SEARCH · Engineering Papers
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Structured Threat Automated Response (STAR) is a script that creates a python run-time for automated response action included in the Structure Threat Information Expression (STIX) Course of Action object. This script can parse a valid STIX json file and execute the included Course of Action.
Artificial Diversity and Defense Security (ADDSec) machine learning algorithms are used to classify and cluster threats so that an appropriate response can be initiated as a mitigation strategy. The package includes an ensemble of machine learning algorithms such as Support Vector Machines, naïve bayes, logistic regression, and random forest that evolve with the data to recognize anomalous behavior at the host and network levels. Inputs into the machine learning algorithms include end host system calls, system utilization, packet captures, and syslog messages. The machine learning algorithms can be retrained based on user defined intervals or on the number of packets received. ADDSEC's threat responses include Internet Protocol (IP) Address randomization, application port number randomization, and application library randomization. The IP randomization implementation is built on top of a Software Defined Networking (SDN) framework. The SDN controller installs flows on each of the SDN switches with randomized source and destination IP addresses. The application port numbers are randomized using iptables. The application library randomization is created with a LLVM compiler. All randomization schemes are transparent to the endpoints on the network. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525. SAND2021-3379 O
This software allows for the conversion, extraction, and transformation of malware behavior data from "Malware Configuration And Payload Extraction" (CAPEv2) sandbox reports, to Structured Threat Information eXpression (STIX). This allows for further analysis to be performed, sharing of threat data, and transit to a graph database.
The Renewable Energy and Storage Cybersecurity Research (RESCue) project is a collaborative effort aimed at securing the rapidly growing deployment of transmission-connected hybrid renewable energy systems, consisting of a combination of wind, solar, and/or energy storage equipment, against escalating cyber threats. This project brings together major original equipment manufacturers (OEMs) of wind, solar, and energy storage, along with major asset owners and DOE National Laboratories, to collectively identify cyber threats, assess risks, and develop robust cybersecurity strategies and solutions. The development of hybrid reference architectures has provided comprehensive blueprints for the secure design and integration of hybrid renewable energy systems, accounting for their unique characteristics and interdependencies. Additionally, NREL has created a cyber-resilient design framework that integrates cybersecurity considerations from the start of the system lifecycle, ensuring security is "baked in" from the initial design phase. The research thrusts for the project included (i) development of hybrid reference architectures and (ii) a cyber-resilient design framework for hybrid energy systems. The reference architectures has provided comprehensive blueprints for the secure design and integration of hybrid renewable energy systems, accounting for their unique characteristics and interdependencies. Additionally, NREL has created a cyber-resilient design framework that integrates cybersecurity considerations from the start of the system lifecycle, ensuring security is "baked in" from the initial design phase. A demonstration experiment was developed for one of the architectures using NREL's Cyber Range resources. This experiment configuration, deployable using open-source tools, is provided here in this repository. Additional models were developed for the wind and solar architectures as well, however the configurations for only the Energy Storage scenario are provided here: https://www.nrel.gov/docs/fy24osti/89921.pdf
CATCH CLI focuses on gathering telemetry data, storing it in the Neo4j database, querying for Mitre ATT&CK patterns, and creating STIX 2.1 reports. Key Components: Analysis Modules: Analyze data to detect attack patterns. GoSTOTS Collection Engines: Collect telemetry data. These tools can be used together or individually. Analysis modules rely on data from specific engines to identify attack patterns. Source Code Organization: Engines: CATCH/catch/cmd/collection Modules: CATCH/catch/cmd/analysis CGUI Overview CATCH Graphical User Interface (CGUI) offers a graphical shell to execute CATCH CLI, allowing easy editing of: Analysis Modules Database configurations Profiles (collection and device settings) Neo4j Overview Neo4j is a graph database using the Cypher query language, storing data in JSON. It seamlessly integrates with STIX 2.1 data for: Data Submission: CATCH Collection Engines Data Querying: Analysis Modules CATCH modifies STIX 2.1 data for Neo4j submission and reverts it back during querying. STIG Overview Structured Threat Intelligence Graph (STIG) is a tool for creating, editing, querying, analyzing, and visualizing threat intelligence using STIX 2.1 and storing data in Neo4j. Usage Tools can be run: Manually (CLI): Refer to CATCH documentation User Interface: Run ./cgui/CGUI or go run ./cgui/ Additional Information Logging System: Detailed in the config documentation Further Documentation: Available for CATCH and CGUI
The US government routinely performs radiological response deployments to search for the presence of illicit nuclear materials (e.g., highly enriched uranium and weapons-grade plutonium) in a specified area. The deployments can be intelligence driven, in support of law enforcement, and for planned events such as WrestleMania, presidential inaugurations, or political conventions. In a typical deployment, radiation detection systems carried by human operators or mounted on vehicles move in a clearing pattern through the search area. Search teams rely on radiation detection algorithms running on these systems in real time to alert them to the presence of an illicit threat source. The detection and identification of sources is complicated by large variation of natural radiation background throughout a search area and the potential presence of localized non-threat sources such as patients undergoing treatment with medical isotopes. As a result, detection algorithms must be carefully balanced between missing real sources (false negatives) and reporting too many false alarms (false positives).The purpose of this data set is to spur innovations in detecting, identifying, and localizing nuclear materials inurban search missions.
