Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Vulnerabilities”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 415 records · Page 23

Toward Global Drought Early Warning Capability - Expanding International Cooperation for the Development of a Framework for Monitoring and Forecasting

Drought has had a significant impact on civilization throughout history in terms of reductions in agricultural productivity, potable water supply, and economic activity, and in extreme cases this has led to famine. Every continent has semiarid areas, which are especially vulnerable to drought. The Intergovernmental Panel on Climate Change has noted that average annual river runoff and water availability are projected to decrease by 10 percent-13 percent over some dry and semiarid regions in mid and low latitudes, increasing the frequency, intensity, and duration of drought, along with its associated impacts. The sheer magnitude of the problem demands efforts to reduce vulnerability to drought by moving away from the reactive, crisis management approach of the past toward a more proactive, risk management approach that is centered on reducing vulnerability to drought as much as possible while providing early warning of evolving drought conditions and possible impacts. Many countries, unfortunately, do not have adequate resources to provide early warning, but require outside support to provide the necessary early warning information for risk management. Furthermore, in an interconnected world, the need for information on a global scale is crucial for understanding the prospect of declines in agricultural productivity and associated impacts on food prices, food security, and potential for civil conflict. This paper highlights the recent progress made toward a Global Drought Early Warning Monitoring Framework (GDEWF), an underlying partnership and framework, along with its Global Drought Early Warning System (GDEWS), which is its interoperable information system, and the organizations that have begun working together to make it a reality. The GDEWF aims to improve existing regional and national drought monitoring and forecasting capabilities by adding a global component, facilitating continental monitoring and forecasting (where lacking), and improving these tools at various scales, thereby increasing the capacity of national and regional institutions that lack drought early warning systems or complementing existing ones. A further goal is to improve coordination of information delivery for drought-related activities and relief efforts across the world. This is especially relevant for regions and nations with low capacity for drought early warning. To do this requires a global partnership that leverages the resources necessary and develops capabilities at the global level, such as global drought forecasting combined with early warning tools, global real-time monitoring, and harmonized methods to identify critical areas vulnerable to drought. Although the path to a fully functional GDEWS is challenging, multiple partners and organizations within the drought, forecasting, agricultural, and water-cycle communities are committed to working toward its success.

GDEWS↗

Empirical Analysis and Automated Classification of Security Bug Reports

With the ever expanding amount of sensitive data being placed into computer systems, the need for effective cybersecurity is of utmost importance. However, there is a shortage of detailed empirical studies of security vulnerabilities from which cybersecurity metrics and best practices could be determined. This thesis has two main research goals: (1) to explore the distribution and characteristics of security vulnerabilities based on the information provided in bug tracking systems and (2) to develop data analytics approaches for automatic classification of bug reports as security or non-security related. This work is based on using three NASA datasets as case studies. The empirical analysis showed that the majority of software vulnerabilities belong only to a small number of types. Addressing these types of vulnerabilities will consequently lead to cost efficient improvement of software security. Since this analysis requires labeling of each bug report in the bug tracking system, we explored using machine learning to automate the classification of each bug report as a security or non-security related (two-class classification), as well as each security related bug report as specific security type (multiclass classification). In addition to using supervised machine learning algorithms, a novel unsupervised machine learning approach is proposed. An ac- curacy of 92%, recall of 96%, precision of 92%, probability of false alarm of 4%, F-Score of 81% and G-Score of 90% were the best results achieved during two-class classification. Furthermore, an accuracy of 80%, recall of 80%, precision of 94%, and F-score of 85% were the best results achieved during multiclass classification.

