, the report aims to prepare industry professionals with the knowledge and tools necessary to navigate the complexities of modern energy systems. By providing a comprehensive approach that includes risk assessment, cybersecurity, and consequence analysis, solar stakeholders can more effectively guarantee the reliability, efficiency, and security of the energy grid.

14 SOLAR ENERGY↗
DOE OSTI2020

Data Requirements for Application of Risk-Based Dynamic Contingency Analysis to Evaluate Hurricane Impact to Electrical Infrastructure in Puerto Rico

This paper presents a risk-based dynamic contingency analysis framework that was used to evaluate the hurricane impact to electrical infrastructure in Puerto Rico. PNNL developed a scalable risk-based framework for identifying high-voltage transmission resilience improvements by classifying and prioritizing high-risk power grid contingencies (system failures) under hurricane impact. The risk-based framework is founded on grid outage definitions with their associated probabilities of occurrence from hurricane events, in combination with an impact assessment derived from detailed dynamic cascading failure analysis. This paper focuses on a discussion around data requirements for transmission resilience planning for hurricane events, derived from the development of the risk-based framework and its application to Puerto Rico. This paper launches an important first step in encouraging the engineering community and power system industry to move towards establishing resilience planning as a routine practice. Since actual results for Puerto Rico contain sensitive information, sample simulation results will be used to illustrate the data requirements and risk-based dynamic cascading framework on the Puerto Rico power grid, as well as demonstrate the potential for such a simulation framework. The paper includes a discussion on the lessons learned, importance and need for improved datasets that are not usually considered in traditional power system planning. The paper will also elaborate on how the scalable simulation framework and datasets might be expanded to larger footprints and leveraged for modelling other types of natural disasters.

DCAT, Puerto Rico, hurricane, Power System Stabili↗
DOE OSTI2024

Attack Surface of Renewable Energy Technologies

This slide deck presents an overview of the threat landscape for renewable energy technologies. It highlights he growing penetration of renewable resources and potential impact of an attack. Standard architectures are shared to highlight where vulnerabilities may exist and attack paths to reach critical infrastructure. We discuss threat actors and attack paths. Several recent events impacting renewable energy assets or companies are explained.

14 SOLAR ENERGY↗
DOE OSTI2026

Supporting U.S. National Security Through Cybersecurity Partnerships

At NLR, we're studying energy evolutions and threats to understand the challenges they pose and uncover ways to leverage grid advancements to achieve more secure, defensible, and reliable systems. Our integrated research approach bridges the gap between cyber threats and real-world consequences to deliver actionable solutions that reduce vulnerabilities and help strengthen U.S. national security.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2023

Comparison of Socio-Technical Threat Models

Given the adoption of emerging technologies and the increasing complexity of managing such systems with a lifecycle much shorter than that of critical infrastructure systems, there is a practical need to be able to analyze sociotechnical dependencies and their associated evolving risks. Threat models based on social influence techniques can be used to implement adversarial tactics analogous to the cyber kill chain and attested to within the MITRE ATT&CK for ICS framework including Initial Access, Persistence, Collection, and Impact. Furthermore, as with cyber disruptions, the impact of social influence threat models can have an asymmetric impact that is not spatially-localized. Finally, unlike cyber attacks with a reasonably short duration (ransomware takes days to months), social influence based attacks have the potential to persist for much longer as they are based on long-term strategic infrastructure investments within the private sector. Given the increased importance of electric vehicle charging stations as a long-term, strategic infrastructure investment within the Energy and Transportation Sectors, we provide initial results that compare the impact of a Loss of Availability (T0826) realized through cyber and social influence based threat models. The analysis employs techniques from automated reasoning and measures of network complexity to understand evolving dominance of EV payment and charging networks within geographic region of interest. Within this context, we compare the impact of a loss of availability due to ransomware versus that of loss of support due to a merger and acquisition. Results across several different metro areas will be provided.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2021

Development of data‐driven exponential integrators with application to modeling of delay photocurrents

Abstract Radiation‐induced photocurrent effects represent a threat to microelectronic components operating in space, manmade and terrestrial radiation environments. Analysis of these threats by circuit simulations requires accurate and computationally efficient compact models. Most existing compact models are based on closed form analytic solutions of the governing equations and require empirical assumptions and idealizations that can limit their validity. In this paper we formulate an alternative numerical, data‐driven approach that learns a compact model from data representative of the type of measurements one can obtain in an experimental facility. To develop the model we start from a generic discrete‐time dynamical system and then use physics knowledge to refine its structure. Numerical studies demonstrate the potential of the model and establish some empirical guidelines for its training.