Hydrogen peroxide (H 2 O 2 ) is the most common chemical threat that organisms face. Here, we show that H 2 O 2 alters the bacterial food preference of Caenorhabditis elegans , enabling the nematodes to find a safe environment with food. H 2 O 2 induces the nematodes to leave food patches of laboratory and microbiome bacteria when those bacterial communities have insufficient H 2 O 2 -degrading capacity. The nematode’s behavior is directed by H 2 O 2 -sensing neurons that promote escape from H 2 O 2 and by bacteria-sensing neurons that promote attraction to bacteria. However, the input for H 2 O 2 -sensing neurons is removed by bacterial H 2 O 2 -degrading enzymes and the bacteria-sensing neurons’ perception of bacteria is prevented by H 2 O 2 . The resulting cross-attenuation provides a general mechanism that ensures the nematode’s behavior is faithful to the lethal threat of hydrogen peroxide, increasing the nematode’s chances of finding a niche that provides both food and protection from hydrogen peroxide.
The 2009 H1N1 pandemic (pdm09) lineage of influenza A virus (IAV) crosses interspecies barriers with frequent human-to-swine spillovers each year. These spillovers reassort and drift within swine populations, leading to genetically and antigenically novel IAV that represent a zoonotic threat. We quantified interspecies transmission of the pdm09 lineage, persistence in swine, and identified how evolution in swine impacted zoonotic risk. Human and swine pdm09 case counts between 2010 and 2020 were correlated and human pdm09 burden and circulation directly impacted the detection of pdm09 in pigs. However, there was a relative absence of pdm09 circulation in humans during the 2020–21 season that was not reflected in swine. During the 2020–21 season, most swine pdm09 detections originated from human-to-swine spillovers from the 2018–19 and 2019–20 seasons that persisted in swine. We identified contemporary swine pdm09 representatives of each persistent spillover and quantified cross-reactivity between human seasonal H1 vaccine strains and the swine strains using a panel of monovalent ferret antisera in hemagglutination inhibition (HI) assays. The swine pdm09s had variable antigenic reactivity to vaccine antisera, but each swine pdm09 clade exhibited significant reduction in cross-reactivity to one or more of the human seasonal vaccine strains. Further supporting zoonotic risk, we showed phylogenetic evidence for 17 swine-to-human transmission events of pdm09 from 2010 to 2021, 11 of which were not previously classified as variants, with each of the zoonotic cases associated with persistent circulation of pdm09 in pigs. These data demonstrate that reverse-zoonoses and evolution of pdm09 in swine results in viruses that are capable of zoonotic transmission and represent a potential pandemic threat.
Modern power systems become more vulnerable to cyber threats due to their growing interconnectivity, interdependence, and complexity. Widespread deployment of distributed energy resources (DERs) further expands the threat landscape to the grid edge, where fewer cybersecurity protections exist. In this article, a systematic cyber-physical events demonstration, enabled by an integrated transmission, distribution, and communication co-simulation framework, is performed. It analyzes cyber risks to power grid under DER-enabled automatic generation control from different angles. Unlike existing works, the simulation captures millisecond-to-minutes frequency and voltage transient dynamics at a cross-region system scale.
