Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Vulnerabilities”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 469 records · Page 26
All sourcesNASA NTRSDOE OSTI
DOE OSTI2026

Smart Inverters, Dumb Risk: Taking Control of IBR Security in the Digital Age

This presentation addresses the security challenges posed by Inverter-Based Resources (IBRs) in the modern energy landscape. The presentation highlights the vulnerabilities and risks associated with IBRs, including the potential for cyber-attacks, the impact of insecure defaults, and the systemic risks posed by supply chain dependencies. Key topics covered include: 1) The increasing digital transformation in energy systems and the associated security risks. 2) Specific vulnerabilities in IBRs, including weak passwords, hardcoded credentials, and insecure web application interfaces. 3) The implications of persistent connectivity and the strategic risks posed by foreign-manufactured components. 4) The role of regulatory frameworks, such as NERC CIP, in addressing these challenges and the limitations of current oversight. 5) Practical solutions for mitigating risks, including secure design practices, vendor risk assessments, and the importance of strong passwords and role-based access control. The presentation underscores the necessity of a comprehensive, system-of-systems approach to securing IBRs, emphasizing the need for collaboration across various stakeholders, including operators, developers, and regulators, to ensure the resilience and security of the energy grid.

24 - POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2025

Braxton Marlatt Intern Poster

The Internet of Things (IoT) encompasses a vast network of interconnected devices embedded with software, sensors, and network connectivity, enabling data collection and exchange. While IoT technology revolutionizes various industries, it also introduces significant security challenges. This research focuses on enhancing IoT security through the implementation of Zero Trust Architecture concepts, specifically targeting the Network and Device pillars of the Cybersecurity and Infrastructure Security Agency’s Zero Trust Maturity Model. By generating Codified Attack Surfaces (CAS) using custom Structured Threat Information eXpression bundles, this project aims to provide enhanced visibility into network communications, detect vulnerabilities in device firmware, and improve the overall security posture for IoT devices and networks. The methodology involves defining custom STIX schema and objects, collecting data from intra-IoT traffic, external network traffic, and firmware analysis, and automating the conversion and correlation of this data into STIX bundles. The automated generation of attack surfaces offers comprehensive insights into activity, vulnerabilities, and anomalies within an IoT environment, enabling proactive threat identification and mitigation.

24 - POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2025

Advanced Transmission Technologies – GETs and HPCs Session 2: Advanced Power Flow Control and Transmission Topology Optimization

The INL TADA GETs Cohort Session 2, held on November 7, 2025, conducted in collaboration with ScottMadden, focused on two core Advanced Transmission Technologies (ATTs): Advanced Power Flow Control (APFC) and Transmission Topology Optimization (TTO). These technologies are pivotal in enhancing grid flexibility, reliability, and cybersecurity resilience. APFC, particularly through modular FACTS devices like Modular Static Synchronous Series Compensators (M-SSSCs), enables dynamic voltage injection to reroute power flows. The session highlighted the deployment benefits of APFC, such as rapid installation, minimal civil works, and re-deployability. Regulatory drivers like FERC Order 2023 mandate the inclusion of Grid-Enhancing Technologies (GETs) in interconnection studies. Case studies from Central Hudson, CAISO, and National Grid (UK) demonstrated APFC’s effectiveness in congestion relief and cost savings. The session also addressed cybersecurity concerns, including firmware vulnerabilities, SCADA integration risks, and supply chain dependencies. Participants engaged in interactive exercises to rank cybersecurity and supply chain risks, emphasizing the need for robust digital assurance strategies. TTO involves software-based reconfiguration of transmission networks to optimize power flow without new infrastructure. The session showcased its operational value, with examples from SPP, PJM, and MISO showing significant congestion cost reductions. Cybersecurity vulnerabilities were discussed, particularly in API security and software supply chains, referencing incidents like SolarWinds and attacks on Danish utilities. Digital assurance exercises explored worst-case scenarios, attack paths, and mitigation responsibilities between vendors and utilities. Reliability challenges such as algorithm stability, vendor dependency, and operator trust were also examined. Cross-cutting themes emphasized the importance of digital assurance tools, including Software Bills of Materials (SBOMs) and hardware-in-loop testing. Human performance, training, and operational confidence were identified as critical enablers of technology adoption. The session concluded with a preview of Session 3, which will focus on High Performance Conductors (HPCs) and risk-based cybersecurity tools. Session 2 of 3.

