SEARCH · Engineering Papers

Results for “cyber attack”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 379 records · Page 21

All sources NASA NTRS DOE OSTI

DOE OSTI2022

Security Enhancement of Network Constraint Grid-Edge Energy Management System

Network constrained grid edge energy management system (EMS) provides economic solution for active and reactive power dispatch of distributed energy resources (DERs) at the grid edge level. Grid edge EMS ensures secure interconnection of a circuit segment to the distribution system by maintaining grid code requirements (e.g. IEEE 1547–2018). Grid edge EMS is dependent on communication to receive load measurement, which brings a risk of unobservable false data injection attacks (FDIAs). To mitigate the risk, this paper proposes a framework to enhance resilient operation of grid edge EMS by detecting the unobservable FDIAs on loads and replacing them with forecasted values. In this work, a two-step detection algorithm is proposed. In first step, conventional residual based algorithm is deployed. Autoencoder (AE) based data driven mechanism is included in second step to detect the presence of unobservable FDIAs. After ensuring the presence of FDIA, its specific location is detected by checking the maximum residue values till the predefined threshold value is reached. Detected false data injected loads are then replaced with forecasted load values following long-short term memory (LSTM) based forecast to ensure resilient performance of grid edge EMS in the presence of attacks. This proposed security enhancement framework for grid edge EMS is evaluated in IEEE 13 bus system with three integrated DERs. Numerical simulation shows the validation of the proposed framework by reducing voltage violation in real operation of grid edge EMS.

cyber attack detection↗

DOE OSTI2020

A trilevel model against false gas-supply information attacks in electricity systems

The interdependence between natural gas and electricity systems is increasing rapidly due to the growing reliance on natural gas-fired generating units. Availability of natural gas for gas-fired generating units can impact the secure operation of electricity systems. Fuel supply shortage for gas-fired units can be caused by uncertain interruptible supply contracts and incorrect supply information. This article proposes a trilevel min-max-min defender-attacker-operator optimization problem to provide the power system operator a screening methodology that allocates a limited budget for best protecting critical fuel supply information, and also the strategies to sign firm supply contract to reduce natural gas supply uncertainties. We utilize a column and constraint generation (C&CG) algorithm to solve the proposed problem. We illustrate the effectiveness of this trilevel formulation using a case study based on IEEE 24-node test system.

42 ENGINEERING↗

DOE OSTI2020

Self-Secure Inverters Against Malicious Setpoints

The next generation of grid-interactive inverters brings a communication feature that allows data sharing from utility supervisory controllers and smart devices that are connected to the same network. This feature enhances the control capabilities of grid-interactive inverters to provide services beyond active power injection. However, communication networks entail more vulnerable surfaces to malicious attacks that may result in modifying active and reactive power setpoints and causing weak-grid conditions or abnormal inverter operation. In this paper, steady-state and the dynamic behavior of the inverter for the incoming setpoints are analyzed to detect false data injection attacks and provide device-level security. The steady-state behavior of the inverter in the operating region is determined from the grid parameters such as the grid voltage and the grid impedance. These estimations are accomplished by the proposed self-security technique through a low-frequency signal injection-based approach combined with the recursive least square method. Moreover, a reduced fourth-order inverter model is used as the dynamic reference model, and grid parameters as well as the incoming setpoints are implemented to the reference model to verify whether the dynamic behavior of the inverter is inside the permissible region of operation. The validity and performance of the proposed method are verified experimentally through Allen-Bradley Powerflex 755 three-phase inverter and a 12 kW NHR 9410 regenerative power grid emulator. The results show that the self-secure smart-inverter is able to accept or reject the incoming commands and thus is protected from malicious cyber-physical attacks.

Hossen, Tareq↗

DOE OSTI2024

Cyber-Informed Engineering (CIE) Benefits Quantification: Recommendations for Consideration

Cyber-Informed Engineering (CIE) integrates engineering principles into the design, development, and operation of cyber-physical systems (CPS) to mitigate or eliminate the impact of cyber-enabled attacks. In July 2024, Idaho National Laboratory (INL) engaged MITRE researchers to investigate methods for systematically measuring the benefits of CIE implementation. This included evaluating the success and outcomes of CIE, identifying and quantifying the value of early adoption, and determining the business justification for its implementation, especially in existing infrastructure. MITRE reviewed existing methods in engineering and cybersecurity to understand how organizations prioritize security investments, considering their strengths, weaknesses, and relevance to CIE stakeholders. Based on this analysis, MITRE proposed potential approaches for quantifying CIE benefits and provided recommendations for INL's consideration.

