SEARCH · Engineering Papers

Results for “Cyber security”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 397 records · Page 22

All sources NASA NTRS DOE OSTI

DOE OSTI2021

DOE Fffice of Nuclear Energy cybersecurity research, development and demonstration program plan

This document describes the Cybersecurity Research Development and Demonstration (RD&D) Program, established by the Department of Energy Office of Nuclear Energy (NE) to provide sciencebased methods and technologies necessary for cost-effective, cyber-secure digital instrumentation, control and communication in collaboration with nuclear energy stakeholders. It provides an overview of program goals, objectives, linkages to organizational strategies, management structure, and stakeholder and cross-program interfaces.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2017

Current Capabilities at SNL for the Integration of Small Modular Reactors onto Smart Microgrids Using Sandia's Smart Microgrid Technology High Performance Computing and Advanced Manufacturing.

Smart grids are a crucial component for enabling the nation’s future energy needs, as part of a modernization effort led by the Department of Energy. Smart grids and smart microgrids are being considered in niche applications, and as part of a comprehensive energy strategy to help manage the nation’s growing energy demands, for critical infrastructures, military installations, small rural communities, and large populations with limited water supplies. As part of a far-reaching strategic initiative, Sandia National Laboratories (SNL) presents herein a unique, three-pronged approach to integrate small modular reactors (SMRs) into microgrids, with the goal of providing economically-competitive, reliable, and secure energy to meet the nation’s needs. SNL’s triad methodology involves an innovative blend of smart microgrid technology, high performance computing (HPC), and advanced manufacturing (AM). In this report, Sandia’s current capabilities in those areas are summarized, as well as paths forward that will enable DOE to achieve its energy goals. In the area of smart grid/microgrid technology, Sandia’s current computational capabilities can model the entire grid, including temporal aspects and cyber security issues. Our tools include system development, integration, testing and evaluation, monitoring, and sustainment.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2022

Epistemology of voltage control in DER-rich power system

Despite the recent development of several scalable, robust, and resilient control approaches with superior convergence properties considering an increasing penetration of distributed energy resources (DERs), cognitive oversights often simplify several aspects of the cyber–physical power system in the controller development. Here, following the identification of the limitations of classical controller definitions, we justify alternative definitions of voltage control approaches classifiers considering three inter-disciplinary domains: (i) power system, (ii) optimization and decision-making, and (iii) networking and cyber-security, to develop a taxonomy for helping in real-world comparative performance analysis and deployability of these controllers. We observe that classical and introduced domain-based definitions together can better classify the control algorithms.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2014

Secure Interoperable Open Smart Grid Demonstration Project

The Consolidated Edison, Inc., of New York (Con Edison) Secure Interoperable Open Smart Grid Demonstration Project (SGDP), sponsored by the United States (US) Department of Energy (DOE), demonstrated that the reliability, efficiency, and flexibility of the grid can be improved through a combination of enhanced monitoring and control capabilities using systems and resources that interoperate within a secure services framework. The project demonstrated the capability to shift, balance, and reduce load where and when needed in response to system contingencies or emergencies by leveraging controllable field assets. The range of field assets includes curtailable customer loads, distributed generation (DG), battery storage, electric vehicle (EV) charging stations, building management systems (BMS), home area networks (HANs), high-voltage monitoring, and advanced metering infrastructure (AMI). The SGDP enables the seamless integration and control of these field assets through a common, cyber-secure, interoperable control platform, which integrates a number of existing legacy control and data systems, as well as new smart grid (SG) systems and applications. By integrating advanced technologies for monitoring and control, the SGDP helps target and reduce peak load growth, improves the reliability and efficiency of Con Edison’s grid, and increases the ability to accommodate the growing use of distributed resources. Con Edison is dedicated to lowering costs, improving reliability and customer service, and reducing its impact on the environment for its customers. These objectives also align with the policy objectives of New York State as a whole. To help meet these objectives, Con Edison’s long-term vision for the distribution grid relies on the successful integration and control of a growing penetration of distributed resources, including demand response (DR) resources, battery storage units, and DG. For example, Con Edison is expecting significant long-term growth of DG. The SGDP enables the efficient, flexible integration of these disparate resources and lays the architectural foundations for future scalability. Con Edison assembled an SGDP team of more than 16 different project partners, including technology vendors, and participating organizations, and the Con Edison team provided overall guidance and project management. Project team members are listed in Table 1-1.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗

DOE OSTI2020

Artificial Intelligence for Digital Security and Protections

Proper functioning of nuclear power plants relies on a mix of well-regulated human and machine-driven workflows. This regulation supports nuclear safety through a series of processes and many of the tasks that support these processes have a repetitive nature that make artificial intelligence (AI) informed by machine learning (ML) a potential aid in a variety of tasks. AI is being evaluated for activities that include inspections, fuel processing, monitoring, and other activities. The introduction of any new technology presents a potential new attack vector. In the case of AI/ML, there are many attacks that have already been discovered and over time the attacks can be expected to follow the growth pattern observed in cyber security. While future planning is necessary, current efforts need to be established now to predict the threat emergence over the next year 10 years and mitigate potential threats. Based on these observations, AI/ML will need to become trustworthy, which corresponds to techniques and procedures that emphasize AI explainability along with resilience techniques to data, algorithms, models, and systems. This kind of system robustness is the foundation for defenses against AI/ML-specific attacks. Attempting to look forward and take a broad view of capabilities provides input to research roadmaps and the ability to distill vulnerabilities into specific use cases may provide greater assistance in understanding the technology benefits while introducing new risks. The impact of current and future AI in three areas—capabilities, challenges, and recovery strategies—represents an initial attempt at balancing both.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

DOE OSTI2019

Secure Software Defined Radio Project: Secure Wireless Systems for the Energy Sector (Briefing 6)

Strong industry interest in the SEL-FLT/FLR products has led to a large number of customers conducting various lab and field trial evaluations of the system. These trials are on-going but have allowed SEL to collect enough information about operation and deployment and security capabilities of the system to conclude the field demo phase of the project. The field-testing topical report has been completed and submitted. SEL has also prepared a SEL-FLT/FLR best practices guide based on learnings from the field demo phase of the project. This best practice guide has also been submitted. The final deliverable from this phase of the project is an economic and operational benefits white paper, which has also been written and submitted. The overall objective of the project, extending the cyber security capabilities of utility wired networks into last mile wireless networks has been successfully achieved. SEL chose to target a sensor network for implementation of this capability because it was one area of last mile networking where there was substantial need and opportunity. Based on customer interest in the product these efforts have been a success. Interest in, and support for many of the security features of the product has been expressed by customers trialing the product system. Key security features customers value are strong data encryption, sensor white listing, and use of secure account based log on for access to the system. These and other features of the product have gained strong acceptance from customers interested in purchasing these products. All project deliverables and tasks are now complete, and the project can be closed out.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2018

VULCON: A System for Vulnerability Prioritization, Mitigation, and Management

Vulnerability remediation is a critical task in operational software and network security management. In this paper, an effective vulnerability management strategy, called VULCON (VULnerability CONtrol), is developed and evaluated. The strategy is based on two fundamental performance metrics: i). Time-to-Vulnerability Remediation (TVR) and; ii). Total Vulnerability Exposure (TVE). VULCON takes as input real vulnerability scan reports, metadata about the discovered vulnerabilities, asset criticality, and personnel resources. VULCON uses a mixed integer multi-objective optimization algorithm to prioritize vulnerabilities for patching, such that the above performance metrics are optimized subject to the given resource constraints. VULCON has been tested on multiple months of real scan data from a Cyber-Security Operations Center (CSOC). Results indicate an overall Total Vulnerability Exposure reduction of 8.97\% when VULCON optimizes a realistic security analyst workforce's effort. Additionally, it is demonstrated that VULCON can determine monthly resources required to maintain a target TVE score. As such, VULCON provides valuable operational guidance for improving vulnerability response processes in CSOCs.

Farris, Katheryn A.↗

DOE OSTI2018

Recurrent Neural Network Language Models for Open Vocabulary Event-Level Cyber Anomaly Detection

Automated analysis methods are crucial aids for monitoring and defending a network to protect the sensitive or confidential data it hosts. This work introduces a flexible, powerful, and unsupervised approach to detecting anomalous behavior in computer and network logs; one that largely eliminates domain-dependent feature engineering employed by existing methods. By treating system logs as threads of interleaved ``sentences'' (event log lines) to train online unsupervised neural network language models, our approach provides an adaptive model of normal network behavior. We compare the effectiveness of both standard and bidirectional recurrent neural network language models at detecting malicious activity within network log data. Extending these models, we introduce a tiered recurrent architecture, which provides context by modeling sequences of users' actions over time. Compared to isolation forests and Principal Components Analysis (PCA), two popular anomaly detection algorithms, we observe superior performance on the Los Alamos National Laboratory Cyber Security dataset. For log-line-level predictions, our best performing character-based model provides test set anomaly scores ranking red team events in the 98th percentile on average, and yields 0.97 area under the receiver operator characteristic curve, demonstrating the strong fine-grained anomaly detection performance of this approach on open vocabulary logging sources.

