Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Attack detection”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 361 records · Page 20
All sourcesNASA NTRSDOE OSTI
DOE OSTI2023

Flexible visualization of a 3rd party Intrusion Prevention (Security) tool: A use case with the ELK stack

A difficult aspect of cyber security is the ability to achieve automated real time intrusion prevention across various sets of systems. To this extent, several companies are offering comprehensive solutions that leverage an "accuracy of scale" and moving much of the intelligence and detection on the Cloud, relying on an ever-growing set of data and analytics to increase decision accuracy. Often, they provide tools to visualize the decision workflows in attack prevention (as well as tune the algorithm) but those solutions are not always practical as companies see the problem as "global" that is, from a unified Cyber-security standpoint. However, a key to a successful Cyber-security program is transparency and trust: from an experimental team viewpoint, this specifically means having the ability to immediately see what and from where, who has been blocked and being able to inform the community in case of a revoked access without the need for filing a "ticket" (that may eventually be answered) – in other words, rapid response to their user-base is essential but solutions targeting "sub-groups" in an organization are not often available. We have come up with a versatile solution leveraging the ELK stack (Elasticsearch, Logstash, & Kibana) and an IPS (Intrusion Prevention System) based WAF (Web Application Firewall) from Signal Sciences. Signal Science allows the streaming of detailed logs in a Logstash format suitable for custom solutions for visualization. By combining these two tools, we have strengthened our security posture and enabled individual experiments to monitor their own traffic. Specifically, the IPS WAF provides unique data such as country of origin, protocol, response code, source IP, and paths accessed. In this contribution, we will show how we engineered a visualization solution so experiment groups could access a dashboard with predefined graphs but also, where they can create individual customizable dashboards used to display blocked traffic and troubleshoot latency issues. We will discuss the details and procedures for developing and configuring these tools and how it benefits cyber security postures across our scientific based environment.

73 NUCLEAR PHYSICS AND RADIATION PHYSICS↗
DOE OSTI2021

Self-Security for Grid-Interactive Smart Inverters Using Steady-State Reference Model

Smart inverters exchange information with other devices through a shared communication link, making the inverters more prone to receive harmful commands from external parties. This erroneous data can be received due to an anomaly in the system, such as a device fault, unintentional utility operator action, or a cyber-attack. In this paper, a device-level self-security strategy is implemented using reference models for a grid-interactive inverter to examine the incoming power setpoints, detect the anomalies, and protect the system accordingly. The PQ setpoints received from the utility supervisory controller are autonomously examined using the inverter’s normal and stable operating regions before engaging the setpoints to the inverter’s local controller. Grid parameters are estimated in real-time during the examination process. The efficacy of the self-security algorithm is tested using a three-phase 3-kVA SiC-MOSFET inverter and a 12-kW NHR 9410 regenerative grid emulator. The results verify that the proposed method can detect harmful PQ setpoints that can cause abnormal or unstable inverter operation.

Gursoy, Mehmetcan↗
DOE OSTI2024

Communication Network Layer State Estimation Measurement Model for a Cyber-Secure Smart Grid

Network communication has been proven to be a very important tool and a key factor in the recent development and progress of the power grid operation. It is also considered as the foundation for the smart grid because information and communication are integrated into electricity distribution to achieve reliable and accurate knowledge of the power grid. In previous years, absorbing energy from substations and delivering it to customers was the only type of interaction we knew between utility companies and customers. Presently, the growing connections of small distributed generation units caused by the cost reduction of most of the technologies used in generation and storage of electrical energy, along with the potential benefits of renewable energy have pushed many researchers to look into the improvement of information and communication technologies (ICT) in order to ensure a bidirectional flow of power and data. Moreover, the evolution of information and communication technologies and its applications to smart grid have converted the smart grid into a cyber-physical system where vulnerabilities and additional security challenges such as cyber-threats and cyber-attacks have emerged. Previously, we have demonstrated that using machine learning-based processing on data gathered from communication networks and the power grid was a promising solution for detecting cyber threats by implementing a co-simulation of cyber-security for cross-layer strategy. Since the majority of the challenges observed can only be solved in the network communication layer, we present in this work a physics-based state estimation model of the communication network system towards enhanced cyber-physical security of the smart grid. Information integration with the previously developed machine learning model is developed, providing a enhanced cyber-physical security application for the smart grid. Easy-to-implement model, without hard-to-derive parameters, highlight potential aspects of the model for real-life applications.