42 ENGINEERING↗

DOE OSTI2020

EVALUATING NUCLEAR SECURITY IMPLICATIONS OF THE SPLINTERNET

The internet, which for years has been viewed as a global online commons with standardized protocols but few regulations is, according to some experts, starting to mirror the contentious political and commercial contours of the physical world. Contributing to this is the rise in data breaches, cyber-enabled attacks on critical infrastructure, government surveillance operations, theft of intellectual property, manipulation of electoral processes, and perceived erosion of privacy, all of which are resulting in a growing skepticism that an open internet will naturally serve the best interests of users, communities, countries, and the global economy. In addition, the rapidly emerging and increasingly lucrative power of data has global superpowers scrambling to protect their informational sovereignty as an urgent matter of national security. Underscoring this urgency is the fact that, despite its global reach and cosmopolitan contributor base, internet infrastructure and governance of the World Wide Web remain largely under U.S. corporate auspices, which reinforces the perception of U.S. control. Whether fragmentation is politically, economically, or socially motivated, there appears to be a growing appetite for an internet that is partitioned and controlled at the national level. From “the Great Firewall of China” to the “Halal” internet of Iran, the trend towards a “Splinternet” has courts and governments embarking on what some call a "legal arms race" to impose a maze of national or regional rules, often conflicting, in the digital realm. The paper explores the emerging Splinternet phenomenon, analyses the implications of this trend on nuclear security, and identifies questions that present opportunities for future research.

Internet, Data Security, Cyber Security, Nuclear S↗

DOE OSTI2021

Analyzing the Effects of Cyberattacks on Distribution System State Estimation

Key components of power systems—such as energy management systems, automatic generation control, and state estimation—are under serious vulnerability from cyberattacks. Cyber threats in electric grids have increased significantly because of the increased interconnectivity of supervisory control and data acquisition systems and public network infrastructure. As the penetration level of distributed energy resources increases, it is imperative to employ system-monitoring techniques such as state estimation for the reliable operation of distribution systems. Recently, multiple methods have been developed that exploit the low rank property of distribution system state matrix and are robust to bad data, such as matrix completion. This paper analyzes the impact of various realistic cyberattack scenarios on matrix completion. Realistic cyberattack scenarios are converted into data corruption models that are used in an extensive simulation of a custom IEEE 123-bus system.

41 EE - Solar Energy Technologies Office (EE-4S)↗

DOE OSTI2024

Losing Control of Your Linear Network? Try Resilience Theory

Resilience of cyber-physical networks to unexpected failures is a critical need widely recognized across domains. For instance, power grids, telecommunication networks, transportation infrastructures, and water treatment systems have all been subject to disruptive malfunctions and catastrophic cyberattacks. Following such adverse events, we investigate scenarios where a node of a linear network suffers a loss of control authority over some of its actuators. These actuators are not following the controller's commands and are instead producing undesirable outputs. The repercussions of such a loss of control can propagate and destabilize the whole network despite the malfunction occurring at a single node. To assess system vulnerability, we establish resilience conditions for networks with a subsystem enduring a loss of control authority over some of its actuators. Furthermore, we quantify the destabilizing impact on the overall network when such a malfunction perturbs a nonresilient subsystem. We illustrate our resilience conditions on two academic examples, on an islanded microgrid and on the linearized IEEE 39-bus system.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2022

Hardware-Based Randomized Encoding for Sensor Authentication in Power Grid SCADA Systems

Supervisory Control and Data Acquisition (SCADA) systems are utilized extensively in critical power grid infrastructures. Modern SCADA systems have been proven to be susceptible to cyber-security attacks and require improved security primitives in order to prevent unwanted influence from an adversarial party. One section of weakness in the SCADA system is the integrity of field level sensors providing essential data for control decisions at a master station. In this paper we propose a lightweight hardware scheme providing inferred authentication for SCADA sensors by combining an analog to digital converter and a permutation generator as a single integrated circuit. Through this method we encode critical sensor data at the time of sensing, so that unencoded data is never stored in memory, increasing the difficulty of software attacks. We show through experimentation how our design stops both software and hardware false data injection attacks occurring at the field level of SCADA systems.

42 ENGINEERING↗

DOE OSTI2020

Agent-Based Coordination Scheme for PV Integration (ABC4PV)

