Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Cyber”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 469 records · Page 26
All sourcesNASA NTRSDOE OSTI
DOE OSTI2020

Cyber-attack detection and neutralization

The example embodiments are directed to a system and method for neutralizing abnormal signals in a cyber-physical system. In one example, the method includes receiving input signals comprising time series data associated with an asset and transforming the input signals into feature values in a feature space, detecting one or more abnormal feature values in the feature space based on a predetermined normalcy boundary associated with the asset, and determining an estimated true value for each abnormal feature value, and performing an inverse transform of each estimated true value to generate neutralized signals comprising time series data and outputting the neutralized signals.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2020

Situation awareness and dynamic ensemble forecasting of abnormal behavior in cyber-physical system

A plurality of monitoring nodes may each generate a time-series of current monitoring node values representing current operation of a cyber-physical system. A feature-based forecasting framework may receive the time-series of and generate a set of current feature vectors using feature discovery techniques. The feature behavior for each monitoring node may be characterized in the form of decision boundaries that separate normal and abnormal space based on operating data of the system. A set of ensemble state-space models may be constructed to represent feature evolution in the time-domain, wherein the forecasted outputs from the set of ensemble state-space models comprise anticipated time evolution of features. The framework may then obtain an overall features forecast through dynamic ensemble averaging and compare the overall features forecast to a threshold to generate an estimate associated with at least one feature vector crossing an associated decision boundary.

Abbaszadeh, Masoud↗
DOE OSTI2020

System and methods for automated detection, reasoning and recommendations for resilient cyber systems

A method for securing an IT (information technology) system using a set of methods for knowledge extraction, event detection, risk estimation and explanation for ranking cyber-alerts which includes a method to explain the relationship (or an attack pathway) from an entity (user or host) and an event context to another entity (a high-value resource) and an event context (attack or service failure).

Choudhury, Sutanay↗
DOE OSTI2021

Local and global decision fusion for cyber-physical system abnormality detection

Monitoring nodes may generate a series of current monitoring node values over time representing current operation of a cyber-physical system. A decision fusion computer platform may receive, from a local status determination module, an indication of whether each node has an initial local status of “normal”/“abnormal” and a local certainty score (with higher values of the local certainty score representing greater likelihood of abnormality). The computer platform may also receive, from a global status determination module, an indication of whether the system has an initial global status of “normal”/“abnormal” and a global certainty score. The computer platform may output, for each node, a fused local status of “normal” or “abnormal,” at least one fused local status being based on the initial global status. The decision fusion computer platform may also output a fused global status of “normal” or “abnormal” based on at least one initial local status.

Abbaszadeh, Masoud↗
DOE OSTI2021

EMERGING CYBER-PHYSICAL LANDSCAPE OF TRANSPORTATION TECHNOLOGY

Technology is rapidly progressing in transportation and shipping industries across the globe, including the nuclear, radioactive and hazardous material transportation sectors. With this progress comes unprecedented opportunities for improved transparency, safety, and security in transportation, as well as novel threat surfaces and attack vectors. Therefore, the transport safety and security interface is affected through the application of these technologies. We provide an investigative overview of the developing fields of “trans-tech” or “freight- tech” with a look towards technology development and adoption over the next 3-5 years across three primary categories: Transportation IoT (Internet of Things), Smart Infrastructure, and digitization of transportation management. We also investigate the safety and security implications of utilizing these technologies. Each of these categories presents novel threats as well as opportunities. We examine the role of technology in each as an emerging cyber-physical threat to nuclear and radioactive material transportation security, and plausible mitigation considerations at both the state and operator levels in additional to opportunities for addressing the interface between safety and security.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗
DOE OSTI2023

Cyber-Resilient Distributed Autonomous Energy Grid

The DARPA Assured Micropatching (AMP) program focuses on creating the capability for rapid patching of legacy binaries in mission critical systems leveraging the field of formal methods. NREL's Cyber Resilient TLDRD effort, focuses on leveraging the field of formal methods to develop tools and methods for formally verifiable implementations of security architectures such as Zero Trust Architecture. The presentation at the DARPA AMP PI meeting is primarily inspired by common interests and ongoing work on leveraging Formal Methods for OT cybersecurity.

cybersecurity↗
DOE OSTI2022

Consequence-driven cyber-informed engineering and related systems and methods

Embodiments of the disclosure relate to a computer-implemented consequence-driven cyber-informed engineering tool for performing and reporting consequence-based prioritization, system-of-systems breakdown, consequence-based targeting, and mitigations and protections. Embodiments of a CCE tool may perform one or more steps of defining a target industrial control system (ICS), wherein the target ICS includes operational goals, critical functions, and critical services; determining one or more scored high consequence events (HCE) associated with the defined target ICS; prioritizing the scored HCEs according to an HCE severity index; and updating a dashboard with one or more representations of the prioritized HCEs, wherein the updated dashboard is associated with the CCE tool and presented at a display.