Mathieu, Reynold↗
DOE OSTI2023

Inferring adversarial behaviour in cyber‐physical power systems using a Bayesian attack graph approach

Abstract Highly connected smart power systems are subject to increasing vulnerabilities and adversarial threats. Defenders need to proactively identify and defend new high‐risk access paths of cyber intruders that target grid resilience. However, cyber‐physical risk analysis and defense in power systems often requires making assumptions on adversary behaviour, and these assumptions can be wrong. Thus, this work examines the problem of inferring adversary behaviour in power systems to improve risk‐based defense and detection. To achieve this, a Bayesian approach for inference of the Cyber‐Adversarial Power System (Bayes‐CAPS) is proposed that uses Bayesian networks (BNs) to define and solve the inference problem of adversarial movement in the grid infrastructure towards targets of physical impact. Specifically, BNs are used to compute conditional probabilities to queries, such as the probability of observing an event given a set of alerts. Bayes‐CAPS builds initial Bayesian attack graphs for realistic power system cyber‐physical models. These models are adaptable using collected data from the system under study. Then, Bayes‐CAPS computes the posterior probabilities of the occurrence of a security breach event in power systems. Experiments are conducted that evaluate algorithms based on time complexity, accuracy and impact of evidence for different scales and densities of network. The performance is evaluated and compared for five realistic cyber‐physical power system models of increasing size and complexities ranging from 8 to 300 substations based on computation and accuracy impacts.

Sahu, Abhijeet↗
DOE OSTI2021

IoT Intrusion Detection Taxonomy, Reference Architecture, and Analyses

This paper surveys the deep learning (DL) approaches for intrusion-detection systems (IDSs) in Internet of Things (IoT) and the associated datasets toward identifying gaps, weaknesses, and a neutral reference architecture. A comparative study of IDSs is provided, with a review of anomaly-based IDSs on DL approaches, which include supervised, unsupervised, and hybrid methods. All techniques in these three categories have essentially been used in IoT environments. To date, only a few have been used in the anomaly-based IDS for IoT. For each of these anomaly-based IDSs, the implementation of the four categories of feature(s) extraction, classification, prediction, and regression were evaluated. We studied important performance metrics and benchmark detection rates, including the requisite efficiency of the various methods. Four machine learning algorithms were evaluated for classification purposes: Logistic Regression (LR), Support Vector Machine (SVM), Decision Tree (DT), and an Artificial Neural Network (ANN). Therefore, we compared each via the Receiver Operating Characteristic (ROC) curve. The study model exhibits promising outcomes for all classes of attacks. The scope of our analysis examines attacks targeting the IoT ecosystem using empirically based, simulation-generated datasets (namely the Bot-IoT and the IoTID20 datasets).

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2022

Implementation Aspects of Smart Grids Cyber-Security Cross-Layered Framework for Critical Infrastructure Operation

Communication networks in power systems are a major part of the smart grid paradigm. It enables and facilitates the automation of power grid operation as well as self-healing in contingencies. Such dependencies on communication networks, though, create a roam for cyber-threats. An adversary can launch an attack on the communication network, which in turn reflects on power grid operation. Attacks could be in the form of false data injection into system measurements, flooding the communication channels with unnecessary data, or intercepting messages. Using machine learning-based processing on data gathered from communication networks and the power grid is a promising solution for detecting cyber threats. In this paper, a co-simulation of cyber-security for cross-layer strategy is presented. The advantage of such a framework is the augmentation of valuable data that enhances the detection as well as identification of anomalies in the operation of the power grid. The framework is implemented on the IEEE 118-bus system. The system is constructed in Mininet to simulate a communication network and obtain data for analysis. A distributed three controller software-defined networking (SDN) framework is proposed that utilizes the Open Network Operating System (ONOS) cluster. According to the findings of our suggested architecture, it outperforms a single SDN controller framework by a factor of more than ten times the throughput. This provides for a higher flow of data throughout the network while decreasing congestion caused by a single controller’s processing restrictions. Furthermore, our CECD-AS approach outperforms state-of-the-art physics and machine learning-based techniques in terms of attack classification. The performance of the framework is investigated under various types of communication attacks.