24 - POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2025

Yesterday’s extremes, today’s new normal: flood risk in the Kathmandu Valley, Nepal

Unplanned urban growth has left many cities increasingly vulnerable to extreme rainfall events, particularly in regions with inadequate drainage infrastructures and development encroaching on natural floodplains. Here, in this perspective paper, we examine the September 2024 floods that struck Central Nepal, triggered by a persistent low-pressure system and enhanced by converging moisture flows from the Arabian Sea and the Bay of Bengal which led to widespread catastrophic damage. In the Kathmandu Valley, floodwaters expanded to more than 2.5 times the bankfull water extent, causing significant damage to housing, transportation network, and critical infrastructure, displacing thousands of residents, and severely disrupting urban services. This event highlights the urgent need for improved flood management strategies that integrate both structural and non-structural measures into the infrastructure development. While early warning systems provided critical lead time, challenges remain in reducing forecasting uncertainties and improving communication across government agencies and with local communities. A forward-looking approach is essential, including probabilistic flood forecasting systems, sustainable floodplain management, risk-sensitive land use planning, climate- and disaster- resilient infrastructure development, and the integration of nature-based solutions like urban green and blue spaces to mitigate flood impacts. By involving local communities in planning and preparedness efforts, particularly through citizen science initiatives, and engagement with underserved and disadvantaged communities, Nepal can better adapt to the growing risks posed by extreme rainfall and urban flooding and enhance long-term disaster resilience in rapidly urbanizing areas like Kathmandu Valley.

Kathmandu Valley↗
DOE OSTI2022

RADAMS: Resilient and adaptive alert and attention management strategy against Informational Denial-of-Service (IDoS) attacks

Attacks exploiting human attentional vulnerability have posed severe threats to cybersecurity. In this work, we identify and formally define a new type of proactive attentional attacks called Informational Denial-of-Service (IDoS) attacks that generate a large volume of feint attacks to overload human operators and hide real attacks among feints. Here, we incorporate human factors (e.g., levels of expertise, stress, and efficiency) and empirical psychological results (e.g., the Yerkes-Dodson law and the sunk cost fallacy) to model the operators’ attention dynamics and their decision-making processes along with the real-time alert monitoring and inspection. To assist human operators in dismissing the feints and escalating the real attacks timely and accurately, we develop a Resilient and Adaptive Data-driven alert and Attention Management Strategy (RADAMS) that de-emphasizes alerts selectively based on the abstracted category labels of the alerts. RADAMS uses reinforcement learning to achieve a customized and transferable design for various human operators and evolving IDoS attacks. The integrated modeling and theoretical analysis lead to the Product Principle of Attention (PPoA), fundamental limits, and the tradeoff among crucial human and economic factors. Experimental results corroborate that the proposed strategy outperforms the default strategy and can reduce the IDoS risk by as much as 20%. Besides, the strategy is resilient to large variations of costs, attack frequencies, and human attention capacities. We have recognized interesting phenomena such as attentional risk equivalency, attacker’s dilemma, and the half-truth optimal attack strategy.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Hydraulic safety and growth rather than climate of origin influence survival in desert shrubs and trees

The species-poor woodlands and forests in arid regions are particularly vulnerable to climate change induced plant die-off. Searching for species suitable to replant in these areas is an effective way to prevent further expansion of land desertification. Good knowledge of drought resistance of species is critical for current replanting efforts, however, the related plant survival mechanisms in the process of restoration remain limited. Here, we tested the dominant drivers of plant survival in relation to climate factors, growth characteristics and functional traits including hydraulics and gas exchange across 35 multiple shrub and tree woody species in a common garden at the Tengger Desert, northwest China. We found the desert plants had a wide range of hydraulic thresholds among these desert species, with relative high hydraulic safety, and low xylem hydraulic conductivity. Pant survival was largely determined by hydraulic safety and growth status, but was not affected by the climate of the species’ site of origin. Shrubs and trees diverged in hydraulic and growth characteristics, while there was no difference between native and introduced species. In this study, our results highlight the critical roles of hydraulic safety and growth on determining the survival and drought adaptation during desert vegetation development, which provide a new insight into ecological restoration in arid regions under changing climate conditions.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2020

Projecting spatiotemporally explicit effects of climate change on stream temperature: A model comparison and implications for coldwater fishes