Project objective was to understand water-related constraints affecting conventional powerplant operations, specifically coal-fired power plants. Of concern were threats related to drought and flood affecting both water supply and ability of plant to discharge wastewater. Also of interest were adaptive measures taken to mitigate identified threats. This spreadsheet contains the responses provided by the power plant operators and owners. Data have been "sanitized" (e.g., random plant ID, binned location and generation capacity information) to ensure anonymity of individual power plants.
Climate change and its impacts on average temperature, water supply, agriculture, coastal flooding, biodiversity, social and economic stability, human migration, and overall global stability is one of the leading threats emerging for humanity, and is likely to increase as a threat for decades to come. This report represents a snapshot of climate change data, information, and understanding, as of 2018, and can serve as a kind of benchmark for changes going forward in time. This report covers temperature change and heat effects, atmospheric and ocean circulation, freshwater supply changes, sea level rise and flooding, extreme climate events, oceanic deoxygenation, land degredation, social and economic changes, migration, and food. Data and information on all these issues represent a compelling body of knowledge supporting the scientific hypothesis describing climate change, and an important mile marker in our effort to track the unfolding nature of the problem. A slide presentation that summarizes the content of this report is in Appendix A and can serve as an executive summary for the report.
The potential for new, re-emerging, or engineered pandemic threats could challenge our nation's biosecurity, requiring rapid and flexible countermeasure development platforms. In healthcare, one of the main hindrances to the timely development of protein-based therapeutics for cancer, infectious disease, and other diseases has been a slow and expensive quality-controlled production stage. We present a protein-based technology that has the potential to address these crucial problems in biosecurity and healthcare by maximizing protein production and system portability, while minimizing production latency and cost. Specifically, we have developed a reusable, portable first-generation platform that leverages the advantages of cell-free protein synthesis (CFPS) and flow cells to create practical amounts of clinically relevant therapeutics. We have demonstrated that this technology is reusable and programmable, enabling a single platform that can synthesize multiple dosages of various therapeutics and vaccine in the field. Implementing this technology could mitigate pandemic threats by providing a rapidly-deployable (just-in-time), versatile (precision medicine) production of biologic therapeutics to the infected patient’s locale (point-of-care). In drug development, once promising drug variations are identified, the platform can be scaled to quickly produce practical amounts of protein for patient testing in the matter of days (vs. months) at a fraction of the cost of existing technology.
This paper examines national and tribal collaborative opportunities to get ahead of the critical infrastructure insecurity problem. Recommendations are viewed through the lens of the Sandia Labs Tribal Cyber-Energy initiative and national security projects. Recommendations include 1) Collaboratively address national priority and shared challenges to gain faster and better solutions to national priority problems on a smaller yet comprehensive American Indian and Alaskan Native sovereign single-point of authority scale 2) Utilize newer standards-based technologies to provide scalable, capable, and manageable solutions for greatly expanded and connected national critical infrastructures 3) Employ Cyber-Physical-Resilient design preliminary analysis to define concept- to-disposition design requirements for preemptive critical infrastructure risk mitigation and baked-in security; 4) Develop data-centric protection to provide increased information asset protection as data shifts from data-owner operated on-premises infrastructure to virtual service provider data-steward owned and operated off-premises infrastructure; and 5) Balance shared solutions with the National Institute of Science and Technology (NIST) Cybersecurity and Risk Management frameworks, and the System Security Engineering Guidelines. As yet unallocated federal funding would support research, development, the timely application of National-Tribal critical infrastructure protection, and critical infrastructure Cyber disruption response and recovery with extraordinary mutual benefits for the foreseeable future. The Critical Infrastructure Insecurity Problem: Rapid modernization and expansive connectivity are due to advances in Information and Communications Technologies that have sweeping cyber impact across all critical infrastructure sectors. Supervisory Control and Data Acquisition and Industrial Control Systems are particularly impacted as systems long separated from the Internet are now being connected and computerized. Virtualization and mobility create a Data Everywhere-User Anywhere paradigm that has evaporated the enterprise network perimeter. There are multi-front technological challenges at play, where long depended on technologies simply don't scale to current needs resulting in a digital dichotomy of competing old and new standards. New standards-based technologies scale but are not as well-known or as widely deployed, which leaves decision makers, stakeholders, and the workforce in a quandary, caught mid-stream between the technological past and the virtual future. Rapid and expansive cyber threat accompanies disruptive change in connectivity and computational dependencies. A lack of action will exacerbate the problem if new technologies roll out without baked-in security design. The Risk: If National-Tribal CIP collaboration to design in security is not done, then an ongoing state of insufficient bolt-on security and elevated threat exposure will remain for years to come.
