Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “attack detection”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 361 records · Page 20
All sourcesNASA NTRSDOE OSTI
NASA NTRS1991

Flight test to determine feasibility of a proposed airborne wake vortex detection concept

This investigation was conducted to determine the radial extent at which aircraft mounted flow vanes or roll rate gyros can sense the circulatory flow field that exists around the lift induced vortex system generated by an aircraft in flight. The probe aircraft was equipped with wingtip sensors for measuring angle of attack and angle of sideslip, and with a fuselage mounted gyroscope for measuring roll rate. Analysis of flight test data indicated that the vortex was detectable at a lateral distance of about 105 feet (best results) using unsophisticated equipment. Measurements were made from the centerline of the probe aircraft to the center of the nearest vortex with the probe aircraft flying between one half and one and one half miles behind the vortex generating aircraft.

Branstetter, James R.↗
DOE OSTI2020

Cyber-physical Architecture For Automated Responses (cyphar) In Adversarial Ot Environments

The ability to react to a malicious attack starts with high fidelity recognition, and with that, an agile response to the attack. The current operational technology (OT) systems for a critical infrastructure may include an intrusion detection system (IDS), but the ability to adapt to an intrusion is a human initiated response. Orchestrators, which are coming of age in the financial sector and allow for levels of automated response, are not prevalent in the OT space. To evolve to such responses in the OT space, a tradeoff analysis is first needed, The tradeoff analysis, which evaluates the mitigation benefits of responses versus the physical affects that result, inform an automated response decision. The intent of this paper is to provide a formulation of a tradeoff analysis and its use in advancing automated, agile responses.

Rieger, CraigG.↗
DOE OSTI2026

Towards Secure Autonomous Vehicles: An Integrated Edge and Multi-Modal Machine Learning Framework for Intrusion Detection

Autonomous vehicles (AVs) are vulnerable to cyberattacks targeting both internal communication networks and external perception sensors. While edge-based intrusion de- tection for Controller Area Network (CAN) buses offers real-time protection, it cannot detect cross-modal threats. Conversely, multi-modal fusion approaches improve coverage but often lack efficiency for in-vehicle deployment. This thesis integrates two complemen- tary solutions: (1) a lightweight, edge-deployable machine learning framework for CAN bus intrusion detection, and (2) a late-fusion system combining CAN FD and LiDAR data. Together, they form a hierarchical defense capable of handling single-modality and coordi- nated attacks. Simulations show that CAN-only models reach 93% accuracy on simulated DoS, spoofing, replay, and fuzzy attacks, while the fusion system achieves 0.87 AUC and 0.82 F1-score at 2 ms latency. This unified framework establishes a scalable, explainable, and field-ready strategy for AV cybersecurity.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2022

Inter-Domain Fusion for Enhanced Intrusion Detection in Power Systems: An Evidence Theoretic and Meta-Heuristic Approach

False alerts due to misconfigured or compromised intrusion detection systems (IDS) in industrial control system (ICS) networks can lead to severe economic and operational damage. However, research using deep learning to reduce false alerts often requires the physical and cyber sensor data to be trustworthy. Implicit trust is a major problem for artificial intelligence or machine learning (AI/ML) in cyber-physical system (CPS) security, because when these solutions are most urgently needed is also when they are most at risk (e.g., during an attack). To address this, the Inter-Domain Evidence theoretic Approach for Inference (IDEA-I) is proposed that reframes the detection problem as how to make good decisions given uncertainty. Specifically, an evidence theoretic approach leveraging Dempster–Shafer (DS) combination rules and their variants is proposed for reducing false alerts. A multi-hypothesis mass function model is designed that leverages probability scores obtained from supervised-learning classifiers. Using this model, a location-cum-domain-based fusion framework is proposed to evaluate the detector’s performance using disjunctive, conjunctive, and cautious conjunctive rules. The approach is demonstrated in a cyber-physical power system testbed, and the classifiers are trained with datasets from Man-In-The-Middle attack emulation in a large-scale synthetic electric grid. For evaluating the performance, we consider plausibility, belief, pignistic, and general Bayesian theorem-based metrics as decision functions. To improve the performance, a multi-objective-based genetic algorithm is proposed for feature selection considering the decision metrics as the fitness function. Finally, we present a software application to evaluate the DS fusion approaches with different parameters and architectures.

