SEARCH · Engineering Papers

Results for “Forensics”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 397 records · Page 22

All sources NASA NTRS DOE OSTI

DOE OSTI2022

VAC: A Software Approach to Resilient SCADA Automation

To better secure critical infrastructure, especially power systems, this paper introduces a virtual SCADA automation controller. The automation controller is a gateway into a power subsystem, making it a valuable target for cyber-attacks that could cut it off from the control center and cause a loss of view and control. To prevent this, the Virtual Automation Controller (VAC) is a backup device that mirrors the capabilities of the physical controller. It can communicate via Modbus and DNP3 and is containerized so it can be deployed on a variety of platforms. Furthermore, it utilizes software-defined networking to quickly disconnect a failed automation controller and preserve its state for forensics. The VAC gives system operators time to replace the failed controller and prevents dangerous and costly damage to power systems. The VAC is compared against the SEL 3505-3 RTAC and shown to have the necessary features to act as a failover controller.

Johnson, Jordan↗

DOE OSTI2022

Cyber Attack Sequences Generation for Electric Power Grid

Security assessment of cyber-physical energy systems (CPESs) such as the electric power grid is a critical operation to maintain availability, reliability, and quality of service in the presence of persistent threats from malicious cyber actors. Existing security assessment approaches such as penetration testing and red teaming rely on subject matter expert experience and forensic cyber analysis of historical events to perform realistic, threat-informed assessments of CPES defense. CPESs have a large attack surface because of the heterogeneity and complexity of underlying topology, devices, measurements, and vulnerabilities. The aforementioned approaches lead to partial coverage of the attack surface with a large set of unknown but possible exploits. There is a need to automate the CPES attack surface discovery and contextualize it for relevant, highly probable, real-world attack scenarios. We propose a methodology and framework to facilitate the discovery of the CPES attack surface. We present a multilayer attack graph with ranked attack sequences to describe CPES failure scenarios. We present a work-in-progress framework that lists key components to automate the attack modeling and sequence generation. We demonstrate the published National Electric Sector Cybersecurity Organization Resource CPES failure scenario to highlight the trustworthiness of generated attack sequences.

Dutta, Ashutosh↗

DOE OSTI2021

Characterization and differentiation of aluminum powders used in improvised explosive devices. Part 2: Micromorphometric method refinement and preliminary statistical analysis

Abstract Aluminum (Al) powder is commonly encountered in improvised explosive devices (IEDs) as a metallic fuel due to its availability and low cost. Although available commercially in powder form, amateur bomb‐makers also produce their own Al powder via simple methods found online. In order to provide investigative leads and forensic intelligence, it is important to evaluate not only the composition of homemade devices, but also to distinguish between the various forms of Al powder they contain. To achieve this goal, a method using automated microscopy in combination with statistical techniques has been demonstrated to have the potential to provide source discrimination and investigative leads in source attribution of Al powders in IEDs. The present research refined this method and investigated 59 industrially and amateurly produced Al powder sources with seven subsamples per source using two traditional linear discriminant analyses (LDA), one with a standard data split for training and testing, and another using leave‐one‐out cross‐validation. Averaging the classification accuracies for the two LDA‐based analyses, LDA has the ability to correctly classify 59.26%, 83.35%, and 80.69% of the samples based on their powder source, type, and production method, respectively. This classification accuracy represents a 3407%, 317%, and 61.38% increase in accuracy from random class assignment, respectively. Further, in most instances of incorrect data attribution to a particular source, the subsample has been misidentified with another sample of the same powder type or production method.

Ommen, Danica M.↗

DOE OSTI2023

Detection and confirmation of fentanyls in high clay‐content soil by electron ionization gas chromatography‐mass spectrometry