Conservation planners and resource managers seek information about how the availability and locations of cold-water habitats will change in the future and how these predictions vary among models. In this work, we used a physical process-based model to demonstrate the implications of climate change for streamflow and water temperature in two watersheds with distinctive flow regimes: the Snoqualmie watershed (WA) and Siletz watershed (OR), USA. Our model incorporated a downscaled ensemble of global climate model outputs and was calibrated with in situ and remotely sensed water temperatures. Furthermore, we compared predictions from our processed-based model to those from a publicly available and widely used statistical model. The process-based model projected greater changes in summer maximum water temperatures for the mixed-rain-snow Snoqualmie watershed than for the rain-dominated Siletz watershed as a result of the near-complete loss of winter snowpack and significant reduction in summer flow in the Snoqualmie watershed expected by the 2080s. Both models projected generally similar future spatial patterns of maximum water temperature in the two rivers, with cool reaches distributed farther upstream and fewer in number. However, the process-based model projected higher spatial heterogeneity in water temperature due to our spatially explicit simulation of streamflow and because we calibrated the model with spatially continuous remotely sensed water temperature data. We used stream temperature projections to assess the vulnerability of Pacific salmon and trout to changes in the spatial distribution of cold-water habitats during August by the 2080s. Results suggest that salmonids may have fewer summertime cold-water habitats in both watersheds. Projected stream warming may further limit particular species and life stages, especially in the Snoqualmie watershed. Our comparison of models highlights the importance of considering what might be gained by using a process-based model for evaluating and prioritizing management actions that mitigate climate impacts on cold-water habitats for stream fishes.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2022

A Typology for Characterizing Human Action in MultiSector Dynamics Models

The role of individual and collective human agency is increasingly recognized as a prominent and arguably paramount determinant in shaping the behavior, trajectory, and vulnerability of multisector systems. This human influence operates at multiple scales: from short-term (hourly to daily) to long-term (annually to centennial) timescales, and from the local to the global, pushing systems towards either desirable or undesirable outcomes. However, the effort to represent human systems in multisector models has been fragmented across philosophical, methodological, and disciplinary lines. To cohere insights across diverse modeling approaches, we present a new typology for classifying how human actors are represented in the broad suite of coupled human-natural system models that are applied in MultiSector Dynamics (MSD) research. The typology conceptualizes a “sector” as a system-of-systems that includes a diverse group of human actors, defined across individual to collective social levels, involved in governing, provisioning, and utilizing products, goods, or services towards some human end. We trace the salient features of modeled representations of human systems by organizing the typology around three key questions: 1) Who are the modeled actors in MSD systems? 2) What are their modeled actions? 3) How and for what purpose are these actors and actions operationalized in a computational model? The typology is used to critically examine existing models and chart the frontier of future human systems modeling for MSD research.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2022

A typological framework of non-floodplain wetlands for global collaborative research and sustainable use

Non-floodplain wetlands (NFWs) are important but vulnerable inland freshwater systems that are receiving increased attention and protection worldwide. However, a lack of consistent terminology, incohesive research objectives, and inherent heterogeneity in existing knowledge hinder cross-regional information sharing and global collaboration. To address this challenge and facilitate future management decisions, we synthesized recent work to understand the state of NFW science and explore new opportunities for research and sustainable NFW use globally. Results from our synthesis show that although NFWs have been widely studied across all continents, regional biases exist in the literature. We hypothesize these biases in the literature stem from terminology rather than real geographical bias around existence and functionality. To confirm this observation, we explored a set of geographically representative NFW regions around the world and characteristics of research focal areas. We conclude that there is more that unites NFW research and management efforts than we might otherwise appreciate. Furthermore, opportunities for cross-regional information sharing and global collaboration exist, but a unified terminology will be needed, as will a focus on wetland functionality. Based on these findings, we discuss four pathways that aid in better collaboration, including improved cohesion in classification and terminology, and unified approaches to modeling and simulation. In turn, legislative objectives must be informed by science to drive conservation and management priorities. Finally, an educational pathway serves to integrate the measures and to promote new technologies that aid in our collective understanding of NFWs. Our resulting framework from NFW synthesis serves to encourage interdisciplinary collaboration and sustainable use and conservation of wetland systems globally.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2020

Identification of Worst Impact Zones for Power Grids During Extreme Weather Events Using Q-learning

Both the frequency and intensity of extreme weather events have been trending higher in recent years, leading to significant infrastructure damage in the electric grid. The impact of these extreme weather events is desired to be analyzed and quantified to help transmission and distribution system operators prepare for and prevent significant damage and subsequent loss of power. In this paper, we develop an approach that models the impact of extreme weather on the grid and identifies the worst impact zone using Q-learning (a reinforcement learning approach). The identification results reveal grid vulnerability to weather events and provide insights for system operators to help achieve optimal resource allocation and crew dispatch to minimize the adverse impacts of extreme weather. Simulation studies are conducted on the IEEE 123-node system to demonstrate the performance of the proposed approach.

