SEARCH · Engineering Papers

Results for “attack detection”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 397 records · Page 22

All sources NASA NTRS DOE OSTI

DOE OSTI2023

Quantum Lock Technologies: Innovation Crossroads Final Report

At Quantum Lock Technologies, our mission is to use future-proof hardware and software to bridge the gap between physical access control and cyber security. Physical security includes access to doors, lockboxes/containers, and machinery/robots. Connecting physical access control to the cloud allows for remote detection, fast ledger updates, and mobile or remote access. However, this also opens physical security up to the world of cyber-attacks. At Quantum Lock, we use quantum random number generation to generate completely random and unpredictable digital keys to be used by connected equipment in a facility. This quantum technology is then paired with end-to-end encryption and a one-time-key communication protocol to ensure the highest level of security. Through the Innovation Crossroads program at Oak Ridge National Laboratory, we have developed benchtop prototypes of our technology, connected with utility boards as our first target customers, and prepared for our first pilot with customers (target end of summer 2022). Below is a photograph of myself at an energy substation where we plan to eventually apply our technology.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

DOE OSTI2023

Quantum Lock Technologies: Innovation Crossroads Final CRADA Report

42 ENGINEERING↗

DOE OSTI2020

A data analytical approach for assessing the efficacy of Operational Technology active defenses against insider threats

In recent years, the need for Operational Technology (OT) defenses has been recognized, serving as an additional line of defense when Information Technology (IT) defenses are bypassed. This is no longer considered an uncommon possibility when dealing with advanced persistent threat (APT) actors expected to be state-sponsored and receiving insider assistance. In these extreme adversarial situations, OT defenses aim to provide another layer of defense for the system, introduced directly at the physical process level, as described by the sensors data, the system model, and control actions. Just like IT defenses, two schools of thought, i.e., passive and active defenses, have emerged to address this challenge. In active defenses, representing the focus of this paper, known signatures, synthesized based on the system's unique characteristics, are inserted into the system. In contradistinction, passive methods rely solely on observing system behavior in search of patterns of normal behavior with deviations thereof representing abnormal behavior. In their most sophisticated implementations, both passive and active defenses rely on the use of data analytics to identify the patterns and synthesize the observed and/or inserted signatures. Past research has shown that passive defenses may be bypassed by APT actors relying on data analytics and their intimate knowledge of the system to evade detection by respecting the patterns identified by the defenders. Here this manuscript explores the use of active defenses under the assumption that the attacker has privileged access to the system, including access to the system's model and sensors data. Specifically, this manuscript assesses the ability of active defenses to remain invisible to the attackers, and discusses the associated challenges that must be addressed to ensure their resiliency against APT actors.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗

NASA NTRS1977

F-8C adaptive flight control extensions

An adaptive concept which combines gain-scheduled control laws with explicit maximum likelihood estimation (MLE) identification to provide the scheduling values is described. The MLE algorithm was improved by incorporating attitude data, estimating gust statistics for setting filter gains, and improving parameter tracking during changing flight conditions. A lateral MLE algorithm was designed to improve true air speed and angle of attack estimates during lateral maneuvers. Relationships between the pitch axis sensors inherent in the MLE design were examined and used for sensor failure detection. Design details and simulation performance are presented for each of the three areas investigated.

Stein, G.↗

NASA NTRS1991

Catalysis of hydrolysis and nucleophilic substitution at the P-N bond of phosphoimidazolide-activated nucleotides in phosphate buffers

Phosphoimidazolide-activated derivatives of guanosine and cytidine 5'-monophosphates, henceforth called ImpN's, exhibit enhanced rates of degradation in the presence of aqueous inorganic phosphate in the range 4.0 < or = pH < or = 8.6. This degradation is been attributed to (i) nucleophilic substitution of the imidazolide and (ii) catalysis of the P-N bond hydrolysis by phosphate. The first reaction results in the formation of nucleoside 5'-diphosphate and the second in nucleoside 5'-monophosphate. Analysis of the observed rates as well as the product ratios as a function of pH and phosphate concentration allow distinction between various mechanistic possibilities. The results show that both H2PO4- and HPO4(2-) participate in both hydrolysis and nucleophilic substitution. Statistically corrected biomolecular rate constants indicate that the dianion is 4 times more effective as a general base than the monoanion, and 8 times more effective as nucleophile. The low Bronsted value beta = 0.15 calculated for these phosphate species, presumed to act as general bases in facilitating water attack, is consistent with the fact that catalysis of the hydrolysis of the P-N bond in ImpN's has not been detected before. The beta nuc = 0.35 calculated for water, H2PO4-, HPO4(2-), and hydroxide acting as nucleophiles indicates a more associative transition state for nucleotidyl (O2POR- with R = nucleoside) transfers than that observed for phosphoryl (PO3(2-)) transfers (beta nuc = 0.25). With respect to the stability/reactivity of ImpN's under prebiotic conditions, our study shows that these materials would not suffer additional degradation due to inorganic phosphate, assuming the concentrations of phosphate, Pi, on prebiotic Earth were similar to those in the present oceans ([Pi] approximately 2.25 micromoles).