Abstract Detection of illicit drugs in the environment, particularly in soils, often suggests the present or past location of a clandestine production center for these substances. Thus, development of efficient methods for the analysis and detection of these chemicals is of paramount importance in the field of chemical forensics. In this work, a method involving the extraction and retrospective confirmation of fentanyl, acetylfentanyl, thiofentanyl, and acetylthiofentanyl using trichloroethoxycarbonylation chemistry in a high clay‐content soil is presented. The soil was spiked separately with each fentanyl at two concentrations (1 and 10 μg/g) and their extraction accomplished using ethyl acetate and aqueous NH 4 OH (pH ~ 11.4) with extraction recoveries ranging from ~56% to 82% for the high‐concentration (10 μg/g) samples while ranging from ~68% to 83% for the low‐concentration (1 μg/g) samples. After their extraction, residues containing each fentanyl were reacted with 2,2,2‐trichloroethoxycarbonyl chloride (Troc‐Cl) to generate two unique and predictable products from each opioid that can be used to retrospectively confirm their presence and identity using EI‐GC‐MS. The method's limit of detection (MDL/LOD) for Troc‐norfentanyl and Troc‐noracetylfentanyl were estimated to be 29.4 and 31.8 ng/mL in the organic extracts. In addition, the method's limit of quantitation for Troc‐norfentanyl and Troc‐noracetylfentanyl were determined to be 88.2 and 95.5 ng/mL, respectively. Collectively, the results presented herein strengthen the use of chloroformate chemistry as an additional chemical tool to confirm the presence of these highly toxic and lethal substances in the environment.

Valdez, Carlos A.↗

DOE OSTI2023

Practical benzylation of N,N -substituted ethanolamines related to chemical warfare agents for analysis and detection by Electron Ionization Gas Chromatography-Mass Spectrometry

The benzylation of three, low-molecular weight N,N-disubstituted ethanolamines related to chemical warfare agents (CWAs) to furnish derivatives with improved Gas Chromatography-Mass Spectrometry (GC-MS) profiles is described. Due to their low molecular weight and polar nature, N,N-disubstituted ethanolamines are notoriously difficult to detect by routine GC-MS analyses during Organisation for the Prohibition of Chemical Weapons (OPCW) proficiency tests (PTs), particularly in scenarios when they are present at low levels (~1-10 ppm) amidst more abundant interferences. Our studies revealed that the optimal derivatization conditions involved the treatment of the ethanolamine with benzyl bromide in the presence of an inorganic base (e.g., Na 2 CO 3 ) in dichloromethane at 55 °C for 2 hours. This optimized set of conditions were then successfully applied to the derivatization of N,N-dimethylethanolamine, N,N-diethylethanolamine and N,N-diisopropylethanolamine present separately at 1 and 10 μg/mL concentrations in a glycerol-rich matrix sample featured in the 48 th OPCW PT. The benzylated derivatives of the three ethanolamines possessed retention times long enough to clear the massive glycerol-containing matrix interferences. In conclusion, the protocol herein is introduced as an alternative method for derivatization of these CWA and pharmaceutically important species and should find broad applicability in laboratories where their routine forensic analysis is carried out.

37 INORGANIC, ORGANIC, PHYSICAL, AND ANALYTICAL CH↗

DOE OSTI2023

Spatially Resolved Characterisation of Low Mass Fraction Uranium Glass Working Reference Materials

Here, we present the results of a study to generate reference glasses that reflect an environment analogous to historic nuclear fallout samples of interest for post-detonation nuclear forensics. The glasses were generated by melting and then quenching SiO 2 , Al 2 O 3 and CaCO 3 powders. Two suites of glasses with three distinct U isotopic ratios were successfully made with enrichments in the 235 U isotope (~ natural [0.72%], ~ 53% and 94%), but the bulk elemental data showed heterogeneity (~ 10% RSD) with U mass fractions ranging from 331.47 to 373.63 μg g -1 . Spatially resolved U isotopic measurements were performed using three mass spectrometry techniques (secondary ion mass spectrometry-single stage accelerator mass spectrometry [SIMS-SSAMS], large geometry [LG] - SIMS, and laser ablation-inductively coupled plasma-mass spectrometry [LA-ICP-MS]) across five National Laboratories. The results showed good agreement with the bulk U isotopic data for the low, medium, and high U mass fractions. We conclude that despite elemental heterogeneity, these samples can serve as useful working reference materials for spatially resolved nuclear fallout analyses, as well as for other related spatially resolved analyses.