Renewables and especially photovoltaics (PV) have benefitted significantly from a host of incentives and policies targeted toward enhanced integration and adoption of specific energy technologies. However, with the push to move forward into a subsidy-free market framework, behind-the-meter residential PV applications have generally struggled to retain their value (unlike utility scale and commercial projects) [1]. This project focused on developing control-theoretic solutions aimed at improving the integration and interaction of behind-the-meter residential PV with other distribution system assets (controllable and non-controllable) to enhance the integrated value of residential PV. To this end, a suite of decentralized control methodologies have been developed to enable effective coordination and control of behind-the-meter residential load customers’ PV, battery storage systems (BSS), controllable loads and other similar assets within a distribution feeder. This interaction aims at procuring energy savings and, thus, energy bill savings. The main source of savings is drawn from reducing the effect of demand charge pricing and is realized at the feeder level, assuming community level interaction and management among the aforementioned assets. Optimal control of the assets is implemented with a distributed optimization methodology, leveraging consensus-based algorithms. The results gathered from the optimal control simulations demonstrates that the savings can be duly achieved and the algorithm decision times (to dynamically control asset set points, for example) are fast. As for the overall efficiency of PV+BSS systems, to procure energy savings from curtailment of the demand charge pricing effects, the optimal control is set up so as to minimize the variance of the load for all customers, throughout a feeder and throughout time in a rolling horizon scheduling with model predictive control. The control takes into account inter-temporal electrochemical storage (battery) degradation costs: specifically, we have developed a long-term lifetime model for the BSS that weighs in the effect of the degradation factor in the dispatch formulations, thus, a considerable operating cost that affects energy decision making. The levelized cost of energy (LCOE – redefined for the purpose of quantifying asset integration effectiveness through the customers’ energy cost) is shown to be below the threshold set for the combined PV+BSS topology of $ 0.14/kWh for multiple cases of PV penetration all the way up to 50%, provided that a policy of shared ownership of and savings is in place. Further, the LCOE calculated for the case before the deployment PV+BSS systems is also achievable, i.e. the deployment of PV+BSS, if planned and scheduled optimally. will have no effect on customers’ energy costs. From the control methodology viewpoint, the developed consensus-based algorithms are shown to converge for a wide range of problem cases (spanning normal operating scenarios and contingencies), guaranteeing dispatch solutions under forecasting errors, communication break-downs and cyber-security attacks. The proposed control solutions are scalable and real-time implementable, with dispatch computations and device set-point updates converging in less than 2s in most practical instances of the above events.

14 SOLAR ENERGY↗

DOE OSTI2021

Software-defined Networking for Energy Delivery Systems (SDN4EDS): An Architectural Blueprint (Final Report)

This is the initial version of a reference for suppliers and energy companies of all sizes to deploy networks based on software-defined networking technology (SDN) to improve reliability, reduce cyber security attack surface, and facilitate mitigation of adversarial behavior. It is a living document and will progress over the life cycle of the Software-Defined Networking for Energy Delivery Systems (SDN4EDS) project. Version 2 of this report provides information on the Red Team tabletop assessment performed against the initial reference architecture. Version 3 of this report updates the reference architecture with lessons learned from the Red Team tabletop assessment, as well as provides additional details for the use cases. It also provides information on the decision process that could be used by an organization when considering deploying SDN in their environment. The final version of this report consolidates all the interim reports generated by the project into a final report. It also draws from PNNL’s experience in deploying SDN to make recommendations on how SDN could be deployed in a utility environment, and provides rationale for those decisions allowing individual utilities to make risk-based and knowledge-based decisions on how to best deploy SDN in their own environment

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2021

Software-defined Networking for Energy Delivery Systems (SDN4EDS): An Architectural Blueprint (Final Summary Report)

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2023

TF9 Dataset Analysis

Incident Overview: In the time between November 2, 2019 and November 11, 2019, WheelByte was plagued by breaches in security. These insecurities led to breaches in customer data, company data, and even the death of an employee, Matthew Swift. They have launched an investigation into the company’s computer systems in hopes to find the root cause. We have been provided with the following artifacts from WheelByte: memory images, disk images, network packet captures, and emails. We have found multiple cyber-system attacks against WheelByte. Our investigation lasted from July 13th - August 3rd, 2023. WheelByte allowed us to look at any and every file, and there were no restrictions on what we could or could not use in our investigation. By the end of our investigation, we have been able to deduce who is behind the attack, what they have done, and why they did it. A company that is closely related to WheelByte is called Slyde. Slyde sells electric scooters and it is known that the Chief Executive Officer (CEO) of Slyde, Kimberly Holmes, sees WheelByte as a threat to business, as Wheelbyte sells electric skateboards. We have been able to deduce that Slyde is likely behind many of the malicious attacks. We have seen exfiltration addresses to Slyde domains, along with other Slyde information within their malware. We can see lots of traffic to and from Slyde Internet Protocol (IP) addresses. This may be an attempt to cripple WheelByte’s productivity to remove Slyde’s competitor from the market.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2025

Integration and Validation of Multi-Layer Mitigation Strategies for Cyber Physical Systems Resilience (RD2C Capstone I Project) (Technical Report)

This project demonstrated the effectiveness of RD2C-developed, resilience-driven control strategies on high-fidelity system models with high penetrations of inverter-based resources, under the impacts of unexpected natural events and cyber-physical attacks. Controller performance and overall system resilience were quantified using data from a comprehensive suite of scenarios, and provided a clear understanding on how to operate and deploy these mitigation strategies.