NASA Discipline Number 52-20↗

DOE OSTI2020

Data-driven model construction for industrial asset decision boundary classification

In some embodiments, a system model construction platform may receive, from a system node data store, system node data associated with an industrial asset. The system model construction platform may automatically construct a data-driven, dynamic system model for the industrial asset based on the received system node data. A synthetic attack platform may then inject at least one synthetic attack into the data-driven, dynamic system model to create, for each of a plurality of monitoring nodes, a series of synthetic attack monitoring node values over time that represent simulated attacked operation of the industrial asset. The synthetic attack platform may store, in a synthetic attack space data source, the series of synthetic attack monitoring node values over time that represent simulated attacked operation of the industrial asset. This information may then be used, for example, along with normal operational data to construct a threat detection model for the industrial asset.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2023

Reinforcement Learning Approach to Cybersecurity in Space (RELACSS)

Securing satellite groundstations against cyber-attacks is vital to national security missions. However, these cyber threats are constantly evolving. As vulnerabilities are discovered and patched, new vulnerabilities are discovered and exploited. In order to automate the process of discovering existing vulnerabilities and the means to exploit them, a reinforcement learning framework is presented in this report. We demonstrate that this framework can learn to successfully navigate an unknown network and detect nodes of interest despite the presence of a moving target defense. The agent then exfiltrates a file of interest from the node as quickly as possible. This framework also incorporates a defensive software agent that learns to impede the attacking agents progress. This setup allows for the agents to work against each other and improve their abilities. We anticipate that this capability will help uncover unforeseen vulnerabilities and the means to mitigate them. The modular nature of the framework enables users to swap out learning algorithms and modify the reward functions in order to adapt the learning tasks to various use cases and environments. Several algorithms, viz., tabular Q learning, deep Q networks, proximal policy optimization, advantage actor-critic, generative adversarial imitation learning, are explored for the agents and the results highlighted. The agent learns to solve the tasks in a light-weight abstract environment. Once the agent learns to perform sufficiently well, it can be deployed in a minimega virtual machine environment (or a real network) with wrappers that map abstract actions to software commands. The agent also uses a local representation of the actions called a ‘slot-mechanism’. This allows the agent to learn in a certain network and generalize it to different networks. The defensive agent learns to predict the actions taken by an offensive agent and uses that information to anticipate the threat. This information can then either be used to raise an alarm or to take actions to thwart the attack. We believe that with the appropriate reward design, a representative environment, and action set, this framework can be generalized to tackle other cybersecurity tasks. By sufficiently training these agents, we can anticipate vulnerabilities leading to robust future designs. We can also deploy automated defensive agents that can help secure satellite groundstation and their vital national security missions.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

NASA NTRS1989

Infrared imaging and tufts studies of boundary layer flow regimes on a NACA 0012 airfoil

A study of boundary-layer flow regimes on a NACA 0012 airfoil from zero angle of attack up to separation is presented. The boundary-layer transition from the laminar to the turbulent regime and the onset of the separation were detected by surface thermography of the airfoil performed with an infrared imaging system. The findings were compared with observations of aluminum-foil tufts visible with the infrared imaging system. This arrangement allows the infrared imaging system to assume the dual role of flow regime detection through surface thermography and flow visualization through the observation of the aluminum-foil tufts. Ultimately the temperature history on an uncontaminated surface could provide an interpretation of the state of boundary-layer flow. Separation studies performed on the NACA 0012 airfoil showed that aluminum foil tufts can be observed with infrared imaging systems.