distribution system↗
DOE OSTI2022

Cyber-Physical Security and Resiliency Analysis Testbed for Critical Microgrids with IEEE 2030.5: Preprint

IEEE 2030.5, also known as the Common Smart Inverter Standard (CSIP) is a protocol that specifies the interface between the end user and the smart grid. This standard was proposed recently, and provides many functions which if implemented incorrectly might lead to vulnerabilities. This paper proposes a cyber-physical microgrid testbed using OpenDSS and IEEE 2030.5 that can be used to study the performance of the CSIP protocol various scenarios. For critical microgrid installations, it is essential that the critical loads are served in spite of multiple contingencies. A resiliency analysis is performed for a military microgrid to study its performance and the results are analyzed.

CVSS↗
DOE OSTI2020

Q-Learning-Based Impact Assessment of Propagating Extreme Weather on Distribution Grids

The increasing number of power outage events due to extreme weather conditions is hampering us socioeconomically. Preparing in advance for the extreme weather event is critical. It can help utility operators to reduce grid damages, restore grid service quickly, allocate energy resources and repair crews strategically, and hence dramatically increase grid resilience. In this paper, we propose a method to identify the sequence of worst impact zones in the power grid caused by extreme weather events based on Q-learning (a reinforcement learning algorithm). To quantity the weather severity and its effect on the grid, we model the impact of extreme weather on the grid as a function of intensity, vulnerability, and exposure. A modified IEEE 123-node distribution feeder is presented in a mesh grid and experimented for sequences of zones identification. Finally, simulation results present the identified sequences and their associated impacts on the grid caused by extreme weather events.

distribution system↗
DOE OSTI2021

A Cyber-Resilience Risk Management Architecture for Distributed Wind

Distributed wind is an electric energy resource segment with strong potential to be deployed in many applications, but special consideration of resilience and cybersecurity is needed to address the unique conditions associated with distributed wind. Distributed wind is a strong candidate to help meet renewable energy and carbon-free energy goals. However, care must be taken as more systems are installed to ensure that the systems are reliable, resilient, and secure. The physical and communications requirements for distributed wind mean that there are unique cybersecurity considerations, but there is little to no existing guidance on best practices for cybersecurity risk management for distributed wind systems specifically. This research develops an architecture for the consideration of cyber risks associated with distributed wind systems. The architecture takes into account the configurations, challenges, and standards for distributed wind to create a risk-focused perspective that considers of threats, vulnerabilities, and consequences, with special emphasis on what sets distributed wind systems apart from other distributed energy resources (DER). We discuss common distributed wind architectures and how they are interconnected to larger power systems. Because cybersecurity cannot exist independently, the cyber-resilience architecture must consider the system holistically. Finally, we discuss the implementation of a risk assessment process that uses the cyber-resilience framework to address challenges specific to distributed wind.

17 WIND ENERGY↗
DOE OSTI2025

Data Repository for Multi-Objective Urban Observational Strategies: A risk-based framework for expanding flood sensor networks.

These data support the manuscript "Multi-Objective Urban Observational Strategies: A risk-based framework for expanding flood sensor networks." These data are generated to allow water managers to reason about optimal locations to expand a flood observation system from multiple perspectives, specifically focusing on flood hazards, and population exposure to flooding. The data included are a) a shapefile of individual sensor locations b) a shapefile of river reach catchments, c) raster of FEMA flood likelihood layers d) shapefile of population locations and population socioeconomic characteristics. The code is written in R and includes all files necessary to generate the figures for the associated manuscript. Interactive maps of the final calculated maps of hazard, vulnerability, exposure, and risk are also included as html files.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2020

Fossil Power Plant Cyber Security Life-Cycle Risk Reduction, A Practical Framework for Implementation

Market conditions are forcing fossil electricity generation facility owners and operators to implement advanced digital technologies. These technologies enable efficiencies, operational flexibility, operations and maintenance efficiencies, and adapting to a transitioning workforce. These digital technologies, however, can increase the cybersecurity attack surface. The purpose of this research was to develop a holistic cybersecurity risk reduction framework for fossil generation facilities. The framework begins with assessing how cyber risk changes across facility life cycles, including plant, system, vendor, and business life cycles. The next phase performs consequence analysis to prioritize high consequence events. Focusing on high consequence events allows owners to use a graded, risk-informed approach to prioritize cybersecurity efforts. The final phase identifies the digital asset attack surface in sensors and instrumentation and control equipment. After the vulnerabilities are identified, the owner selects mitigating cybersecurity control measures (or countermeasures) based on the risk analysis from the previous phases. This report describes the current industry cybersecurity best practices in fossil generation that are based on the first principles for cybersecurity engineering. The report is divided into five sections that describe the implementation of the risk reduction framework and present identified research, methodological, and technology gaps that were identified through this course of research and development.