Bochev, Pavel↗
DOE OSTI2022

Evaluation of Joint Cyber/Safety Risk in Nuclear Power Systems

This report presents an analysis of the Emergency Core Cooling System (ECCS) for a generic Boiling Water Reactor (BWR)-4 NPP. The Electric Power Research Institute (EPRI) developed Hazards and Consequences Analysis for Digital Systems (HAZCADS) process is applied to the ECCS and its subsystems to identify unsafe control actions (UCAs) which act as possible cyber events of concern. The analysis is performed for two design basis events: Small-break Loss of Coolant Accident (SLOCA) and general transients (TRANS), such as unintended reactor trip. In previous work, HAZCADS UCAs were combined with other cyber-attack analysis to develop a risk-informed approach; however, this was for a single system. This report explores advanced systems engineering modeling approaches to model the interactions between digital assets across multiple systems which may be targeted by cyber adversaries. The complex and interdependent design of digital systems has the potential to introduce emergent cyber properties that are generally not covered by hazard analyses nor formal nuclear Probabilistic Risk Assessment (PRA). The R&D and supporting analysis presented here explores approaches to predict and manage how interdependent system properties effect risk. To show the potential impact of a successful cyber-attack to formal PRA event tree probabilities, HAZCADS analysis was also used. HAZCADS was also used to model the automatic depressurization system (ADS) automatic actuation. This analysis extended to an integrated system analysis for common-cause failure (CCF). In this aspect, the HAZCADS analysis continued by analyzing plant design details for system connectivity in support of critical plant functions. A dependency matrix was developed to depict the integrated functionality of the interconnected systems. Areas of potential CCF are indicated. Future work could include adversary attack development to show how CCF could be caused, resulting in PRA events. Across the multiple systems that comprise the ECCS, the analysis shows that the change in such probabilities was very different between systems. This indicates that some systems have a larger potential risk impact from successful cyber-attack or digital failure, which indicates a need for these systems to have a higher priority for design and defensive measures. Furthermore, we were able to establish that a risk analysis using any arbitrary threat model establishes an ordering of components with regard to cyber-risk. This ordering can be used to influence the overall system design with an eye to lowering risk, or as a way to understand real-time risk to operational systems based on a current threat landscape. Expert knowledge of both the analysis process and the system being analyzed is required to perform a HAZCADS analysis. The need for a tiered risk analysis is demonstrated by the results of this report.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
DOE OSTI2020

Threat Reduction Research Networks: Fostering Sustainable Collaborations Through Trainings for Genomics for Biosurveillance

Scientific research communities can be represented as heterogeneous or multidimensional networks encompassing multiple types of entities and relationships. These networks might include researchers, institutions, meetings, and publications, connected by relationships like authorship, employment, and attendance. We describe a method for efficiently and flexibly capturing, storing, and extracting information from multidimensional scientific networks using a graph database. The database structure is based on an ontology that captures allowable types of entities and relationships. This allows us to construct a variety of projections of the underlying multidimensional graph through database queries to answer specific research questions. We demonstrate this process through a study of the U.S. Biological Threat Reduction Program (BTRP), which seeks to develop Threat Reduction Networks to build and strengthen a sustainable international community of biosecurity, biosafety, and biosurveillance experts to address shared biological threat reduction challenges. Networks like these create connectional intelligence among researchers and institutions around the world, and are central to the concept of cooperative threat reduction. Our analysis focuses on a series of seven BTRP genome sequencing training workshops, showing how they created a growing network of participants and countries over time, which is also reflected in coauthorship relationships among attendees. By capturing concept and relationship hierarchies, our ontology-based approach allows us to pose general or specific questions about networks within the same framework. This approach can be applied to other research communities or multidimensional social networks to capture, analyze, and visualize different types of interactions and how they change over time.

59 BASIC BIOLOGICAL SCIENCES↗
DOE OSTI2020

A Systematic Evidence Based Performance Approach to Regulation of Nuclear Sites in England and Wales - 20058