Cybersecurity↗

Unsupervised Anomaly Detection in High-Dimensional Flight Data Using Convolutional Variational Auto-Encoder

The modern National Airspace System (NAS) is an extremely safe system and the aviation industry has experienced a steady decrease in fatalities over the years. This can be attributed to both improved flight critical systems with redundant hardware and software protections, as well as an increased focus on active monitoring and response to real time and historically identified vulnerabilities by implementing more resilient procedures and protocols. The main approach for identifying vulnerabilities in operations leverages domain expertise using knowledge about how the system should behave within the expected tolerances to known safety margins. This approach works well when the system has a well-defined operating condition. However, the operations in the NAS can be highly complex with various nuances that render it difficult to clearly pre-define all known safety vulnerabilities. With the advancement of data science and machine learning techniques, the potential to automatically identify emerging vulnerabilities in the observed operations has become more practical in recent years. The state-of-the-art anomaly detection approaches in aerospace data usually rely on supervised or semi-supervised learning. However, in many real-world problems such as flight safety, creating labels for the data requires huge amount of effort and is largely impractical. To address this challenge, we developed a Convolutional Variational Auto-Encoder (CVAE), which is an unsupervised learning approach for anomaly detection in high-dimensional heterogeneous time-series data. We validate performance of CVAE compared to the state-of-the-art supervised learning approach as well as unsupervised clustering-based approach using KMeans++ and kernel-based approach using One-Class Support Vector Machine (OC-SVM) on Yahoo!'s benchmark time series anomaly detection data. Finally, we showcase performance of CVAE on a case study of identifying anomalies in the first 60 seconds of commercial flights' take-offs using Flight Operational Quality Assurance (FOQA) data.

Memarzadeh, Milad↗

Unsupervised Anomaly Detection in High-Dimensional Flight Data Using Convolutional Variational Auto-Encoder

The modern National Airspace System (NAS) is an extremely safe system. The industry has experienced a steady decrease in fatalities over the years. This can be contributed to both improved flight critical systems with redundant hardware and software protections as well as an increased focus on active monitoring and response to real time and historically identified vulnerabilities by implementing more resilient procedures and protocols. The main practice for identifying vulnerabilities in operations leverages domain expertise using knowledge about how the system should behave with the expected tolerances to known safety margins. This approach works well when the system has a well-defined operating condition. However, the operations in the NAS can be highly complex with various nuances that render it difficult to clearly pre-define all known safety vulnerabilities. With the advancement of data science and machine learning techniques, the potential to automatically identify emerging vulnerabilities in the observed operations has become more practical in recent years. The state-of-the-art anomaly detection approaches in aerospace data usually rely on supervised or semi-supervised learning. However, in many real-world problems such as flight safety creating labels for the data requires huge amount of efforts and is largely expensive. As a result, in this article, we develop a Convolutional Variational Auto-Encoder (CVAE), an unsupervised learning approach for anomaly detection in high-dimensional heterogeneous time-series data. We validate performance of CVAE compared to the state-of-the-art supervised learning approach (as an upper bound) as well as an supervised clustering based on K-Means (as a lower bound) on Yahoo!'s benchmark time series anomaly detection data. Finally, we showcase performance of CVAE on a case study of identifying anomalies in the first 60 seconds of commercial flights' take-offs using Flight Operational Quality Assurance (FOQA) data.

Milad Memarzadeh↗

The Spaceport Command and Control System Security Assessor Project

This Summer, I worked as a National Aeronautics and Space Administration (NASA) Internships and Fellowships (NIF) intern under my mentor, Jill Giles within the Software Engineering Branch. Within this project, I worked alongside the Cyber Security branch to identify a list of Commercial Off the Shelf (COTS) software to analyze, research, and gain insight about potential vulnerabilities within the software that could become a threat of attack. After identifying the list of COTS software, my team and I used Microsoft Excel to create a worksheet to easily organize and design a questionnaire about the software. Security reports weregiven to us to identify the software used on the machines in the firing rooms. With these reports, we created a script that would populate the database with the software information to identify potential security weaknesses of COTS software.The goal of the project was to produce a final report, summarizing the most vulnerable launch control system servers and configurations and document vulnerabilities, residual risk, likelihood, and consequence. This project is important for the Cyber Security and Information Technology branches because it will identify security weaknesses and help to mitigate risk. From the Spaceport Command and Control System Security Assessor Project, I learned how to properly identify weaknesses and vulnerabilities within software and how to mitigate the risks within the software. This project also taught me how to create databases using scripts and input files.