Since its founding in 1992, the Center for Global Security Research (CGSR) has had an abiding interest in nuclear threat reduction. In the 1990s it did some of the leading thinking about cooperative threat reduction with post-Soviet entities. In the early 2000s it focused increasingly on strengthening the nonproliferation regime. Since 2015 one of its primary interests has been exploring the future of cooperative strategies to reduce nuclear/strategic dangers. That future faces many challenges, both technical and geopolitical. By 2020, a rising sense of urgency of nuclear danger had clearly taken shape in the United States and internationally, driven in significant measure by the renewal of major power rivalry and potential military flashpoints among those powers. And that urgency has driven a rising national and international exploration of what can be done to reduce nuclear dangers.
The COVID-19 pandemic is unique among the range of threats encountered over the last century, and its specific impacts do not necessarily resemble those of other disasters. In the near term, the pandemic is causing demand shocks, workforce impacts, supply chain complications, and a global, economic contraction with long-term consequences as yet unknown. In contrast, with natural disasters the principal impacts are more acute. These include infrastructure destruction, displaced populations, and often localized economic impact; however, the long-term response to both of these threats–pandemics and destructive forces of nature–requires similar approaches to building short-term and long-term resilience that prepare power sectors for safe and reliable operation during times of disruption.
The increasingly large payloads of Unmanned Aircraft Systems (UASs) are exponentially increasing the threat to the nuclear enterprise. Current mitigation using RF interference is effective, but not feasible for fully autonomous systems and is prohibited in many areas. A new approach to UAS threat mitigation is needed that does not create radio interference but is effective against any type of vehicle. At the present time there is no commercial counter-UAS system that directly assaults the mems gyros and accelerometers in the Inertial Measurement Unit on the aircraft. But lab testing has revealed resonances in some IMUs that make them susceptible to moderate amplitude acoustic monotones. Sandia's energetic materials facility has enabled a quick and thorough exploration of UAS vulnerability to directed acoustic energy by using intense acoustic impulses to destabilize or down a UAS. We have: 1) detonated/deflagrated explosive charges of various sizes; 2) accurately measured impulse pressure and pulse duration; 3) determined what magnitude of acoustic insult to the IMU disrupts flight and for how long and; 4) determined if the air blast/shock wave on aircraft/propellers disrupts flight.
The electric power grid is a complex critical infrastructure that forms the lifeline of modern society, and its secure and reliable operation is of paramount importance to national security and economic well being. However, recent findings documented in authoritative sources indicate the threat of cyber-based attacks growing in numbers and sophistication. However, securing the grid against stealthy cyber attacks is a challenging task due to legacy nature of the infrastructure coupled with dynamic nature of threat landscape and ever growing sophistication of the adversaries. Additionally, the grid’s attack surface continues to grow with the increased dependence on digital communications and control that now extends to each consumer through smart meters and distributed energy resources. Unfortunately, this expansive surface increases the grid’s vulnerability and further exposes critical control systems in both substations and control centers. To respond to this emerging need, we had successfully assembled an interdisciplinary team with academic- industry partnership to successfully conduct research, development, evaluation, demonstration, and commercialization of attack surface reduction tools, whose goal is to significantly reduce the cyber attack surface in the North American power grid. Our proposed project was a synergistic collaborative effort leveraging the synergistic expertise of the team members across power systems, cyber security and CPS security, testbeds, field deployments and demonstration, and successful commercialization. The team consisted of leading experts from two major universities – Iowa State University, Washington State University – complemented by reputed researchers from two DOE national laboratories – Pacific Northwest National Lab, and Argonne National Lab, one major utility vendor GE Global Research, and one utility partner – Cedar Falls Utilities (CFU). The team members have proven track record of successful academic-industry collaboration in interdisciplinary R&D projects, and bring onboard some of the best state-of-the-art testbed resources, industry-grade SCADA/EMS/DMS environment for experimentation and field demonstration.