cross-layered↗
DOE OSTI2021

CPS Testbed Architectures for WAMPAC using Industrial Substation and Control Center Platforms and Attack-Defense Evaluation

Advanced persistent threats and cyberattacks can impact wide-area monitoring, protection, and control (WAMPAC) system operation. Many cyber-physical system (CPS) testbeds have been developed for attack-defense experimentation and attack-resiliency tools evaluation for WAMPAC, but they are limited to a simulation-and-emulation based environment. This paper presents a quasi-realistic CPS attack-defense testbed-based framework for WAMPAC applications using the industrial substation and control center platforms such as eTerra integrated with the hardware-in-the-loop CPS smart grid testbed available at Iowa State University. The proposed framework includes various combinations of industry-grade substation and control center platforms, communication topologies, real-time digital simulators, and a novel cyber-physical distributed intrusion-and-anomaly detection system (D-IADS) for WAMPAC applications. The D-IADS includes a master at the control center and geographically distributed sensor devices at each substation. Each D-IADS sensor deployed at a substation or control center network monitors ingress and egress traffic, detect intrusions, and dispatch alerts to the D-IADS master. The D-IADS master centrally monitors and analyze the alerts and controls D-IADS sensors. We considered an EMP60 synthetic CPS grid as a case study to demonstrate the framework and proposed D-IADS for WAMPAC applications against cyberattack vectors such as Man-in-the-Middle DNP3 attack, denial-of-service, and data-integrity attacks.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2021

HP in Cybersecurity: CyOTE

The U.S. Department of Energy’s (DOE) Office of Cybersecurity, Energy Security, and Emergency Response (CESER), through the Cybersecurity for the Operational Technology Environment (CyOTE) Program, worked with energy sector asset owners and operators (AOOs), partners, and Idaho National Laboratory (INL) to develop capabilities for AOOs to independently detect adversarial tactics, techniques, and procedures (TTPs) within their operational technology (OT) environments. Unlike the approach taken with commercial security solutions, CyOTE seeks to tie anomalies in cyber operations to a cyber-attack. By stringing together multiple techniques in the OT environment, AOOs can identify attack campaigns with ever decreasing impacts. The CyOTE methodology applies fundamental concepts of perception and comprehension to a universe of knowns and unknowns increasingly disaggregated into observables, anomalies, and triggering events. MITRE’s ATT&CK® Framework for Industrial Control Systems (ICS) is used as a common lexicon to identify a set of triggering events related to three Use Cases – Alarm Logs, Human-Machine Interface (HMI), and Remote Logins – which together account for 87 percent of the techniques commonly used by adversaries. The CyOTE methodology is also appropriate for OT-related anomalies perceived outside the three Use Cases, such as through the energy system itself.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2025

Molten Salt Corrosion Tests of Additively Manufactured Stainless Steel 316H

Molten salt reactors (MSRs) have drawn considerable interest due to their favorable safety features, high thermal efficiency, and compatibility with different fuel cycles. Yet, the success of MSRs hinges critically on the performance of structural materials to be used in these aggressive molten salt environments, where corrosion and material compatibility remain primary challenges to long-term reliability. Additively manufactured (AM) nuclear structural materials prompt the use of novel geometries and compositions to enhance material performance and reduce costs of constructing MSRs. The rapid solidification conditions inherent to AM processing impart distinctive microstructural features, including cellular sub-structures, dislocation densities, residual stress, and oxide inclusions, which can influence material performance in MSR components. While the mechanical properties of AM stainless steels have been widely studied, their corrosion behavior, particularly in molten salt environments, has received far less attention. Addressing these needs, the Advanced Materials and Manufacturing Technologies (AMMT) program provides a framework for systematically evaluating how unique microstructures produced by AM processes influence the performance of these materials in these demanding environments and for developing reproducible testing workflows that can support future code qualification efforts and standards development. Bridging this knowledge gap is essential for assessing the viability of AM alloys in MSRs and informing qualification strategies. A further challenge is the absence of standardized protocols for molten salt corrosion testing. Accordingly, this report provides an account of the corrosion evaluation of AM 316H stainless steel in NaCl 2 -MgCl 2 molten salt at 550 °C, with exposure times of 100 and 500 hours. It documents the experimental procedures implemented under the AMMT program, including salt preparation, exposure protocols, and post-test characterization methods, to establish reproducibility and transparency. Importantly, the study examines AM 316H samples in the as-fabricated condition, directly reflecting the surface state most relevant to engineering applications, and compares their behavior to machine-cut surfaces. Overall, preliminary evaluations have noted that surface conditions (e.g. morphology, contamination, etc.) have a noticeable impact on the corrosion resiliency. The impact of the corrosion is difficult to detect at 100h, unless, in the case of AM 316H, the specimen surface is decontaminated. After 500 h, as-fabricated surfaces of AM and wrought 316H display evidence of general versus preferential corrosion attack, respectively. Both AM and wrought 316H machine-cut surfaces exhibit a continuous Cr depletion zone, evident of general corrosion. While the estimated extent of corrosion appears within the same order of magnitude regardless of the surface condition, it is apparent that more predictable behavior is observed on machine-cut surfaces. Nonetheless, further investigation is necessary to fully elucidate the corrosion mechanism under these conditions.