Destani Satora Van Arsdalen↗

Employing NASA Earth Observations and Socioeconomic Data to Conduct Site Suitability Analyses on Residential Tree Planting Initiatives in Phoenix, Arizona

Phoenix, Arizona is the hottest large city in the United States with an average summer daytime temperature of 106°F. Temperatures in Phoenix continue to climb due to increasing global greenhouse gas concentrations and regional urbanization. The impacts of high temperatures, including heat-related illnesses and deaths, are disproportionately concentrated in low-income neighborhoods often characterized by little tree canopy, lack of green space, and insufficient access to shade. The City of Phoenix’s Office of Heat Response and Mitigation and Arizona State University’s Urban Climate Research Center, partnered with NASA DEVELOP to identify residential neighborhoods and parcels within qualified census tracts (QCTs) to be prioritized for tree planting initiatives using funding from the American Rescue Plan Act (ARPA). This project conducted analyses using NASA Earth observations, socioeconomic data from the 2019 American Community Survey, and local tree canopy and mobility data. For Earth observations, daytime land surface temperature, vegetation, and land cover were obtained from the Landsat 8 Thermal Infrared Sensor (TIRS) and Operational Land Imager (OLI). The project team incorporated these data into a heat vulnerability index (HVI) with an emphasis on tree canopy and social vulnerability to rank block groups within QCTs and focused on the resulting top 25 block group HVI scores. These top 25 most vulnerable block groups were then processed through a parcel analysis to determine the feasibility of residential tree planting based on building footprints on each parcel. Within the top 25 block groups, 2,411 parcels were analyzed, and 3,133 existing trees were identified averaging 1.3 trees per parcel with 90% of parcels having 3 trees or less. Homes with 2 trees or fewer were considered high priority for future planting efforts. Based on the City’s goals for increased tree canopy the project team determined that <10,000 additional trees would need to be planted within the most vulnerable 25 block groups. The project findings have helped initiate community engagement efforts and have contributed to the approval of tree planting funds in Phoenix.

Ryan Hammock↗

Air Return Strategies and Airborne SARS-CoV-2

Dedicated ducted air return per zone for heating, ventilating, and air-conditioning (HVAC) systems is sometimes claimed to be a superior technique over plenum return strategy from the viewpoint of exposure reduction to airborne pathogens. While both the return strategies have advantages, there is limited evidence in the literature as to which strategy is superior merely from a standpoint of building vulnerability to airborne contaminants. We performed multizonal airborne contaminant dispersion modelling using CONTAM to simulate the overall building vulnerability to airborne SARS-CoV-2 aerosols when released in an office building and evaluated the two air return strategies. Results showed that for ducted returns, maintaining negative pressure in the release zone coupled with 100% outdoor air supply can greatly reduce overall building vulnerability. However, for a building maintained under a slight positive pressure and a recirculated air percentage as low as 31%, ducted returns do not necessarily outperform plenum returns in terms of overall building vulnerability to airborne pathogens. Building-specific details and factors that are not easily represented with multizone modelling are important, making general preferential statements for either strategy difficult to make. Insights from this study can guide new construction and retrofits of buildings both during and after the COVID-19 pandemic with the aim of safe re-occupancy of buildings while keeping the buildings resilient against potential future epidemics spread by airborne agents.

Shrestha, Prateek↗

Inequality in the availability of residential air conditioning across 115 US metropolitan areas

Continued climate change is increasing the frequency, severity, and duration of populations’ high temperature exposures. Indoor cooling is a key adaptation, especially in urban areas, where heat extremes are intensified—the urban heat island effect (UHI)—making residential air conditioning (AC) availability critical to protecting human health. In the United States, the differences in residential AC prevalence from one metropolitan area to another is well understood, but its intra-urban variation is poorly characterized, obscuring neighborhood-scale variability in populations’ heat vulnerability and adaptive capacity. We address this gap by constructing empirically derived probabilities of residential AC for 45,995 census tracts across 115 metropolitan areas. Within cities, AC is unequally distributed, with census tracts in the urban “core” exhibiting systematically lower prevalence than their suburban counterparts. Moreover, this disparity correlates strongly with multiple indicators of social vulnerability and summer daytime surface UHI intensity, highlighting the challenges that vulnerable urban populations face in adapting to climate-change driven heat stress amplification.