Cyber Analysis, Deep Learning, language analysis, ↗

DOE OSTI2017

Automating Network Node Behavior Characterization by Mining Communication Patterns

Enterprise networks of scale are complex, dynamic computing environments that respond to evolv- ing business objectives and requirements. Characteriz- ing system behaviors in these environments is essential for network management and cyber security operations. Characterization of system’s communication is typical and is supported using network flow information (NetFlow). Related work has characterized behavior using theoretical graph metrics; results are often difficult to interpret by enterprise staff. We propose a different approach, where flow information is mapped to sets of tags that contextualize the data in terms of network principals and enterprise concepts. Frequent patterns are then extracted and are expressed as behaviors. Behaviors can be com- pared, identifying systems expressing similar behaviors. We evaluate the approach using flow information collected by a third party.

cyber system modeling↗

DOE OSTI2017

On the Adaptive Protection of Microgrids: A Review on How to Mitigate Cyber Attacks and Communication Failures

One main challenge in the practical implementation of a microgrid is the design of an adequate protection scheme in both grid connected and islanded modes. Conventional overcurrent protection schemes face selectivity and sensitivity issues during grid and microgrid faults since the fault current level is different in both cases for the same relay. Various approaches have been implemented in the past to deal with this problem, yet the most promising ones are the implementation of adaptive protection techniques abiding by the IEC 61850 communication standard. This paper presents a critical review of existing adaptive protection schemes, the technical challenges for the use of classical protection techniques and the need for an adaptive, smart protection system. However, the risk of communication link failures and cyber security threats still remain a challenge in implementing a reliable adaptive protection scheme. A contingency is needed where a communication issue prevents the relay from adjusting to a lower current level during islanded mode. An adaptive protection scheme is proposed that utilizes energy storage (ES) and hybrid ES (HESS) already available in the network as a mechanism to source the higher fault current. Four common grid ES and HESS are reviewed for their suitability in feeding the fault while some solutions are proposed.

25 ENERGY STORAGE↗

DOE OSTI2017

Implementation of wireless technologies in nuclear power plants' electromagnetic environment using cognitive radio system - 153

Wireless technologies have increased efficiency in many industrial settings across the world by enabling a mobile workforce and improving communications. Unfortunately, the nuclear power industry has been slow to adopt wireless technology as a result of safety, security, and reliability concerns expressed by regulators and others. A Research and Development (R and D) effort is currently being conducted to address two significant technical concerns for the introduction of wireless technology in nuclear power plants, which are electromagnetic compatibility (EMC) and wireless coexistence. Most equipment in nuclear power plants has never been tested for vulnerability to wireless transmission. As such, the impact of modern wireless devices on nuclear safety and plant reliability is not understood. Existing guidance from the Nuclear Regulatory Commission (NRC) and Electric Power Research Institute (EPRI) rely on the use of exclusion zones to protect plant equipment, which can result in exclusion zones of up to eight feet for some tablet devices rendering them ineffective for the mobile workforce. Another unknown is how different wireless devices will operate in close proximity to one another in the harsh electromagnetic environment of a nuclear power plant. These issues are being addressed through development of a cognitive radio system that has the ability to generate and output multiple wireless signals such as Wi-Fi, Bluetooth, and cellular communications at varying power levels and frequencies. The cognitive radio system is a modular system that can test nuclear plant equipment located in training areas, simulators, and the actual plant environment. In addition to using the system for testing plant equipment to wireless signals and EMC standards, the system can also monitor the radio spectrum for usage in other plant focuses such as cyber security. The R and D work will provide the objective guidance for the nuclear industry in the two areas mentioned and will develop a cognitive radio system for in-plant EMC and coexistence testing. The system will assist in the seamless use of wireless technology in nuclear power plants while greatly reducing the risks wireless signals may introduce. (authors)