42 ENGINEERING↗
NASA NTRS1980

Ground radar detection of meteoroids in space

A special test to lower the detection threshold for satellite fragments potentially dangerous to spacecraft was carried out by NORAD for NASA, using modified radar software. The Perimeter Acquisition Radar Attack Characterization System, a large, planar face, phased radar, operates at a nominal 430 MHz and produces 120 pulses per second, 45 of which were dedicated to search. In a time period of 8.4 hours of observations over three days, over 6000 objects were detected and tracked of which 37 were determined to have velocities greater than escape velocity. Six of these were larger objects with radar cross sections greater than 0.1 sq m and were probably orbiting satellites. A table gives the flux of both observed groups.

Kessler, D. J.↗
DOE OSTI2021

Cyber State Awareness For Resilience

Characterization of cyber-physical attacks requires a holistic understanding of cyber and physical behavior in a system. Machine Learning Anomaly Detection provides a compelling solution for continuously identifying suspicious behavior within these complex systems. In our software, we present an approach for holistic characterization of cyber-physical systems based on cyber and physical anomaly correlation. The approach consists of three main components: 1) an architecture for real-time data acquisition, management, and analysis of both cyber and physical data; 2) cyber and physical data driven anomaly detection systems (ADSs), 3) a metric that combines cyber and physical ADSs to provide a holistic characterization of the system..

Rieger, CraigG.↗
DOE OSTI2022

Assessing the interfacial corrosion mechanism of Inconel 617 in chloride molten salt corrosion using multi-modal advanced characterization techniques

The United States Department of Energy (DOE) has committed to expanding the domestic clean energy portfolio in response to the rising challenges of energy security in the wake of climate change. Accordingly, the construction of a series of Generation IV reactor technologies are being demonstrated, including sodium-cooled, small modular, and molten chloride fast reactors (MCFRs). To date, there are no fully qualified structural materials for constructing MCFRs. A number of commercial structural alloys have been considered for the construction of MCFRs, including alloys from the Inconel and Hastelloy series. Informed qualification of structural materials for the construction of MCFRs in the future can only be ensured by expanding the current fundamental knowledgebase of information pertaining to material performance under environmental stressors relevant to operation of the reactor, including corrosion susceptibility. The purpose of this investigation is to illustrate how a correlative multi-modal electron microscopy characterization approach, including the novel application of focused-ion beam 3D reconstruction capabilities, can elucidate the corrosion mechanism of a candidate structural material Inconel 617 for MCFR in NaCl-MgCl 2 eutectic salt at 700°C for 1,000 h. Evidence of intergranular corrosion, Ni and Fe dealloying, and Cr-O enrichment along the grain boundary, which most likely corresponds to Cr 2 O 3 , is a phenomenon that has been documented in other Ni-based superalloys exposed to chloride molten salt systems. Additional corrosion products, including the formation of insoluble MgAl 2 O 4 , within the porous network produced by the salt attack is a novel observation. In addition, Mo 3 Si 5 and τ 2 precipitates are detected in the alloy bulk and are dissolved by the salt. Furthermore, the lack of detection of design γ' precipitates in Inconel 617 after 1,000 h could indicate that the molten salt corrosion mechanism has indirectly induced a phase transformation of Al 2 TiNi (τ 2 ) and Ni 3 (Al,Ti) (γ’) phase. This investigation provides a comprehensive understanding of molten salt corrosion mechanisms in a complex material system such as a commercial structural alloy for applications in MCFRs.

36 MATERIALS SCIENCE↗
DOE OSTI2022

Stealthy Cyber Anomaly Detection On Large Noisy Multi-material 3D Printer Datasets Using Probabilistic Models

As Additive Layer Manufacturing (ALM) becomes pervasive in industry, its applications in safety critical component manufacturing are being explored and adopted. However, ALM's reliance on embedded computing renders it vulnerable to tampering through cyber-attacks. Sensor instrumentation of ALM devices allows for rigorous process and security monitoring, but also results in a massive volume of noisy data for each run. As such, in-situ, near-real-time anomaly detection is very challenging. The ideal algorithm for this context is simple, computationally efficient, minimizes false positives, and is accurate enough to resolve small deviations. In this paper, we present a probabilistic-model-based approach to address this challenge. To test our approach, we analyze current measurements from a polymer composite 3D printer during emulated tampering attacks. Our results show that our approach can consistently and efficiently locate small changes in the presence of substantial operational noise.