36 - MATERIALS SCIENCE↗
DOE OSTI2022

Cyber Resilient Flexible Alternating Current Transmission Systems (XFACTS)

This report summarizes the activities conducted under the DOE-OE funded project DEOE0000897, Cyber Attack Resilient Flexible AC Systems – XFACTS. Hitachi Energy (HE), in collaboration with ABB Inc. (ABB), Bonneville Power Administration (BPA), University of Illinois at Urbana-Champaign (UIUC), Iowa State University (ISU), and University of Idaho (UI) pursued the development of a system of defense for Flexible Alternating current Transmission Systems against cyber-attacks (XFACTS). A FACTS substation enhanced with XFACTS defense mechanisms will be capable of mitigating cyberattacks especially those that seek to control electrical parameters like voltage or current and interrupt the power flow in AC lines. It empowers existing FACTS controllers and associated intelligent electronic devices to detect and mitigate malicious intents to depress system voltages, destabilize power flows, trip AC circuit breakers, corrupt currents, and voltages, even if the malicious commands and the measurements have correct syntax. The XFACTS functions utilize the physics of active power electronic systems, control and protection, electric power engineering principles, and state estimation to bring more in-depth cyber defense closer to the protected FACTS substation devices.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2020

Cybersecurity Attacks in Vehicular Sensors

Today's modern vehicles contain anywhere from sixty to one-hundred sensors and exhibit the characteristics of Cyber-Physical-Systems (CPS). There is a high degree of coupling, cohesiveness, and interactions among vehicle's CPS components (e.g., sensors, devices, systems, systems-of-systems) across sensing, communication, and control layers. Cyber-attacks in the sensing or communication layers can compromise the security of the control layer. This paper provides a detailed review of potential cyber threats related to the sensing layer. Notably, the focus is mainly towards two categories of sensors: vehicle dynamics sensors (e.g., Tire Pressure Monitoring Systems (TPMS), magnetic encoders, and inertial sensors) and environment sensors (e.g., Light Detection and Ranging (LiDAR), ultrasonic, camera, Radio Detection and Ranging (Radar) systems, and Global Positioning System (GPS) units). Furthermore, the paper also offers perspectives through existing countermeasures from literature and stresses the need for data-driven cybersecurity solutions.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2026

SDN-Based Smart Cyber Switching (SCS) for Cyber Restoration of a Digital Substation

In recent years, critical infrastructure and power grids have increasingly been targets of cyber-attacks, causing widespread and extended blackouts. Digital substations are particularly vulnerable to such cyber incursions, jeopardizing grid stability. This paper addresses these risks by proposing a cybersecurity framework that leverages software-defined networking (SDN) to bolster the resilience of substations based on the IEC- 61850 standard. The research introduces a strategy involving smart cyber switching (SCS) for mitigation and concurrent intelligent electronic device (CIED) for restoration, ensuring ongoing operational integrity and cybersecurity within a substation. The SCS framework improves the physical network’s behavior (i.e., leveraging commercial SDN capabilities) by incorporating an adaptive port controller (APC) module for dynamic port management and an intrusion detection system (IDS) to detect and counteract malicious IEC-61850-based sampled value (SV) and generic object-oriented system event (GOOSE) messages within the substation’s communication network. The framework’s effectiveness is validated through comprehensive simulations and a hardware-in-the-loop (HIL) testbed, demonstrating its ability to sustain substation operations during cyber-attacks and significantly improve the overall resilience of the power grid.