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

DOE OSTI2015

Dominion. A game exploring information exploitation

FlipIt is a game theoretic framework published in 2012[1] to investigate optimal strategies for managing security resources in response to Advanced Persistent Threats. It is a two-player game wherein a resource is controlled by exactly one player at any time. A player may move at any time to capture the resource, incurring a move cost, and is informed of the last time their opponent has moved only upon completing their move. Thus, moves may be wasted and takeover is considered \stealthy", with regard to the other player. The game is played for an unlimited period of time, and the goal of each player is to maximize the amount of time they are in control of the resource minus their total move cost, normalized by the current length of play. Marten Van Dijk and others[1] provided an analysis of various player strategies and proved optimal results for certain subclasses of players. We extend their work by providing a reformulation of the original game, wherein the optimal player strategies can be solved exactly, rather than only for certain subclasses. We call this reformulation Dominion, and place it within a broader framework of stealthy move games. We de ne Dominion to occur over a nite time scale (from 0 to 1), and give each player a certain number of moves to make within the time frame. Their expected score in this new scenario is the expected amount of time they have control, and the point of the game is to dominate as much of the unit interval as possible. We show how Dominion can be treated as a two player, simultaneous, constant sum, unit square game, where the gradient of the bene t curves for the players are linear and possibly discontinuous. We derive Nash equilibria for a basic version of Dominion, and then further explore the roles of information asymmetry in its variants. We extend these results to FlipIt and other cyber security applications.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2023

Enhancing Early Systems R&D Capabilities with Systems —Theoretic Process Analysis

Systems engineering today faces a wide array of challenges, ranging from new operational environments to disruptive technological — necessitating approaches to improve research and development (R&D) efforts. Yet, emphasizing the Aristotelian argument that the “whole is greater than the sum of its parts” seems to offer a conceptual foundation creating new R&D solutions. Invoking systems theoretic concepts of emergence and hierarchy and analytic characteristics of traceability, rigor, and comprehensiveness is potentially beneficial for guiding R&D strategy and development to bridge the gap between theoretical problem spaces and engineering-based solutions. In response, this article describes systems–theoretic process analysis (STPA) as an example of one such approach to aid in early-systems R&D discussions. STPA—a ‘top-down’ process that abstracts real complex system operations into hierarchical control structures, functional control loops, and control actions—uses control loop logic to analyze how control actions (designed for desired system behaviors) may become violated and drive the complex system toward states of higher risk. By analyzing how needed controls are not provided (or out of sequence or stopped too soon) and unneeded controls are provided (or engaged too long), STPA can help early-system R&D discussions by exploring how requirements and desired actions interact to either mitigate or potentially increase states of risk that can lead to unacceptable losses. This article will demonstrate STPA's benefit for early-system R&D strategy and development discussion by describing such diverse use cases as cyber security, nuclear fuel transportation, and US electric grid performance. Together, the traceability, rigor, and comprehensiveness of STPA serve as useful tools for improving R&D strategy and development discussions. In conclusion, leveraging STPA as well as related systems engineering techniques can be helpful in early R&D planning and strategy development to better triangulate deeper theoretical meaning or evaluate empirical results to better inform systems engineering solutions.

42 ENGINEERING↗

DOE OSTI2017

Botnet behaviour analysis: How would a data analytics-based system with minimum a priori information perform?

Botnets, as one of the most aggressive threats, has used different techniques, topologies, and communication protocols in different stages of their lifecycle since 2003. Hence, identifying botnets has become very challenging specifically given that they can upgrade their methodology at any time. Various detection approaches have been proposed by the cyber-security researchers, focusing on different aspects of these threats. In this work, 5 different botnet detection approaches are investigated. These systems are selected based on the technique used and type of data used where 2 are public rule–based systems (BotHunter and Snort) and the other 3 use machine learning algorithm with different feature extraction methods (packet payload based and traffic flow based). On the other hand, 4 of these systems are based on a priori knowledge while one is using minimum a priori information. The objective here is to evaluate the effectiveness of these approaches under different scenarios (eg, multi-botnet and single-botnet classifications) as well as exploring how a system with minimum a priori information would perform. The goal is to investigate if a system with minimum a priori information could result in a competitive performance compared to systems using a priori knowledge. The evaluation is shown on 24 publicly available botnet data sets. Results indicate that a machine learning–based system with minimum a priori information not only achieves a very high performance but also generalizes much better than the other systems evaluated on a wide range of botnet structures (from centralized to decentralized botnets).