54 ENVIRONMENTAL SCIENCES↗

Towards Improving Container Security by Preventing Runtime Escapes

Container escapes enable the adversary to execute code on the host from inside an isolated container. Notably, these high severity escape vulnerabilities originate from three sources: (1) container profile misconfigurations, (2) Linux kernel bugs, and (3) container runtime vulnerabilities. While the first two cases have been studied in the literature, no works have investigated the impact of container runtime vulnerabilities. In this paper, to fill this gap, we study 59 CVEs for 11 different container runtimes. As a result of our study, we found that five of the 11 runtimes had nine publicly available PoC container escape exploits covering 13 CVEs. Our further analysis revealed all nine exploits are the result of a host component leaked into the container. Here, we apply a user namespace container defense to prevent the adversary from leveraging leaked host components and demonstrate that the defense stops seven of the nine container escape exploits.

42 ENGINEERING↗

Managing Wildfire Risk and Promoting Equity through Optimal Configuration of Networked Microgrids

As climate change increases the risk of large-scale wildfires, wildfire ignitions from electric power lines are a growing concern. To mitigate the wildfire ignition risk, many electric utilities de-energize power lines to prevent electric faults and failures. These preemptive power shutoffs are effective in reducing ignitions, but they could result in wide-scale power outages. Advanced technology, such as networked microgrids, can help reduce the size of the resulting power outages; however, even microgrid technology might not be sufficient to supply power to everyone, thus forcing hard questions about how to prioritize the provision of power among customers. In this paper, we present an optimization problem that configures networked microgrids to manage wildfire risk while maximizing the power served to customers; however, rather than simply maximizing the amount of power served in kilowatts, our formulation also considers the ability of customers to cope with power outages, as measured by social vulnerability, and it discourages the disconnection of particularly vulnerable customer groups. To test our model, we leverage a synthetic but realistic distribution feeder, along with publicly available social vulnerability indices and satellite-based wildfire risk map data, to quantify the parameters in our optimal decision-making model. Our case study results demonstrate the benefits of networked microgrids in limiting load shed and promoting equity during scenarios with high wildfire risk.

distribution systems↗

Machine Learning-based Intrusion Detection for Smart Grid Computing: A Survey

Machine learning (ML)-based intrusion detection system (IDS) approaches have been significantly applied and advanced the state-of-the-art system security and defense mechanisms. In smart grid computing environments, security threats have been significantly increased as shared networks are commonly used, along with the associated vulnerabilities. However, compared to other network environments, ML-based IDS research in a smart grid is relatively unexplored, although the smart grid environment is facing serious security threats due to its unique environmental vulnerabilities. In this article, we conducted an extensive survey on ML-based IDS in smart grids based on the following key aspects: (1) The applications of the ML-based IDS in transmission and distribution side power components of a smart power grid by addressing its security vulnerabilities; (2) dataset generation process and its usage in applying ML-based IDSs in the smart grid; (3) a wide range of ML-based IDSs used by the surveyed papers in the smart grid environment; (4) metrics, complexity analysis, and evaluation testbeds of the IDSs applied in the smart grid; and (5) lessons learned, insights, and future research directions.

SCADA↗

Transportation Fuel Resiliency: Case Study of Tampa Bay

Here, this case study presents findings from an analysis of the emergency preparation and response for Hurricane Irma, the most recent hurricane impacting the Tampa Bay region. The Tampa Bay region, in particular, is considered one of the most vulnerable areas in the United States to hurricanes and severe tropical weather. A particular vulnerability stems from how all petroleum fuel comes to the area by marine transport through Port Tampa Bay, which can be (and has been in the past) impacted by hurricanes and tropical storms. The case study discussed in this paper covers previous fuel challenges, vulnerabilities, and lessons learned by key Tampa Bay public agency fleets during the past 10 years (mainly as a result of the most recent 2017 Hurricane Irma) to explore ways to improve the area’s resilience to natural disasters. Some of the strategies for fuel-supply resiliency include maintaining emergency fuel supply, prioritizing fuel use, strategically placing the assets around the region to help with recovery, investing in backup generators (including generators powered by alternative fuels), planning for redundancies in fuel supply networks, developing more efficient communication procedures between public fleets, hurricane preparedness-planning, and upgrading street drainage systems to reduce the threat of local flooding.