Yoginath, Srikanth↗
DOE OSTI2021

Vehicle Tracking

The detection and tracking of vehicles moving at hypersonic speeds (> Mach 5) at altitudes of ~100 km has been of growing interest due to the ongoing development of hypersonic glide vehicles (HGVs) by the U.S., Russia and China. This challenge is notably different from traditional ballistic missile systems whose re-entry vehicles move at hypersonic velocities but at much higher altitudes on a ballistic course. Hypersonic glide vehicles are also designed to be able to make sudden turns along their flight path making prediction of their trajectories difficult. Their ability to maneuver, combined with their high velocity and altitude make them difficult to track. The combination of these characteristics presents a challenge for anyone attempting to defend against a hypersonic glide vehicle attack by generally shortening the time available to react. That reaction can involve moving potential targets or attempting to detect the hypersonic glide vehicle and intercept it before it reaches the intended target. Figure 1 compares the trajectory of hypersonic vehicles compared to that of a traditional ballistic missile.

42 ENGINEERING↗
DOE OSTI2022

Cooperative Systems in Presence of Cyber-Attacks: A Unified Framework for Resilient Control and Attack Identification

Here, this paper considers a cooperative control problem in presence of unknown attacks. The attacker aims at destabilizing the consensus dynamics by intercepting the system’s communication network and corrupting its local state feedback. We first revisit the virtual network based resilient control proposed in our previous work and provide a new interpretation and insights into its implementation. Based on these insights, a novel distributed algorithm is presented to detect and identify the compromised communication links. It is shown that it is not possible for the adversary to launch a harmful and stealthy attack by only manipulating the physical states being exchanged via the network. In addition, a new virtual network is proposed which makes it more difficult for the adversary to launch a stealthy attack even though it is also able to manipulate information being exchanged via the virtual network. A numerical example demonstrates that the proposed control framework achieves simultaneously resilient operation and real-time attack identification.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

On the Abuse and Detection of Polyglot Files

A polyglot is a file that is valid in two or more formats. Polyglot files pose a problem for file-upload and generative AI web interfaces that rely on format identification to determine how to securely handle incoming files. In this work we found that existing file-format and embedded-file detection tools, even those developed specifically for polyglot files, fail to reliably detect polyglot files used in the wild. To address this issue, we studied the use of polyglot files by malicious actors in the wild, finding 30 polyglot samples and 15 attack chains that leveraged polyglot files. Using knowledge from our survey of polyglot usage in the wild---the first of its kind---we created a novel data set based on adversary techniques. We then trained a machine learning detection solution, PolyConv, using this data set. PolyConv achieves a precision-recall area-under-curve score of 0.999 with an F1 score of 99.20% for polyglot detection and 99.47% for file-format identification, significantly outperforming all other tools tested. We developed a content disarmament and reconstruction tool, ImSan, that successfully sanitized 100% of the tested image-based polyglots, which were the most common type found via the survey. Our work provides concrete tools and suggestions to enable defenders to better defend themselves against polyglot files, as well as directions for future work to create more robust file specifications and methods of disarmament.

Oesch, T [ORNL] (ORCID:0000000269091022)↗
DOE OSTI2021

Characterizing Human Performance: Detecting Targets at High False Alarm Rates [Slides]

Analysts develop a “no threat” bias with high false alarms. If only shown alarms for actual attacks, may never actually see an alarm. We see this in the laboratory, but not often studied in applied environments. (TSA is an exception.) In this work, near-operational paradigms are useful, but difficult to construct well. Pilot testing is critical before engaging time-limited professionals. Experimental control is difficult to balance with operational realism. Grounding near-operational experiments in basic research paradigms has both advantages and disadvantages. Despite shortcomings in our second experiment, we now have a platform for experimental investigations into the human element of physical security systems.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2024

Radio Frequency Spectrum Audit to Inventory Private Cellular Base Station Infrastructure