Liu, Chen-Ching (ORCID:0000000289417958)↗
DOE OSTI2023

Systematic review of type 1 diabetes biomarkers reveals regulation in circulating proteins related to complement, lipid metabolism, and immune response

Type 1 diabetes (T1D) results from an autoimmune attack of the pancreatic β cells that progresses to dysglycemia and symptomatic hyperglycemia. Current biomarkers to track this evolution are limited, with development of islet autoantibodies marking the onset of autoimmunity and metabolic tests used to detect dysglycemia. Therefore, additional biomarkers are needed to better track disease initiation and progression. Multiple clinical studies have used proteomics to identify biomarker candidates. However, most of the studies were limited to the initial candidate identification, which needs to be further validated and have assays developed for clinical use. Here we curate these studies to help prioritize biomarker candidates for validation studies and to obtain a broader view of processes regulated during disease development. This systematic review was registered with Open Science Framework (https://doi.org/10.17605/OSF.IO/N8TSA). Using PRISMA guidelines, we conducted a systematic search of proteomics studies of T1D in the PubMed to identify putative protein biomarkers of the disease. Studies that performed mass spectrometry-based untargeted/targeted proteomic analysis of human serum/plasma of control, pre-seroconversion, post-seroconversion, and/or T1D-diagnosed subjects were included. For unbiased screening, 3 reviewers screened all the articles independently using the pre-determined criteria. A total of 13 studies met our inclusion criteria, resulting in the identification of 266 unique proteins, with 31 (11.6%) being identified across 3 or more studies. The circulating protein biomarkers were found to be enriched in complement, lipid metabolism, and immune response pathways, all of which are found to be dysregulated in different phases of T1D development. We found 2 subsets: 17 proteins (C3, C1R, C8G, C4B, IBP2, IBP3, ITIH1, ITIH2, BTD, APOE, TETN, C1S, C6A3, SAA4, ALS, SEPP1 and PI16) and 3 proteins (C3, CLUS and C4A) have consistent regulation in at least 2 independent studies at post-seroconversion and post-diagnosis compared to controls, respectively, making them strong candidates for clinical assay development. Biomarkers analyzed in this systematic review highlight alterations in specific biological processes in T1D, including complement, lipid metabolism, and immune response pathways, and may have potential for further use in the clinic as prognostic or diagnostic assays.

60 APPLIED LIFE SCIENCES↗
DOE OSTI2026

SDN-Based Dynamic Cybersecurity Framework of IEC-61850 Communications in Smart Grid

In recent years, critical infrastructure and power grids have experienced a series of cyber-attacks, leading to temporary, widespread blackouts of considerable magnitude. Since most substations are unmanned and have limited physical security protection, cyber breaches into power grid substations present a risk. Nowadays, the susceptibility of SDN architecture to cyber-attacks has exhibited a notable increase in recent years, as indicated by research findings. This suggests a growing concern regarding the potential for cybersecurity breaches within the SDN framework. In this paper, we propose a hybrid intrusion detection system (IDS)-integrated SDN architecture for detecting and preventing the injection of malicious IEC 61850-based generic object-oriented system event (GOOSE) messages in a digital substation. Additionally, this program locates the fault’s location and, as a form of mitigation, disables a certain port. Furthermore, implementation examples are demonstrated and verified using a hardware-in-the-loop (HIL) testbed that mimics the functioning of a digital substation.

Liu, Chen-Ching [Virginia Tech] (ORCID:00000002894↗
DOE OSTI2022

A Distributed Trust Model Simulator for Energy Grid of Things Distributed Energy Resource Management System