The Environment Agency for England has developed a systematic evidence-based approach to pursue our strategic environmental objectives for the regulation of nuclear sites. We use an annual evidence review process to ensure effective and efficient targeting of limited resources to achieve those objectives. Over the last 8 years, we have been developing and refining this approach to ensure risk-based and value driven regulation. The approach comprises nuclear site and nuclear sector review processes known as Site Environment Review (SER) and Nuclear Environment Review (NER). This approach complements our regulation of nuclear site permit holders under the Environmental Permitting Regulations (EPR). We deliver our regulation of nuclear sites in England and Wales alongside the Office for Nuclear Regulation. The SER process involves the lead regulator for each nuclear site assessing the permit holder's environmental performance across 14 themes, set within the context of the site's main activities and associated waste disposals. Our themes include environmental leadership, resources and climate change, radioactive waste management, facility management and decommissioning, groundwater, and environmental radiological protection. We use evidence from site inspections and working within our subject matter groups to grade current and predicted future environmental performance. We are particularly interested in sustainability and the application of Best Available Techniques (BAT) to prevent the creation, and minimise the disposal, of radioactive wastes. We use risk analysis (strengths, weaknesses, threats and opportunities) to examine performance against our strategic environmental objectives, which are set out, in our 5-year Nuclear Delivery Plan (NDP). The output supports the targeting of our resources at each nuclear site. We consult the relevant permit holders on the SER priorities and use their feedback to refine our plans. We expect all permit holders to take account of our priorities when considering their own programmes of work, objectives and plans. The NER process brings together what we learn and achieve through regulation across the sector. It provides input to planning priorities, supported by qualitative and semi-quantitative evidence. It covers the 28 nuclear sites in England and Wales and spans the same 14 environmental themes. During the process we collate, compile and summarise evidence from the SERs and other sources such as inspection reports and evidence from our other nuclear work programmes. The output is the NER annual report. This provides a snapshot of the status of the nuclear sector and gives insights to enable us to regulate more efficiently and effectively. It also takes account of cross-cutting issues and risks such as changes in international standards, domestic policy, regulatory framework, domestic standards and guidance, learning from experience such as incidents, events and good practice, and innovation, research and development. It provides graphics that illustrate the grading of environmental performance for the nuclear sector across the fourteen environmental themes. This analysis allows benchmarking of nuclear site's environmental performance and the visualisation provides a convenient comparison of performance across themes, sites, and over time. We use this intelligence to inform our investment in training and development of our staff, and our cross-cutting engagement on strategic issues with government, the Nuclear Decommissioning Authority (NDA) and other corporate organisations. Adopting this approach can provide benefits with organisational reputation, stakeholder participation and ensuring value from the public investment. This paper describes the history of the SER/NER process, a selection of outputs from the process and ideas for improvement. The paper will be of interest to other regulators and organisations across the world that are interested in supporting continuous improvement. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗
DOE OSTI2022

Automated Threat Information Generation

Manual malware analysis is time consuming and is not scalable. This poster describes tools that INL has developed that automate and codify threat information.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2020

Vulnerabilities in Artificial Intelligence and Machine Learning Applications and Data

Artificial intelligence (AI) applications driven by machine learning (ML) are transformational technologies within the international nuclear security regime. Advancements realized by AI—faster and improved data insights, more efficient and automated processes, reductions in human error—enable nuclear security applications such as behavior analysis for insider threat mitigation, source tracking of stolen nuclear material, and facial recognition software for physical protection. In addition to the advantages, however, there are also inherent vulnerabilities and threats associated with its use and risk mitigations must be built into any AI/ML-enabled systems. This work provides a background on AI and ML and different data types used in the field, including open-source intelligence information (OSINT) that is discoverable by AI tools and application data that are used by AI tools for decision-making and automation. Current and potential AI applications and vulnerabilities related to their use within the nuclear security regime are also discussed.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

idaholab/cape2stix

This software allows for the conversion, extraction, and transformation of malware behavior data from "Malware Configuration And Payload Extraction" (CAPEv2) sandbox reports, to Structured Threat Information eXpression (STIX). This allows for further analysis to be performed, sharing of threat data, and transit to a graph database.