33 ADVANCED PROPULSION SYSTEMS↗

Securing Distributed Energy Resource Integration

The penetration of distributed energy resources (DER) is growing at much higher rates than predicted 20 years ago. Far from being used only in residential settings, DER are now installed on distribution and transmission circuits. In this position, they do not have the same properties as traditional generators and are more flexible in many cases. The growing penetration and range of uses for DER motivate the need to reliably and safely integrate them into the grid. Operators must be able to rely on them not only for normal operation, but also during abnormal conditions like black starts or adverse cyber scenarios. To that end, we study the communications, device interfaces, and potential consequences of DER operation under abnormal and adversarial conditions. The weaknesses of communications networks are studied based on the industrial protocols used, and the benefits of security features are examined. The device interfaces are found to be vulnerable to attack based on the requirements in the IEEE-1547 standard for DER interconnection and interoperability, which is expected to be adopted in the next ten years. In addition to exploring the requirements of the standard, we show that these vulnerabilities and others do exist and can be used maliciously in a modern storage system DER. Consequences of these vulnerabilities range from exacerbated grid instability, to simultaneous loss of large portions of DER penetration, to physical damage to inverters or DER themselves and other sensitive equipment. We tie these outcomes to specific attacker actions in an effort to give operators a better threat intelligence view that allows them to prioritize mitigations. Finally, we discuss mitigations that could prevent many of the adversarial scenarios described. Some solutions can be added to existing infrastructure, while others may require longer term planning for grid modernization with consideration for security.

25 ENERGY STORAGE↗

Test and Evaluation of Systems with Embedded Machine Learning Components

As Machine Learning (ML) continues to advance, it is being integrated into more systems. Often, the ML component represents a significant portion of the system that reduces the burden on the end user or significantly improves task performance. However, the ML component represents an unknown complex phenomenon that is learned from collected data without the need to be explicitly programmed. Despite the improvement in task performance, the models are often black boxes. Evaluating the credibility and the vulnerabilities of ML models poses a gap in current test and evaluation practice. For high consequence applications, the lack of testing and evaluation procedures represents a significant source of uncertainty and risk. To help reduce that risk, here we present considerations to evaluate systems embedded with an ML component within a red-teaming inspired methodology. We focus on (1) cyber vulnerabilities to an ML model, (2) evaluating performance gaps, and (3) adversarial ML vulnerabilities.

97 MATHEMATICS AND COMPUTING↗

BioSecure Digital Twin: Manufacturing Innovation and Cybersecurity Resilience

U.S. national security, prosperity, economy, and well-being require secure, flexible, and resilient Biopharmaceutical Manufacturing. The COVID-19 pandemic reaffirmed that the biomedical production value-chain is vulnerable to disruption and has been under attack from sophisticated nation-state adversaries. Current cyber defenses are inadequate, and the integrity of critical production systems and processes are inherently vulnerable to cyber-attacks, human error, and supply chain disruptions. The following chapter explores how a BioSecure Digital Twin will improve U.S. manufacturing resilience and preparedness to respond to these hazards by significantly improving monitoring, integrity, security, and agility of our manufacturing infrastructure and systems. The BioSecure Digital Twin combines a scalable manufacturing framework with a robust platform for monitoring and control to increase U.S. biopharma manufacturing resilience. Then, the chapter discusses some of the inherent vulnerabilities and challenges at the nexus of health and advanced manufacturing. Next, the chapter highlights that as the Pandemic evolves, we need agility and resilience to overcome significant obstacles. This section highlights an innovative application of Cyber Informed Engineering to developing and deploying a BioSecure Digital Twin to improve the resilience and security of the biopharma industrial supply chain and production processes. Finally, the chapter concludes with a process framework to complement the Digital Twin platform, called the Biopharma (Observe, Orient, Decide, Act) OODA Loop Framework (BOLF), a four-step approach to decision-making outputs from the Digital Twin. The BOLF will help end users leverage twin technology by distilling the available information, focusing the data on context, and rapidly making the best decision while remaining cognizant of changes that can be made as more data becomes available.