42 ENGINEERING↗

DOE OSTI2022

Cyber-Physical Secure Observer-Based Corrective Control under Compromised Sensor Measurements

In this paper we introduce the objectives and design principles of corrective control under cyber-physical attacks. We propose two types of observer-based corrective control for both the open-loop stable and the open-loop unstable LTI systems. The basic idea of our corrective control design is to use the observer as the ground-truth during the attack, making the plant dynamics follow the observer behavior. This is the opposite to the no-attack-detected period in which the observer is designed to follow the plant dynamics. We show stability of the proposed control under compromised sensor measurements, and quantify the effects of the discrepancy between the observer and the plant. Numerical examples, with illustrations using microgrid energy dynamics, are presented to show benefits of the proposed corrective control.

Wu, Dan↗

DOE OSTI2023

Robust Decentralized Secondary Control Scheme for Inverter-based Power Networks

Inverter-dominated microgrids are quickly becoming a key building block of future power systems. They rely on centralized controllers that can provide reliability and resiliency in extreme events. Nonetheless, communication failures due to cyber-physical attacks or natural disasters can make autonomous operation of islanded microgrids challenging. This paper examines a unified decentralized secondary control scheme that is robust to inverter clock synchronization errors and can be seamlessly applied to grid-following or grid-forming control architectures. The proposed scheme overcomes the well-known stability problem that arises from parallel operation of local integral controllers. Theoretical guarantees for stability are provided along with criteria to appropriately tune the secondary control gains to achieve good frequency regulation performance while ensuring fair power sharing. The efficacy of our approach is demonstrated through simulations on a 5-bus microgrid with four grid-forming inverters.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2022

PAS: Privacy Algorithms in Systems

Today we face an explosion of data generation, ranging from health monitoring to national security infrastructure systems. More and more systems are connected to the Internet that collects data at regular time intervals. These systems share data and use machine learning methods for intelligent decisions, which resulted in numerous real-world applications (e.g., autonomous vehicles, recommendation systems, and heart-rate monitoring) that have benefited from it. However, these approaches are prone to identity thief and other privacy related cyber-security attacks. So, how can data privacy be protected efficiently in these scenarios? More dedicated efforts are needed to propose the integration of privacy techniques into existing systems and develop more advanced privacy techniques to address the complex challenges of multi-system connectivity and data fusion. Therefore, we have introduced Privacy Algorithms in Systems (PAS) at CIKM which provides a venue to gather academic researchers and industry researchers/practitioners to present their research in an effort to advance the frontier of this critical direction of privacy algorithms in systems.

Kotevska, Olivera↗

DOE OSTI2023

A dataset of cyber-induced mechanical faults on buildings with network and buildings data

We have collected data of cyber-induced mechanical faults on buildings using a simulation platform. A DOE reference building model was used for running the simulation under a Rogue device attack and collected the network data as well as the physical buildings data to better understand the impacts of cyber attacks on the building and help identify the source of the mechanical fault with the network data. Alfalfa is the tool used for simulating the DOE reference buildings and acts as an interface to the model for querying the status and providing input externally. The Building Automation System (BAS) is the centralized controller providing control commands to other BACnet devices on the network based on the building status received from Alfalfa. The BACnet devices like damper will listen for the control commands from BAS on the BACnet network and implement it. The attacker is the malicious actor on the network creating disruptions by placing cyber-attacks.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2024

Beyond Binary: Automated PLC Memory Forensics through RGB Image Analysis and Deep Learning

The introduction of Industry 4.0 and the evolution of industrial control systems (ICS) to adopt Internet-based technologies enhanced productivity, but have inadvertently increased their vulnerability to cyber-based malicious attacks. When an ICS system is compromised, security analysts need to identify the root cause quickly to start the recovery process and develop mitigation strategies to safeguard against future instances. Memory forensics is critical in the analysis process to ascertain what occurred. To date, approaches to analyze the persistent memory in ICS devices are limited, and almost nonexistent for volatile memory. This paper proposes an automated methodology, COMA, for PLC memory dump analysis using computer vision and deep learning techniques. Specifically, COMA converts the sequences of bytes in a PLC memory dump to RGB pixels and creates a deep learning model that learns the underlying patterns and features of pre-labeled forensic artifacts in images and segments them into distinct regions. COMA then uses the trained model to automatically segment new memory images and extract forensic artifacts. We evaluate COMA on a Schneider Electric Modicon M221 PLC involving two cyber-based attack scenarios: (i) code injection and (ii) code modification. The empirical results show that COMA can successfully detect attack artifacts in memory dumps in both scenarios.

Asmar Awad, Rima↗