Cutshaw, Michael [Idaho National Laboratory (INL),↗
DOE OSTI2026

Cyote-attack Chain Estimator

Attack Chain Estimator (ACE) Application Overview The Attack Chain Estimator (ACE) Application is a sophisticated tool designed for the ingestion, classification, sequencing, and enrichment of cybersecurity threat reports. This application leverages advanced machine learning models and extensive historical data to provide comprehensive insights into cyber threats, specifically targeting Industrial Control Systems (ICS). Purpose The primary functions of the ACE Application include: Ingestion of Cybersecurity Threat Reporting: Capable of ingesting text-based threat reports in markdown or text file format. Supports ingestion of structured data from other sources in STIX/JSON format. Classification of Report’s Text-Based Events: Utilizes a DeBERTa classifier, specifically trained on cybersecurity data, to map the events to MITRE ATT&CK for ICS Tactics and Techniques. Classification is performed using multiple Jupyter notebooks and machine learning workflows hosted as FastAPI microservices: regex_data deberta_base_35_train_hft_classifier_mlflow.ipynb hft_regex_classifier_mlflow.ipynb param_train_hft_classifier_mlflow.ipynb regex_tactic_tech.ipynb Ordering of Tactics, Techniques, and Observable Events: Sequences the identified tactics, techniques, and events to form a coherent attack chain. Enrichment with Historical Attack Chain Details: Enhances the attack chain with details from historical attacks using a Markov model developed from CyOTE Precursor Analysis Report data. The Markov model is available as a FastAPI endpoint for seamless integration. Enrichment with Adversary Emulation Capabilities Data: Integrates adversary emulation capabilities data using MITRE Caldera for OT adversary abilities UUIDs. Export of Output Files: Provides options to export the enriched attack chain in JSON or CSV formats. Routing of Output to Other Applications: Facilitates routing of output to various platforms and applications, including: Threat Intelligence Platforms COREII Scout for Threat Intelligence Analysis COREII Modeling and Simulation for Adversary Emulation Technical Description The ACE Application is an advanced cybersecurity tool designed to provide detailed threat analysis and sequence generation. It is built on a robust architecture that integrates natural language processing, machine learning, and historical data modeling. Key Components: Data Ingestion Module: Handles the input of threat reports and data from various formats, ensuring flexibility in data sources. Classification Engine: Employs DeBERTa-based classifiers hosted as FastAPI microservices to analyze and classify threat report events in accordance with the MITRE ATT&CK framework for ICS. Sequence Generator: Orders the classified events into a logical attack chain, providing clear insight into the sequence of tactics and techniques used in the threat. Enrichment Engine: Integrates historical data and adversary emulation capabilities to enhance the attack chain with valuable context and additional details. The historical data enrichment is powered by a Markov model, which is available as a FastAPI endpoint. Export and Routing Module: Facilitates the export of the enriched attack chain in multiple formats and routes the output to designated applications for further analysis or emulation.

Paul, Tony [Idaho National Laboratory (INL), Idaho↗
DOE OSTI2025

Wildfire and power grid nexus in a changing climate

Global wildfire events have had increasingly severe impacts in recent years, particularly in the western USA, driven by extreme fire-weather conditions, fuel accumulation and multiple ignition sources. Wildfires sparked by power lines tend to be larger and more destructive, as they often occur during high winds, which accelerate the spread of fires. Moreover, efforts to contain wildfires frequently result in power outages, causing considerable economic disruption. Here, in this Review, we examine wildfire risks related to power-line-induced ignitions, infrastructure damage, climate-induced environmental impacts, grid operational risks, real-time grid management risks, vegetation management risks, and financial and funding risks in the context of a changing climate and their interdependence with power grid infrastructures. We then explore the resilience of power grids under wildfire threats, looking at risk analysis, prediction and mitigation strategies. The Review also shares practical insights and experiences in the USA to inform researchers, policymakers and industry professionals.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

HME MicroCT Data Acquisition, Processing and Data Request Overview

This document is a short summary of the steps required for MicroCT evaluation of a specimen. This includes data acquisition through image analysis, for the Explosives Threat Assessment (ETA) program. Expected outputs for each stage are outlined. Information and data shall be shipped to LLNL as described herein.

42 ENGINEERING↗
DOE OSTI2026

Vulcan-Forge: Architecture and Design of a Multi-Modal Forensic Analysis Plugin for CALDERA

Forge and VULCAN together describe an open-architecture cybersecurity analysis ecosystem that unifies forensic artifact processing, detection engineering, and vulnerability intelligence within integrated platforms. Forge operates as a plugin for MITRE CALDERA, ingesting diverse evidence formats—including EVTX, PCAP/PCAPNG, CSV, JSON, YAML, XML, binaries, and archives—to construct a unified artifact graph enriched with severity scoring, TLP classification, and audit trails. It provides subsystems for artifact parsing, streaming structured-data visualization, NetworkMiner-based packet inspection, PE/.NET binary analysis, and LLM-assisted triage and rule generation, with outputs validated against CCCS-YARA and pySigma schemas. VULCAN complements this by serving as a cybersecurity analyst platform that integrates a Neo4j knowledge graph, Qdrant vector retrieval, SSVC-based triage, and a local LLM to deliver CVE intelligence and forensic analysis through a multi-source ingest pipeline drawing from NVD, CISA KEV, EPSS, MITRE ATT&CK, and CAPEC. Together, they bridge structured threat intelligence with automated forensic analysis and detection workflows.

97 MATHEMATICS AND COMPUTING↗