36 MATERIALS SCIENCE↗

DOE OSTI2024

Analysis of hydrogen and lithium isotopes using Laser-Induced Breakdown Spectroscopy

The detection and quantification of hydrogen (1,2,3H) and lithium (6,7Li) isotopes are critical to several energy and defense application areas, including hydrogen storage, nuclear forensics, and safeguards/non-proliferation. In this context, laser-induced breakdown spectroscopy (LIBS) is very promising and it comes with certain advantages such as rapid detection, and standoff capability. Although LIBS provides experimental simplicity and is capable of detecting all elements in the periodic table in any phase (solid, liquid, or gas), there exist certain challenges for isotopic analyses of H and Li due to spectral broadening, the presence of closely spaced fine and hyperfine structures, and line distortion effects (e.g., self-absorption and self-reversal) present in laser-produced plasmas. This article reports recent developments in H and Li isotopic analysis using LIBS, and existing challenges.

(020.3260) Isotope shifts, (140.3440) Laser-induce↗

DOE OSTI2025

Automated nuclear cloud feature extraction from film

Chemical, biological, radiological, nuclear, and explosives incidents require rapid detection and characterization for appropriate response. For a nuclear detonation, visible-light cameras may be used to locate the cloud and characterize fallout deposition when coupled with numerical models. Films from the United States’ nuclear testing era compose the only sizeable collection of imagery depicting high-yield detonations. These films offer unique insights into characteristics of flows involving scales that are difficult to replicate experimentally, and they are a valuable source of data for the validation of models for nuclear fallout transport, either as part of emergency response or forensic activities. In this work, we implement modern computer vision and machine learning techniques to identify and track the cloud automatically and subsequently determine the time dependence of some of its features. We trained a ResNet-18 image classifier on hundreds of images to categorize nuclear cloud morphology. Each category or cloud regime is determined by early cloud evolution and is associated to constitutive properties of the flow, such as distribution of vorticity. Next, we identified keypoint features using the KAZE algorithm and tracked these keypoints in the images, allowing us to determine the dimensions and velocities of the cloud across film frames. These measurements converted to real-world units provide valuable experimental data that can be used in the development and validation of nuclear cloud models. We compared the results of this method against manual cloud rise measurements from two different films. In one, our automated method accelerated the feature extraction process without sacrificing measurement accuracy.

Khristy, Joel [ORNL] (ORCID:0000000209963060)↗

DOE OSTI2026

Uncertainty quantification of fireball features extracted from nuclear test films using computer vision

Films from the US’s historic nuclear testing era comprise the only extensive collection of imagery depicting high-yield detonations. These films offer unique insights into the characteristics of flows occurring on scales that are difficult to replicate experimentally, and they are a valuable source of data for the validation of models used to describe nuclear detonations. In recent work, we implemented modern computer vision and machine learning techniques to extract features of the fireball following nuclear detonation. With a training dataset of fireball films, we fine-tuned a You Only Look Once 11 (YOLO11) model to detect and track the fireball. Applied to a video, the outer bounding box produced in each frame by YOLO11 is used as an input prompt to Meta’s Segment Anything Model 2 (SAM2), which is shown to accurately predict the boundary of the fireball over time with high resolution. These state-of-the-art computer vision foundation models exhibit impressive visual accuracy in their results but lack an output of values that robustly quantify uncertainty in scientific applications. In this paper, we develop procedures for uncertainty quantification of extracted fireball features. We outline the application of a parallel attention mechanism to calculate uncertainty ranges that complement and better pose model validation data. This higher quality fireball validation data may serve to improve prognostic models describing nuclear detonations in support of nuclear forensic and emergency response activities.

Khristy, Joel [ORNL] (ORCID:0000000209963060)↗

DOE OSTI2025

Addressing the dynamic nature of reference data: a new nucleotide database for robust metagenomic classification