Gartenberg, Ehud↗

NASA NTRS1996

A Structured Grid Based Solution-Adaptive Technique for Complex Separated Flows

The objective of this work was to enhance the predictive capability of widely used computational fluid dynamic (CFD) codes through the use of solution adaptive gridding. Most problems of engineering interest involve multi-block grids and widely disparate length scales. Hence, it is desirable that the adaptive grid feature detection algorithm be developed to recognize flow structures of different type as well as differing intensity, and adequately address scaling and normalization across blocks. In order to study the accuracy and efficiency improvements due to the grid adaptation, it is necessary to quantify grid size and distribution requirements as well as computational times of non-adapted solutions. Flow fields about launch vehicles of practical interest often involve supersonic freestream conditions at angle of attack exhibiting large scale separate vortical flow, vortex-vortex and vortex-surface interactions, separated shear layers and multiple shocks of different intensity. In this work, a weight function and an associated mesh redistribution procedure is presented which detects and resolves these features without user intervention. Particular emphasis has been placed upon accurate resolution of expansion regions and boundary layers. Flow past a wedge at Mach=2.0 is used to illustrate the enhanced detection capabilities of this newly developed weight function.

Thornburg, Hugh↗

DOE OSTI2024

Exploring Robust Features for Improving Adversarial Robustness

While deep neural networks (DNNs) have revolutionized many fields, their fragility to carefully designed adversarial attacks impedes the usage of DNNs in safety-critical applications. In this article, we strive to explore the robust features that are not affected by the adversarial perturbations, that is, invariant to the clean image and its adversarial examples (AEs), to improve the model’s adversarial robustness. Specifically, we propose a feature disentanglement model to segregate the robust features from nonrobust features and domain-specific features. Here, the extensive experiments on five widely used datasets with different attacks demonstrate that robust features obtained from our model improve the model’s adversarial robustness compared to the state-of-the-art approaches. Moreover, the trained domain discriminator is able to identify the domain-specific features from the clean images and AEs almost perfectly. This enables AE detection without incurring additional computational costs. With that, we can also specify different classifiers for clean images and AEs, thereby avoiding any drop in clean image accuracy.

97 MATHEMATICS AND COMPUTING↗

NASA NTRS1972

Analysis of flight data on boundary layer transition at high angles of attack

Boundary layer transition data were obtained on the flight of two cones which reentered at velocities of about 7.0 km/sec. One cone reentered at a nominal zero degree angle of attack and the other, due to an anomaly above the earth atmosphere, reentered at local angles of attack up to 7.0 km/sec. The transition data were obtained from on-board acoustic and electrostatic sensors. A description of the design, calibration, and method used to detect transition from the sensors is included. The flow field calculation used to obtain the local flow properties on the cones is described. Finally, the transition data found from both cone flights is correlated.

Haigh, W. W.↗

NASA NTRS2002

Boundary Layer Transition on Slender Cones in Conventional and Low Disturbance Mach 6 Wind Tunnels

An experimental investigation was conducted on a 5-degree half-angle cone and a 5-degree half-angle flared cone in a conventional Mach 6 wind tunnel to examine the effects of facility noise on boundary layer transition. The influence of tunnel noise was inferred by comparing transition onset locations determined from the present test to that previously obtained in a Mach 6 low disturbance quiet tunnel. Together, the two sets of experiments are believed to represent the first direct comparison of transition onset between a conventional and a low disturbance wind tunnel using a common test model and transition detection technique. In the present conventional hypersonic tunnel experiment, separate measurements of heat transfer and adiabatic wall temperatures were obtained on the conical models at small angles of attack over a range of Reynolds numbers, which resulted in laminar, transitional, and turbulent flow. Smooth model turbulent heating distributions are compared to that obtained with transition forced via discrete surface roughness. The model nosetip radius was varied to examine the effects of bluntness on transition onset. Despite wall to total temperature differences between the transient heating measurements and the adiabatic wall temperature measurement, the two methods for determining sharp cone transition onset generally yielded equivalent locations. In the 'noisy' mode of the hypersonic low disturbance tunnel, transition onset occurred earlier than that measured in the conventional hypersonic tunnel, suggesting higher levels of freestream acoustic radiation relative to the conventional tunnel. At comparable freestream conditions, the transition onset Reynolds number under low disturbance conditions was a factor of 1.3 greater than that measured on flared cone in the LaRC conventional hypersonic tunnel and a factor of 1.6 greater that the flared cone run in the low disturbance tunnel run 'noisy'. Navier-Stokes mean flow computations and linear stability analysis were conducted to assess the experimental results and have indicated N factors associated with sharp flared cone transition onset to be approximately a factor of 2 lower than that inferred from the corresponding low disturbance tunnel measurements.