Assante, Michael↗
DOE OSTI2022

Scalable hierarchical abnormality localization in cyber-physical systems

A cyber-physical system may have monitoring nodes that generate a series of current monitoring node values over time that represent current operation of the system. A hierarchical abnormality localization computer platform accesses a multi-level hierarchy of elements, and elements in a first level of the hierarchy are associated with elements in at least one lower level of the hierarchy and at least some elements may be associated with monitoring nodes. The computer platform may then determine, based on feature vectors and a decision boundary, an abnormality status for a first element in the highest level of the hierarchy. If the abnormality status indicates an abnormality, the computer platform may determine an abnormality status for elements, associated with the first element, in at least one level of the hierarchy lower than the level of the first element. These determinations may be repeated until an abnormality is localized to a monitoring node.

Abbaszadeh, Masoud↗
DOE OSTI2020

Development of a Reference Design for a Cyber-Physical System

The purpose of this thesis is to develop a reference design to assist in the selection of security practices in power electronics design. A prototype will be developed from this reference design for evaluation. This evaluation will include a brief cost/benefit analysis to gauge the efficacy of implementing each layer of security throughout the power electronics design process. This thesis will also describe the obstacles and effectiveness of integrating a Trusted Platform Module (TPM) into a cyber-hardened grid-connected device. The TPM device is a secured crypto processor that assists in generating, storing, and restricting the use of cryptographic keys. The emphasis of this research is to establish integrity, authenticity, and confidentiality within a system by providing a baseline of security concerns for segments of the system. This research considers communication, control, and hardware level securities. The scope of this thesis will review the necessary security methods as well as consider the effects these methods have on the embedded system, to assess the desired security to responsiveness trade off. Applying this approach to a design process will alleviate various unknowns of appending security to a power electronics design. This thesis describes the specific vulnerabilities introduced within this grid-edge environment, and how the liabilities within the system can be mitigated. Initially, common security techniques will be considered to establish a guideline to benchmark performance and resource costs of the system. The foundation will be a non-hardened power electronic system platform with industry standard communication protocols. Several security techniques and attack vectors will then be evaluated to contribute to the base level platform. Other fail-safe features take place to gauge progress of the selected approach, non-inclusive to the TPM. Collectively, this investigation will determine a valid experiment by appraising and categorizing resource allocation, performance overhead, and monetary cost analysis results into a reference design. The prototype will then demonstrate methods to relieve common threats that are purposefully implemented into the design.

Blair, Nicholas Paul↗
DOE OSTI2023

Coslett Intern Poster: Faster Cyber Attack Response Using STIG

This is a poster for the 2023 intern poster session demonstrating the most effective way to use STIG, a publicly available graph tool, for more efficient cybersecurity. Responses to cyber attacks can be implemented sooner if those shared are more generally applicable.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2024

Verifying Cyber Implementation Best Practices With Malcolm

Network traffic analysis can reveal a lot about what's right or wrong with a network's cybersecurity footing. Using Malcolm, a powerful open-source network traffic analysis tool suite for network security monitoring, cyber analysts and asset owners can validate cybersecurity best practices and uncover red flags in network configuration, including: proper network segmentation east-west (cross-segment) and north-south traffic unsecure or outdated network protocols authentication using clear text credentials rogue devices and services unexpected protocols (e.g., IPv6, DNS, DHCP, update checks, etc.) suspicious file transfers

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2025

Cybersecurity for Digital Energy Infrastructure : Trends, Threats, and Cyber-Informed Engineering

This presentation discusses the rise in digital energy infrastructure and associated threats. It covers an in-depth risk assessment of digital energy equipment and provides real world examples of threats, vulnerabilities, and known incidents. Research conducted by INL assessing and addressing these risks follows, concluding with a dive into Cyber-Informed Engineering (CIE) and it's application to digital energy infrastructure, using battery energy storage systems (BESS) as an example.

24 - POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2026

Automated Generation of Graph-based Cyber Threat Intel

With the advancement of AI technology and tools, specifically in the cybersecurity domain, both cyber defenders and threat actors are continuously adapting the use of these capabilities to expedite their operations. With this phenomenon, threat intelligence that is up to date, refreshable, and has relevant context to a specific threat becomes more and more important as it enables cybersecurity professionals to gain insight into relevant data and relationships to guide their operations. This project enables users to frequently aggregate threat intelligence from various sources, such as vendor vulnerability advisories affecting critical infrastructure, malware reports, and adversary writeups into a centralized, standardized database. The project utilizes the Structured Threat Intelligence eXpression (STIX) for a standardized, shareable threat intelligence data format and Neo4j as a graph database solution to store STIX nodes and relationships. Initial results of the project include datasets of over 8,000 nodes and 20,000 relationships extracted from over 500 data sources that have been released within the past month.

Threat Intelligence↗