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2023

Topological Analysis of Temporal Hypergraphs

In this work we study the topological properties of temporal hypergraphs. Hypergraphs provide a higher dimensional generalization of a graph that is capable of capturing multi-way connections. As such, they have become an integral part of network science. A common use of hypergraphs is to model events as hyperedges in which the event can involve many elements as nodes. This provides a more complete picture of the event in comparison to the standard dyadic connection limitation of a graph. However, a common attribution to events is temporal information as an interval for when the event occurred. Consequently, a temporal hypergraph is born which accurately captures both the temporal information of events as well as their multi-way connections. Common tools for studying these temporal hypergraphs typically use summary statistics of snapshots from a sliding window procedure to capture changes in the underlying dynamics. However, these do not provide insight into how the changing structure of the hypergraph evolves and which components of the temporal hypergraph persist and are influential to the underlying system. To alleviate this need we leverage zigzag persistence from the field of Topological Data Analysis (TDA) to study the change in topological structure of time-evolving hypergraphs. We apply our pipeline to both a cyber security and social network dataset and show how the topological structure of their temporal hypergraphs change and can be used to understand the underlying dynamics.

hypergraphs, topological data analysis, zigzag per↗

DOE OSTI2014

NSTX-U Control System Upgrades

The National Spherical Tokamak Experiment (NSTX) is undergoing a wealth of upgrades (NSTX-U). These upgrades, especially including an elongated pulse length, require broad changes to the control system that has served NSTX well. A new fiber serial Front Panel Data Port input and output (I/O) stream will supersede the aging copper parallel version. Driver support for the new I/O and cyber security concerns require updating the operating system from Redhat Enterprise Linux (RHEL) v4 to RedHawk (based on RHEL) v6. While the basic control system continues to use the General Atomics Plasma Control System (GA PCS), the effort to forward port the entire software package to run under 64-bit Linux instead of 32-bit Linux included PCS modifications subsequently shared with GA and other PCS users. Software updates focused on three key areas: (1) code modernization through coding standards (C99/C11), (2) code portability and maintainability through use of the GA PCS code generator, and (3) support of 64-bit platforms. Central to the control system upgrade is the use of a complete real time (RT) Linux platform provided by Concurrent Computer Corporation, consisting of a computer (iHawk), an operating system and drivers (RedHawk), and RT tools (NightStar). Strong vendor support coupled with an extensive RT toolset influenced this decision. The new real-time Linux platform, I/O, and software engineering will foster enhanced capability and performance for NSTX-U plasma control.

70 PLASMA PHYSICS AND FUSION TECHNOLOGY↗

DOE OSTI2018

Framework for Shared Drinking Water Risk Assessment

Risk assessment plays a vital role in protecting our nation's critical infrastructure. Traditionally, such assessments have been conducted as a singular activity confined to the boarders of a particular asset or utility with little external sharing of information. In contrast other domains, e.g., disaster preparedness, cyber security, food-borne hazards, have demonstrated the benefits of sharing data, experiences and lessons learned in assessing and managing risk. Here we explore the concept of a Shared Risk Framework (SRF) in the context of critical infrastructure assessments. In this exploration, key elements of an SRF are introduced and initial instantiations demonstrated by way of three water utility assessments. Results from these three demonstrations were then combined with results from four other risk assessments developed using a different risk assessment application by a different set of analysts. Through this comparison we were able to explore potential challenges and benefits from implementation of a SRF. Challenges included both the capacity and interest of local utilities to conduct a shared risk assessment; particularly, wide scale adoption of any SRF will require a clear demonstration that such an effort supports the basic mission of the utility, adds benefit to the utility, and protects utility data from unintended access or misuse. In terms of benefits, anonymous sharing of results among utilities could provide the added benefits of recognizing and correcting bias; identifying ‘unknown, unknowns’; assisting self-assessment and benchmarking for the local utility; and providing a basis for treating shared assets and/or threats across multiple utilities.

60 APPLIED LIFE SCIENCES↗

DOE OSTI2014

Scaling Graph Community Detection on the Tilera Many-core Architecture

In an era when power constraints and data movement are proving to be significant barriers for the application of high-end computing, the Tilera many-core architecture offers a low-power platform exhibiting many important characteristics of future systems, including a large number of simple cores, a sophisticated network-on-chip, and fine-grained control over memory and caching policies. While this emerging architecture has been previously studied for structured compute-intensive kernels, benchmarking the platform for data-bound, irregular applications present significant challenges that have remained unexplored. Community detection is an advanced prototypical graph-theoretic operation with applications in numerous scientific domains including life sciences, cyber security, and power systems. In this work, we explore multiple design strategies toward developing a scalable tool for community detection on the Tilera platform. Using several memory layout and work scheduling techniques we demonstrate speedups of up to 46x on 36 cores of the Tilera TileGX36 platform over the best serial implementation, and also show results that have comparable quality and performance to mainstream x86 platforms. To the best of our knowledge this is the first work addressing graph algorithms on the Tilera platform. This study demonstrates that through careful design space exploration, low-power many-core platforms like Tilera can be effectively exploited for graph algorithms that that embody all the essential characteristics of an irregular application.

community detection↗