The ever-changing cellular communication landscape makes it difficult to identify, map, and localize cellular base stations. Localizing cellular base stations provides various advantages, including information security, cybersecurity, spectrum management, and interference detection. For example, the MITRE ATT&CK® (Adversarial Tactics, Techniques, and Common Knowledge architecture) [1] and Common Attack Pattern Enumeration and Classification [2] emphasize the importance of being able to minimize the cyber security threat presented by unregulated private cellular base stations (PCBS). The majority of published research looks at the malicious use of PCBSs and focuses on using data retrieved from user equipment (UE), data obtained from an application on the UE, or data shared between the UE and a mobile network to locate it. This innovative strategy, however, focuses on the passively discovered uniqueness of radio frequency (RF) transmissions from commercial cellular infrastructure received in a designated monitoring position (DMP).

42 ENGINEERING↗
NASA NTRSDate not supplied

High Reynolds Number Testing of the NATO AVT-298 SWiFT Configuration at the National Transonic Facility

A high Reynolds number wind tunnel test of the NATO AVT-298 Swept Wing Flow Test (SWiFT) configuration was conducted in the National Transonic Facility at the NASA Langley Research Center during the summer of 2023. The SWiFT research model geometry has relevance to both blended/hybrid wing body (BWB/HWB) and unmanned combat aerial vehicle (UCAV) configurations, and the test campaign was the culmination of an international collaboration under the NATO AVT-298 research task group. The main objectives of the test were to investigate Reynolds number scaling effects on low-speed stability & control characteristics and to examine the onset and progression of flow separation on the wings particularly near the wing crank. Force & moment and surface pressure data were acquired at Mach numbers from 0.2 to 0.8, Reynolds numbers from 2.5 to 34 million, angles of attack from -3 to 20 degrees, and sideslip angles from -10 to 10 degrees. Boundary layer transition detection techniques utilizing static pressure taps, unsteady pressure transducers, and sublimating chemicals were used on the model in a free/natural transition state or a forced transition state using trip dots. Pressure sensitive paint was used to obtain a global surface pressure profile on the model and an advanced laser velocimetry technique was used to obtain velocity measurements in the wake downstream of the wing crank. The results from the test showed clear Reynolds number scaling effects on the maximum lift coefficient and pitching moment coefficient at Mach 0.2, while also capturing significant hysteresis effects. The data acquired from the test will ultimately help improve computational aerodynamic analysis and design tools for application to future BWB-type vehicle configurations.

NATO AVT-298↗
NASA NTRSDate not supplied

High Reynolds Number Testing of the NATO AVT-298 SWiFT Configuration at the National Transonic Facility

A high Reynolds number wind tunnel test of the NATO AVT-298 Swept Wing Flow Test (SWiFT) configuration was conducted in the National Transonic Facility at the NASA Langley Research Center during the summer of 2023. The SWiFT research model geometry has relevance to both blended/hybrid wing body (BWB/HWB) and unmanned combat aerial vehicle (UCAV) configurations, and the test campaign was the culmination of an international collaboration under the NATO AVT-298 research task group. The main objectives of the test were to investigate Reynolds number scaling effects on low-speed stability & control characteristics and to examine the onset and progression of flow separation on the wings particularly near the wing crank. Force & moment and surface pressure data were acquired at Mach numbers from 0.2 to 0.8, Reynolds numbers from 2.5 to 34 million, angles of attack from -3 to 20 degrees, and sideslip angles from -10 to 10 degrees. Boundary layer transition detection techniques utilizing static pressure taps, unsteady pressure transducers, and sublimating chemicals were used on the model in a free/natural transition state or a forced transition state using trip dots. Pressure sensitive paint was used to obtain a global surface pressure profile on the model and an advanced laser velocimetry technique was used to obtain velocity measurements in the wake downstream of the wing crank. The results from the test showed clear Reynolds number scaling effects on the maximum lift coefficient and pitching moment coefficient at Mach 0.2, while also capturing significant hysteresis effects. The data acquired from the test will ultimately help improve computational aerodynamic analysis and design tools for application to future BWB-type vehicle configurations.