01 COAL, LIGNITE, AND PEAT↗
DOE OSTI2021

Cybersecurity Certification Recommendations for Interconnected Grid Edge Devices and Inverter Based Resources

Escalating deployment of PV and grid-edge devices on the distribution grid has increased the sustainability and efficiency of the electric grid. However, the increasing number of distributed energy resources (DERs) deployed creates a heightened cyber-physical interdependency on the distribution grid and thus creates more vectors for cyber-attacks to exploit through information and communication technology (ICT) systems and networks. For example, control signal packets can be modified, intercepted, or corrupted due to vulnerabilities in communication protocols used by microgrid controllers and grid edge devices for power control. Therefore, to mitigate and prevent cyber-attacks on grid edge devices and the inverter-based resources connected to the distribution grid, the U.S. Department of Solar Energy Technologies Office (SETO) awarded funding to the National Renewable Energy Laboratory and Sandia National Laboratory (SNL) to research, develop, and harmonize cybersecurity standards for Photovoltaic (PV) systems and for other kinds of DERs. To help develop a standard for DER cybersecurity, NREL established certification recommendations and test cases, in consensus with the solar industry and UL, for ensuring intrinsic design security for DERs. These recommendations were developed to bolster the cybersecure functionalities such as TLS, MAC, CRL, session resumption/renegotiation, and password, system, and service security management within the DER devices. The proposed test cases verify authentication, authorization, confidentiality, and data integrity for data and communications of DERs that use Transmission Control Protocol/Internet Protocol (TCP/IP). They were also developed to protect DER communications from eavesdropping, replay, man-in-the-middle, denial of service (DoS), spoofing through security certificates, least-privilege violation, and brute-force credentials. This report, which has been validated and reviewed by UL, expands upon those test cases to provide DER cybersecurity certification recommendations which increase DER resiliency and help to mitigate cyber-attacks. UL's collaboration with NREL and approval of this document will accelerate the adoption of a UL standard for DER cybersecurity.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2023

The Nuclear System-of-Systems Capabilities Analytic Process

This dissertation discusses the impetus for, development of, and initial demonstration of NuSCAPTM: the Nuclear System-of-Systems Capabilities Analytic Process TM . NuSCAP is an approach executed via a Python® application that enables capabilities-based vulnerability analyses of military systems of systems (SOS) exposed to prompt nuclear weapon effects. The NuSCAP application calls on industry-standard, fast-running nuclear weapon effects tools and the Monte Carlo N-Particle®1 (MCNP®) code to evaluate the impact of nuclear weapon environments on the military capabilities of a complex and networked SOS.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2025

Adapting Traditional Hazards Analysis Methods to Address Cyber Risks

Traditional hazards analysis (HA) methods, originally developed to address physical and operational risks, often fall short when it comes to identifying and mitigating cyber threats. These cyber threats pose unique and evolving risks to critical infrastructure and industrial control systems (ICS). This report explores the integration of Cyber-Informed Engineering (CIE) principles into existing HA methods to enhance their ability to address cyber-induced risks. CIE provides organizations with a practical, cost-effective approach to closing the gap between traditional HA methods and the need for cyber risk mitigation. By leveraging existing safety processes and controls, CIE allows users to examine and mitigate cyber vulnerabilities without overhauling existing HA methods. This report identifies areas where HA and CIE naturally align and where their approaches diverge. It emphasizes how CIE principles can be used to adapt HA methods, broadening their scope to include cyber risks and enabling the mitigation of cyber- induced impacts alongside traditional hazards and failure scenarios. This report examines how CIE can be applied across various HA methods—such as Hazard and Operability Studies (HAZOP), Probabilistic Risk Assessment (PRA), Failure Modes and Effects Analysis (FMEA), Systems-Theoretic Process Analysis (STPA), Hazard and Consequence Analysis for Digital Systems (HAZCADS), and Layers of Protection Analysis (LOPA). It provides strategies for integrating CIE to strengthen the identification, assessment, and mitigation of cyber-induced risks. The findings offer a structured entry point for organizations to embed CIE concepts into hazards and safety analyses, as well as broader engineering processes, ultimately supporting the design and operation of a more resilient infrastructure.

42 ENGINEERING↗