Accurate metagenomic classification relies on comprehensive, up-to-date, and validated reference databases. While the NCBI BLAST Nucleotide (nt) database, encompassing a vast collection of sequences from all domains of life, represents an invaluable resource, its massive size—currently exceeding 10 12 nucleotides—and exponential growth pose significant challenges for researchers seeking to maintain current nt-based indices for metagenomic classification. Recognizing that no current nt-based indices exist for the widely used Centrifuge classifier, and the last public version currently available was released in 2018, we addressed this critical gap by leveraging advanced high-performance computing resources. We present new Centrifuge-compatible nt databases, meticulously constructed using a novel pipeline incorporating different quality control measures, including reference decontamination and filtering. These measures demonstrably reduce spurious classifications, as shown through our reanalysis of published metagenomic data where Plasmodium annotations were dramatically reduced using our decontaminated database, highlighting how database quality can significantly impact research conclusions. Through temporal comparisons, we also reveal how our approach minimizes inconsistencies in taxonomic assignments stemming from asynchronous updates between public sequence and taxonomy databases. These discrepancies are particularly evident in taxa such as Listeria monocytogenes and Naegleria fowleri, where classification accuracy varied significantly across database versions. These new databases, made available as pre-built Centrifuge indexes, respond to the need for an open, robust, nt-based pipeline for taxonomic classification in metagenomics. Applications such as environmental metagenomics, forensics, and clinical metagenomics, which require comprehensive taxonomic coverage, will benefit from this resource. Our work highlights the importance of treating reference databases as dynamic entities, subject to ongoing quality control and validation akin to software development best practices. This approach is crucial for ensuring accuracy and reliability of metagenomic analysis, especially as databases continue to expand in size and complexity.

59 BASIC BIOLOGICAL SCIENCES↗

DOE OSTI2023

Flow Injection Electrochemical Quartz Crystal Microbalance with ICP-OES Detection: Electroprecipitation and Stripping of Lanthanum and Neodymium in a Flow Cell

We used an improved version of our hyphenated analysis technique, flow injection electrochemical quartz crystal microbalance (EQCM) with inductively coupled optical emission spectroscopy, to investigate the electroprecipitation of lanthanum and neodymium from flowing solutions. The improved version has two independent flow injection circuits, allowing different conditions for electrochemical precipitation (pH=4.3 or 2.6) and quick stripping (2% HNO3) with EQCM mass detection and ICP-OES elemental analysis. Lanthanum or neodymium ions in a 500 uL sample were injected into a carrier stream and deposited onto an EQCM housed in a micro flow cell, owing to a localized high-pH layer. The deposits are subsequently stripped from the electrode using HNO3 and analyzed downstream using an ICP-OES. We found that using acidic solutions without supporting electrolyte leads to an increase of the amount of lanthanum detected by 4-fold. The enhanced deposition can be attributed to enhanced mass transfer by migration. Furthermore, we showed that by applying chronopotentiometry, we can detect a change in the hydrogen evolution reaction mechanism that enables the precipitation of lanthanides on the surface of the electrode. Understanding and enhancing the deposition of lanthanides is relevant for elemental or isotopic detection in nuclear forensics.

38 RADIATION CHEMISTRY, RADIOCHEMISTRY, AND NUCLEA↗

DOE OSTI2020

ENSIGN

ENSIGN is a data analytics software package offering a modern unsupervised machine learning solution for scalable discovery in Big Data. The analytics in ENSIGN are based on an advanced mathematical tool called tensor decomposition and they are optimized to run efficiently on a range of computing platforms (from small multicore Desktop platforms to large Supercomputing clusters and novel high-end memory-driven computing platforms such as HPE Superdome Flex). ENSIGN enables the user to extract deep insights from the entirety of massive-scale (100s of Gigabytes or Terabytes scale) multidimensional data. ENSIGN uncovers latent patterns in data without the user having to specify or describe what the patterns are; the user, in the first place, may not even know such patterns existed and that they have to look for such patterns. The insights gained from ENSIGN could be trailheads that can be used as starting points for deeper forensic investigation.

Baskaran, Muthu↗

DOE OSTI2022

ENSIGN

Baskaran, Muthu↗

DOE OSTI2022

IViz-OT (Intrusion Detection Visualizer for Operational Technology Network) [SWR-22-63]

The Visualizer dashboard provides grid operator highly-trusted alarming environment for an ongoing or potential cyber-attack based on system anomalies and network-based verification. Once anomalies are detected by the IDS tool (HIDES, NREL SWR-19-65), this platform stores the signatures or alert logs that are generated by the intrusion detector, lays out the detailed summary of the possible alerts, and maps these attacks with high-level scenarios. These scenarios are later combined to define a final event using a decision tree approach and a final report is generated out of this tool for further forensic analysis. It also supports authentication and authorization to support roles-based access control (RBAC) for users and a group of people.