99 GENERAL AND MISCELLANEOUS↗

I Can't Patch My OT Systems! A Look at CISA's KEVC Workarounds & Mitigations for OT

We examine the state of publicly available information about known exploitable vulnerabilities applicable to operational technology (OT) environments. Specifically, we analyze the Known Exploitable Vulnerabilities Catalog (KEVC) maintained by the US Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) to assess whether currently available data is sufficient for effective and reliable remediation in OT settings. Our team analyzed all KEVC entries through July 2025 to determine the extent to which OT environments can rely on existing remediation recommendations. We found that although most entries in the KEVC could affect OT environments, only 13% include vendor workarounds or mitigations as alternatives to patching. This paper also examines the feasibility of developing such alternatives based on vulnerability and exploit characteristics, and we present early evidence of success with this approach.

97 MATHEMATICS AND COMPUTING↗

Speeding-up fuzzing through directional seeds

Abstract Fuzzing is an automated process for discovering inputs in a program that may trigger unexpected behavior. Today, fuzzing has become a standard practice for the discovery of bugs and security vulnerabilities. However, the main issue with such practices is that the exploration of the input space of programs can often be prohibitively expensive. Therefore, several alternative fuzzing strategies have been introduced during the last few years. Some fuzzing techniques rely on human expertise to provide a plausible set of initial input examples, namely, seeds. However, the process of handcrafting seeds for fuzzing purposes often becomes strenuous for humans as it requires a deeper understanding of the Program-Under-Test (PUT). Also, the use of known inputs to programs often does not trigger vulnerable program behavior or may not reach potentially vulnerable code locations. To address those issues, we propose a seed generation framework that enables Human-In-The-Loop (HITL) directed fuzzing where the human assumes a more active role in the creation of seeds that can penetrate and assess desired locations of the PUT. Our proposed framework uses Symbolic Execution (SE) to generate seeds that exercise paths to target program locations. Moreover, our framework enables the visualization of the explored execution paths in the binary of the PUT for the generated seeds. We evaluated our approach on a set of 12 carefully designed C programs with diverse characteristics that mimic real-world programs. The experimental results show the effectiveness of the proposed approach in improving the performance of standard fuzzing tools such as the American Fuzzy Lop ("Image missing" <#comment/> ). Specifically, our solution can generate seeds that substantially enhance the performance of the fuzzer, achieving speedups ranging from $$1.46\times $$ 1.46 × to $$68.53\times $$ 68.53 × for branch conditions, $$1.39\times $$ 1.39 × to $$254.62\times $$ 254.62 × for branch depths, $$14,879.59\times $$ 14 , 879.59 × to $$30,295.88\times $$ 30 , 295.88 × for branch widths over traditional seeds. Additionally, the speedup increases with the number of target function ranging from $$12,260\times $$ 12 , 260 × to $$22,856.07\times $$ 22 , 856.07 × over traditional seeds while only requiring less than 15 seconds on average for the seed generation step.

97 MATHEMATICS AND COMPUTING↗

What drives embodied carbon policy? A global perspective on adoption

Abstract Embodied carbon refers to the greenhouse gas emission associated with the lifecycle of buildings. Embodied carbon policies are critical for addressing the environmental impact of construction materials and advancing climate goals. Despite their importance, the adoption of embodied carbon policies has been limited globally, influenced by economic, environmental, institutional, and trade factors. This study employs structural equation modeling to analyze 37 countries, testing ten hypotheses across four categorical factors. The base model reveals the significant influence of environmental vulnerability and institutional frameworks on policy adoption, while robustness models confirm the critical role of trade dependencies and economic competitiveness in shaping national embodied carbon strategies. Findings underscore that countries with high climate vulnerability and strong institutional support are more likely to adopt embodied carbon policies. Conversely, trade-reliant nations face challenges balancing competitiveness and sustainability. Policy implications suggest the need for international collaboration to align trade policies with carbon reduction goals, targeted support for vulnerable nations, and the integration of embodied carbon considerations into existing climate frameworks. These results offer a roadmap for policymakers to design more effective and equitable embodied carbon policies, fostering global progress toward sustainable construction and decarbonization.

Hu, Ming (ORCID:0000000325831161)↗