Horvath, Thomas J.↗

DOE OSTI2023

Flexible visualization of a 3rd party Intrusion Prevention (Security) tool: A use case with the ELK stack

A difficult aspect of cyber security is the ability to achieve automated real time intrusion prevention across various sets of systems. To this extent, several companies are offering comprehensive solutions that leverage an "accuracy of scale" and moving much of the intelligence and detection on the Cloud, relying on an ever-growing set of data and analytics to increase decision accuracy. Often, they provide tools to visualize the decision workflows in attack prevention (as well as tune the algorithm) but those solutions are not always practical as companies see the problem as "global" that is, from a unified Cyber-security standpoint. However, a key to a successful Cyber-security program is transparency and trust: from an experimental team viewpoint, this specifically means having the ability to immediately see what and from where, who has been blocked and being able to inform the community in case of a revoked access without the need for filing a "ticket" (that may eventually be answered) – in other words, rapid response to their user-base is essential but solutions targeting "sub-groups" in an organization are not often available. We have come up with a versatile solution leveraging the ELK stack (Elasticsearch, Logstash, & Kibana) and an IPS (Intrusion Prevention System) based WAF (Web Application Firewall) from Signal Sciences. Signal Science allows the streaming of detailed logs in a Logstash format suitable for custom solutions for visualization. By combining these two tools, we have strengthened our security posture and enabled individual experiments to monitor their own traffic. Specifically, the IPS WAF provides unique data such as country of origin, protocol, response code, source IP, and paths accessed. In this contribution, we will show how we engineered a visualization solution so experiment groups could access a dashboard with predefined graphs but also, where they can create individual customizable dashboards used to display blocked traffic and troubleshoot latency issues. We will discuss the details and procedures for developing and configuring these tools and how it benefits cyber security postures across our scientific based environment.

73 NUCLEAR PHYSICS AND RADIATION PHYSICS↗

DOE OSTI2021

Self-Security for Grid-Interactive Smart Inverters Using Steady-State Reference Model

Smart inverters exchange information with other devices through a shared communication link, making the inverters more prone to receive harmful commands from external parties. This erroneous data can be received due to an anomaly in the system, such as a device fault, unintentional utility operator action, or a cyber-attack. In this paper, a device-level self-security strategy is implemented using reference models for a grid-interactive inverter to examine the incoming power setpoints, detect the anomalies, and protect the system accordingly. The PQ setpoints received from the utility supervisory controller are autonomously examined using the inverter’s normal and stable operating regions before engaging the setpoints to the inverter’s local controller. Grid parameters are estimated in real-time during the examination process. The efficacy of the self-security algorithm is tested using a three-phase 3-kVA SiC-MOSFET inverter and a 12-kW NHR 9410 regenerative grid emulator. The results verify that the proposed method can detect harmful PQ setpoints that can cause abnormal or unstable inverter operation.

Gursoy, Mehmetcan↗

DOE OSTI2024

Communication Network Layer State Estimation Measurement Model for a Cyber-Secure Smart Grid

Network communication has been proven to be a very important tool and a key factor in the recent development and progress of the power grid operation. It is also considered as the foundation for the smart grid because information and communication are integrated into electricity distribution to achieve reliable and accurate knowledge of the power grid. In previous years, absorbing energy from substations and delivering it to customers was the only type of interaction we knew between utility companies and customers. Presently, the growing connections of small distributed generation units caused by the cost reduction of most of the technologies used in generation and storage of electrical energy, along with the potential benefits of renewable energy have pushed many researchers to look into the improvement of information and communication technologies (ICT) in order to ensure a bidirectional flow of power and data. Moreover, the evolution of information and communication technologies and its applications to smart grid have converted the smart grid into a cyber-physical system where vulnerabilities and additional security challenges such as cyber-threats and cyber-attacks have emerged. Previously, we have demonstrated that using machine learning-based processing on data gathered from communication networks and the power grid was a promising solution for detecting cyber threats by implementing a co-simulation of cyber-security for cross-layer strategy. Since the majority of the challenges observed can only be solved in the network communication layer, we present in this work a physics-based state estimation model of the communication network system towards enhanced cyber-physical security of the smart grid. Information integration with the previously developed machine learning model is developed, providing a enhanced cyber-physical security application for the smart grid. Easy-to-implement model, without hard-to-derive parameters, highlight potential aspects of the model for real-life applications.