Singh, Vivek Kumar↗

DOE OSTI2024

Polyglot Framework

Polyglot utilizes a combination of custom and open source tools and libraries to provide developers with a consistent environment for building tools, etc. for a wide variety of targets with minimal changes to the code being built. It supports a variety of architectures and operating systems/firmware in as target-agnostic way as possible. This allows for developers to minimize the amount of time/effort required to port tools—in particular, forensic tools—to a wide variety of targets. The project is comprised of two main components: a frontend toolchain that understands how to utilize other tools in order to build code for a specific target, and a minimalistic C library specific to Polyglot. These collectively provide the method to build code for a specific target, and the capability for code to interact with the underlying operating system when run on the target. Both components are written in a way to minimize the amount of target-specific knowledge required to both develop and utilize the project.

Huddleston, TimothyA.↗

DOE OSTI2024

Polyglot C Library

The C library component of Polyglot. Polyglot utilizes a combination of custom and open source tools and libraries to provide developers with a consistent environment for building tools, etc. for a wide variety of targets with minimal changes to the code being built. It supports a variety of architectures and operating systems/firmware in as target-agnostic way as possible. This allows for developers to minimize the amount of time/effort required to port tools-in particular, forensic tools-to a wide variety of targets. The project is comprised of two main components: a frontend toolchain that understands how to utilize other tools in order to build code for a specific target, and a minimalistic C library specific to Polyglot. These collectively provide the method to build code for a specific target, and the capability for code to interact with the underlying operating system when run on the target. Both components are written in a way to minimize the amount of target-specific knowledge required to both develop and utilize the project.

Huddleston, TimothyA.↗

DOE OSTI2025

Blue Keanu: A Scientific Visualization Tool For Network Data

This software allows the user to visualize complex PCAP-ng files captured from network capture software such as Wireshark. The visualization runs in a GUI window that can be zoomed or moved to areas of interest in a waterfall type display. The user then can see an area of interest that looks different than the typical traffic visually, such as a human interaction or non-repetitive area of data. The program will tell the user the packet number and byte offset of interest for fast analysis of discrete atomic or non-random events. This is particularly useful for visualization of unknown binary format data, such as in PLC or SCADA protocols that may have human or other non-repetitive activity for further analysis, reverse engineering, or fast forensic analysis.

Durller, MichaelGeorge↗

DOE OSTI2023

Diffuse Reflectance Spectroscopy and Principal Component Analysis to Retrospectively Determine Production History of Plutonium Dioxide

Diffuse reflectance spectroscopy measurements in the shortwave infrared (930–1600 nm) spectral region were acquired for Pu 2 (C 2 O 4 ) 3 •9H 2 O and its thermal decomposition product, PuO 2 . We analyzed a total of eight PuO 2 samples that were produced at different calcination temperatures (300, 350, 450, 525, 600, 675, 750, and 900 °C). Our goal was to identify spectroscopic fingerprints that could be used to gain retrospective information regarding the production parameters of these important nuclear compounds. The diffuse reflectance spectrum of Pu 2 (C 2 O 4 ) 3 •9H 2 O features several broad bands that currently preclude detailed analysis. However, all PuO 2 samples produced relatively sharp spectral features that got sharper and more intense for samples that were produced at higher calcination temperatures. The electronic band observed at 1433 nm in the diffuse reflectance spectra of PuO 2 was found to be a sensitive indicator of crystallinity; a result that is corroborated by ancillary Raman spectroscopy measurements. Principal component analysis of diffuse reflectance spectra was able to clearly rank and categorize PuO 2 samples based on the calcination temperature that was employed during their production. Thus, we show herein that important retrospective information pertaining to the process history of PuO 2 can be gained through the relatively simplistic combination of diffuse reflectance spectroscopy and principal component analysis. This discovery presents a new method for determining the provenance and process history of PuO 2 and should have an impact in the fields of nuclear forensics and nuclear nonproliferation.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