BWB/HWB↗
DOE OSTI2023

Enabling Cybersecurity, Situational Awareness and Resilience in Distribution Grids with High Penetration of Photovoltaics (CARE-PV) (Final Report)

Since legacy distribution systems have very limited visibility beyond the substation, high penetration of PV at the grid edge presents some unique operational challenges. One approach to address these challenges is to use information from advanced metering infrastructure (AMI) and µPMUs. However, exploiting this information is impacted by a number of factors, including multi-timescale measurements, volume of data generated, communication network impairments (e.g., information loss and latency) and susceptibility to cyber-attacks. Therefore, one of the critical tasks involved in the management of a distribution grid is to develop complete situational awareness by integrating cyber-security mechanisms with state estimation strategies and leveraging this situational awareness to assure energy services at strategic locations while exploiting AMI/PV inverter/ µPMU data. This CARE-PV project addresses the fundamental challenges in situational awareness and resilience to cyber and physical vectors by exploiting the synergy between innovative modeling, estimation, data analytics, testing and validation using smart PV inverters designed at K-State and facilities at NREL. Specifically, the project involved the development, testing and validation of the following novel enabling technologies: (Thrust 1) Resilience to cyber vectors that impact data integrity was addressed via a two-level defense strategy that combines cyber intrusion detection using self-learning, cooperative smart PV inverters, and a novel moving target defense framework to combat data integrity attacks. (Thrust 2) Resilience to cyber-physical vectors that impact situational awareness by limiting data availability was addressed via novel centralized and decentralized, sparsity-based static and dynamic state estimation approaches that enhance observability even when the underlying system is unobservable. (Thrust 3) Leveraging a unique probabilistic sensitivity analysis approach accompanied by one-of-a-kind dominant influencer set computation, the vulnerability of critical infrastructure at strategic locations was evaluated so that proactive PV-based control strategies can be used to support operations under normal/outage scenarios. These CARE-PV project innovations were demonstrated on both small-scale IEEE and larger utility-scale testbeds (Thrust 4). Feedback from Industry Advisory Board members was used to formulate a commercialization pathway for a subset of CARE-PV technologies. These CARE-PV technologies will ultimately lead to reliable and secure, large-scale integration of renewable energy and mitigate the risk of energy disruption resulting from cyber incidents and other emerging threats within the energy environment.

14 SOLAR ENERGY↗
DOE OSTI2022

Securing Inverter Communication: Proactive Intrusion Detection and Mitigation System to Tap, Analyze, and Act

The electric grid has undergone rapid, revolutionary changes in recent years; from the addition of advanced smart technologies to the growing penetration of distributed energy resources (DERs) to increased interconnectivity and communications. However, these added communications, access interfaces, and third-party software to enable autonomous control schemes and interconnectivity also expand the attack surface of the grid. To address the gap of DER cybersecurity and secure the grid-edge to motivate a holistic, defense-in-depth approach, a proactive intrusion detection and mitigation system (PIDMS) device was developed to secure PV smart inverter communications. The PIDMS was developed as a distributed, flexible bump-in-the-wire (BITW) solution for protecting PV smart inverter communications. Both cyber (network traffic) and physical (power system measurements) are processed using network intrusion monitoring tools and custom machinelearning algorithms for deep packet analysis and cyber-physical event correlation. The PIDMS not only detects abnormal events but also deploys mitigations to limit or eliminate system impact; the PIDMS communicates with peer PIDMSs at different locations using the MQTT protocol for increased situational awareness and alerting. The details of the PIDMS methodology and prototype development are detailed in this report as well as the evaluation results within a cyber-physical emulation environment and subsequent industry feedback.

14 SOLAR ENERGY↗
DOE OSTI2023

Leveraging High-Fidelity Datasets for Machine Learning-based Anomaly Detection in Smart Grids

Data-driven intrusion detection systems are increasingly becoming essential for protecting critical cyber-physical infrastructure, such as the power grid, against the growing number of sophisticated cyber-attacks. The development of such tools is reliant on the availability of high-fidelity cyber-physical datasets that cover a diverse variety of potential cyber events. In this work, a high-fidelity smart grid platform is utilized to develop an extensive dataset, which is used to train and test a machine learning-based intrusion detection system. The evaluation of the developed IDS shows robust performance even when tested with statistically diverse test data not used in training.

Hyder, Burhan↗