Mathieu, Reynold↗

NASA NTRS1987

Effect of alloy composition on the sodium-sulfate induced hot corrosion attack of cast nickel-base superalloys at 900 C

The effects of Cr, Al, Ti, Mo, Ta, Nb, and W content on the hot corrosion of Ni-base alloys were examined experimentally. The superalloys were tested for 300 1-hr cycles at 900 C in a Mach 0.3 burner rig flame containing 0.5 ppmw sodium. The data reveal that the best corrosion resistance is obtained when the Cr content is greater than 12 percent; however, good resistance is detected in some alloys with Cr content less than 10 percent provided that the Al content is less than 2.5 wt pct and the Ti content is less than 4 wt pct. It is observed that the influence of W, Ta, Mo, and Nb content on resistance is dependent on Al and Ti contents. The derivation of an equation for estimating hot corrosion attack as a function of alloy composition using multiple linear regression analysis is described. The applicability of the equation is tested using various data sets of alloys. It is noted that the equation can be used to explain the effects of alloy composition on attack rates.

Stearns, C. A.↗

NASA NTRS1985

Radiative Amplification of Acoustic Waves in Hot Stars

The discovery of broad P Cygni profiles in early type stars and the detection of X-rays emitted from the envelopes of these stars made it clear, that a considerable amount of mechanical energy has to be present in massive stars. An attack on the problem, which has proven successful when applied to late type stars is proposed. It is possible that acoustic waves form out of random fluctuations, amplify by absorbing momentum from stellar radiation field, steepen into shock waves and dissipate. A stellar atmosphere was constructed, and sinusoidal small amplitude perturbations of specified Mach number and period at the inner boundary was introduced. The partial differential equations of hydrodynamics and the equations of radiation transfer for grey matter were solved numerically. The equation of motion was augmented by a term which describes the absorption of momentum from the radiation field in the continuum and in lines, including the Doppler effect and allows for the treatment of a large number of lines in the radiative acceleration term.

Wolf, B. E.↗

NASA NTRSDate not supplied

Clinical Decision Support - Concepts of Operation

We are entering a new era in space exploration to return to the moon and explore Mars. Crew members operating independently during long duration space exploration missions will require a clinical decision support system (CDSS) to increase autonomy by augmenting their knowledge, skills and abilities in different scenarios. Significant changes to in-flight and habitat medical care due to constraints on mass, volume, power, crew time and medical evacuation capabilities are needed to increase crew autonomy and self-reliance in decision making and task performance. The Exploration Medical Capability (ExMC) Element of the Human Research Program (HRP) pushes the boundary of space medical systems to advance the care of astronauts on future exploration missions beyond low Earth orbit by identifying and testing next-generation medical care and crew health maintenance technologies. Clinical decision support (CDS) presents knowledge and data in a context aware manner to augment a crew members’ knowledge, skills and abilities during the process of observation, orientation, decisions and action. A comprehensive crew health and performance CDSS is required to augment crew capability and will be used in different scenarios for several reasons. In general, the CDSS’s role is to assist the crew in prevention, detection, diagnosis and treatment of crew health and performance related conditions that may arise in exploration spaceflight. For example, CDSS would assist a high acuity scenario such as a heart attack by supplying clear instructions, vital signs and treatment reminders. A lower severity scenario such as kidney stone risk could interface to vehicle systems and display more complex predictive data during a diagnosis. A CDSS needs to contribute to successful missions by maintaining a high performing crew who can potentially exhibit countless medical conditions related to derangements from the space environment (sleep, cognition, nutrition and exercise) as well as conditions intrinsic to humans anywhere. While supporting the crew’s ability to make sound clinical decisions is desirable in any mission, it is essential for exploration missions with significant communication delays, no evacuation capability, and extended exposure to the flight environment. Such missions correspond with medical Level of Care V (LOC V), the highest level specified in NASA-STD-3001. The project focuses on CDS implementation research to derive requirements for LOC V, where the need for increased autonomy results in new practices and the inclusion of non-clinical data, such as vehicle environmental measures and physical exercise results, from other human and vehicle domains and advanced analytics. The CDS project describes how the CDSS is intended to be used by defining concepts of operations (ConOps). The process to derive ConOps focuses on increased autonomy that reduces the likelihood and consequences of accepted medical conditions. These crew health and performance inputs are grouped by common datasets and analysis models. Use cases are derived to research new clinical scenarios, architectural development and workflows. Implementation research is conducted with protypes to inform assumptions and derive requirements. The project also establishes how externally developed analysis and approaches can be added to expand a clinical decision support system and thus highlight how a comprehensive system can be globally developed with collaborators. This presentation will cover example scenarios from the CDS ConOps and the method to derive them. One example scenario will be CDSS alerting an increased kidney stone risk during a mission, with diagnosis and treatment options provided during the intervention.

clinical decision support↗