The evolution of networks into more distributed, self-reliant nodes has mitigated single-point failures that plagued traditional centralized networks. Applied to power grids, distributed systems can increase the integrity and availability of grid services while also offering a power management solution. However, while distributed networks provide scalability, security, and sustainability compared to centralized networks, their distributed nature makes them harder for anomaly detection and prevention. Incorporating a Distributed Trust Model (DTM) System into an Energy Grid of Things Distributed Energy Resource Management System (EGOT DERMS) allows grid participants to be characterized and their communication to be analyzed for possible attacks. A Trust Model simulator is needed to evaluate and improve the DTM System.Trustworthiness is calculated using a Trust Model. While many trust models exist, most only consider 2-3 matrices to evaluate trust. The TM proposed in this thesis uses a Metric Vector of Trust (MVoT) monitoring 17 parameters when assessing trust. Moreover, unlike standard trust models, the proposed trust model establishes a method to test the trust between various actors within the network and probe the trust model itself. Using a Trust Model Simulator, MVoT calaculations, initial values, and parameters are fine-tuned to achieve high-confidence message classifications and minimize false positives. The DTM System and Trust Mode Simulation Suite allow for distributed trust evaluation with a real-time classification of EGOT DERMS actors, providing additional security for distributed systems.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗
DOE OSTI2023

Alerga: Alert Aggregation and Reasoning in GOOSE Simulation Pipeline

IEC 61850 specifies the Generic Object Oriented Substation Event (GOOSE) protocol as one option for low latency communication of substation-related events. Due to its strict timing requirements, GOOSE lacks any form of encryption or authentication and has only minimal integrity guarantees. These absences render the protocol vulnerable to a variety of communication anomalies, including adversarial action. In particular, an adversary with access to the substation network can launch man in the middle (MITM) attacks. We propose Alerga, a set of tools to allow operators to mitigate some of the risks of the protocol while retaining its strengths. To that end, we have developed first a GOOSE simulation pipeline including data generation, anomaly detection, alert handling, causal reasoning and data visualization components. The simulator is designed to be modular, allowing operators to swap components to better fit their network capabilities. The volume of alert traffic on a substation network threatens operators with alert fatigue. In order to combat this, we secondly present a novel form of alert aggregation and processing, offering operators a condensed view of any threats to the system. Thirdly, to facilitate the handling of these threats, our causal reasoning system traces the alerts back to their most likely cause, generating an initial hypothesis for operators to investigate.

alert aggregation↗
DOE OSTI2025

Development of a high-throughput method for processing sponge-stick samples to detect viable Bacillus anthracis spores

Since the national validation of the sponge-stick based method for detection of Bacillus anthracis spores in environmental samples, there have not been focused efforts to address the low throughput nature of the method, which processes only one sample at one time. Sample processing remains a serious bottleneck for rapidly analyzing large numbers of samples expected from a biological warfare attack. Therefore, we developed a high-throughput method to simultaneously process multiple sponge-stick samples to be better prepared for rapid response and recovery after wide area anthrax incidents. In this method, sponges are placed in 50 mL tubes containing 25 mL extraction buffer and shaken to release spores, after which the suspension is recovered for analysis. Here, we determined that an additional extraction step, conducted in the same tubes with 10 mL buffer, further increased spore recovery from sponge-stick by approximately 10 %. We determined that orbital shaking and multi-tube vortexing were both more effective than reciprocating shaking for recovering spores. We conducted simultaneous processing of up to 12 sponge-stick samples and demonstrated comparable spore recovery efficiencies to the traditional low-throughput stomacher-based method (approximately 60 % recovery at 10 2 -spore level and 75 % recovery at 10 4 -spore level for both methods in three replicate experiments, P > 0.05 for two-tailed t-tests for each experiment and spore level). We also demonstrated that our high-throughput method could be integrated with Rapid Viability-Polymerase Chain Reaction (RV-PCR) analysis and could detect levels as low as 40 spores per sponge even when challenged by a PCR particulate contaminant.

Anthrax↗
DOE OSTI2020

Model Driven Deception for Defense of Operational Technology Environments

Due to the strong integration of real-world physics, OT deception platforms must operate differently than traditional IT deceptions. For instance, turning off a valve will be detected downstream by other sensors because the flow will reduce and stop. Additionally, controllers and applications leverage data from sensors to send control commands to each other. A believable deception must be integrated with the system to project the effects of events. An attack will likely attempt to control the physical process in a negative manner. To make the attacker believe they are achieving their objective, it must predict the effects of these actions, to a reasonable degree. Our approach to simulating a model to generate realistic decoy behavior is explored including description of two approaches: a physics model-based approach and a data driven approach. The performance of two machine learning techniques are investigated in their ability to learn a good enough model of the physics of the system.

97 MATHEMATICS AND COMPUTING↗