Results for “time security” — Page 27

DOE OSTI2022

Synchrophasors-based Master State Awareness Estimator for Cybersecurity in Power Grid: Testbed Implementation & Field Demonstration

The integration of distributed energy resources(DERs) and expansion of complex network in the distribution grid requires an advanced distributed state estimator to monitor the grid health at micro-level. The distribution state estimator will improve the situational awareness and resiliency of distributed power system. This paper proposes a synchrophasors-based master state awareness (MSA) estimator to enhance the cybersecurity in distribution grid by providing a real-time estimation of system operating states to control center operators. In this paper, the proposed MSA estimator utilizes only phasor measurements, bus magnitudes and angles, from phasor measurement units (PMUs),deployed in local substations, to estimate the system states and also detects data integrity attacks, such as load tripping attack that disconnects the load. To validate the proof of concept, we implement the proposed methodology in cyber-physical testbed environment at the Idaho National Laboratory (INL) Electric Grid Security Testbed. Further, to address the “valley of death” and support technology commercialization, field demonstration is also performed at the Critical Infrastructure Test Range Complex(CITRC) at the INL. Our experimental results reveal a promising performance in detecting load tripping attack and providing an accurate situational awareness through an alert visualization dashboard in real-time

42 ENGINEERING↗

DOE OSTI2023

Testing SOAR tools in use

Investigations within Security Operation Centers (SOCs) are tedious as they rely on manual efforts to query diverse data sources, overlay related logs, correlate the data into information, and then document results in a ticketing system. Security Orchestration, Automation, and Response (SOAR) tools are a relatively new technology that promise, with appropriate configuration, to collect, filter, and display needed diverse information; automate many of the common tasks that unnecessarily require SOC analysts’ time; facilitate SOC collaboration; and, in doing so, improve both efficiency and consistency of SOCs. There has been no prior research to test SOAR tools in practice; hence, understanding and evaluation of their effect is nascent and needed. Here, in this paper, we design and administer the first hands-on user study of SOAR tools, involving 24 participants and six commercial SOAR tools. Our contributions include the experimental design, itemizing six characteristics of SOAR tools, and a methodology for testing them. We describe configuration of a cyber range test environment, including network, user, and threat emulation; a full SOC tool suite; and creation of artifacts allowing multiple representative investigation scenarios to permit testing. We present the first research results on SOAR tools. Concisely, our findings are that: per-SOC SOAR configuration is extremely important; SOAR tools increase efficiency and reduce context switching, although with potentially decreased ticketing accuracy/completeness; user preference is slightly negatively correlated with their performance with the tool; internet dependence varies widely among SOAR tools; and balance of automation with assisting decision making is preferred by senior participants. We deliver a public user- and tool-anonymized and -obfuscated version of the data.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2020

Drone Video Platform—Collision Avoidance, Situational Awareness, and Communications

Small unmanned aerial systems are ideal for delivering sensors into areas that are inaccessible or too dangerous for human entry or manned aircraft over-flights. The systems can fly low and slow for enhanced sensitivity and in tight spaces where ordinary aircraft could never fit. We have configured and flown sensor payloads for radiation, chemical, and optical detection on small fixed-wing and rotary-wing aircraft. All the sensor packages provide telemetry, GPS coordinates, LIDAR distance ranging, and absolute time of day to microsecond accuracy. Payload weights range from less than 1 kg up to 5.5 kg. Currently, communications are over 2.4 GHz and 915 MHz radios, as well as over 4G LTE cellular data links. Real-time data feeds from the sensor payloads to web browser clients anywhere in the world are possible via a virtual EC2 server on the Amazon AWS cloud. In FY 2019, the Nevada National Security Site teamed with Virginia Tech, H3D Corp., and Unmanned Systems, Inc. to accomplish the four flight missions described in this report. A large part of this year’s mission goals were to demonstrate the ability to fly beyond visual line of sight (BVLOS).

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗

DOE OSTI2022

Distributed Energy Resource Cybersecurity Standards Development [Final Report]

Currently, the solar industry is operating with little application-specific guidance on how to protect and defend their systems from cyberattacks. This 3-year Department of Energy (DOE) Solar Energy Technologies Office-funded project helped advance the distributed energy resource (DER) cybersecurity state-of-the-art by (a) bolstering industry awareness of cybersecurity concepts, risks, and solutions through a webinar series and (b) developing recommendations for DER cybersecurity standards to improve the security performance of DER products and networks. Drafting DER standards is a lengthy, consensus-based process requiring effective leadership and stakeholder participation. This project was designed to reduce standard and guide writing times by creating well-researched recommendations that could act as a starting place for national and international standards development organizations. Working within the SunSpec/Sandia DER Cybersecurity Workgroup, the team produced guidance for DER cybersecurity certification, communication protocol standards, network architecture s, access control, and patching. The team also led subgroups within the IEEE P 1547.3 Guide for Cybersecurity of Distributed Energy Resources Interconnected with Electric Power Systems committee and pushed a draft to ballot in October 2021.

14 SOLAR ENERGY↗

DOE OSTI2025

DeepLynx Ecosystem 2025

Poor data integration and governance continue to plague complex engineering projects, resulting in missed cost, schedule, and performance targets. Departments operate in isolated systems with manual data exchange, creating fragmented information that compounds errors and leads to significant delays and cost overruns. The DeepLynx ecosystem addresses these challenges through an open-source, modular data management platform that transforms fragmented project data into an integrated digital thread. Built on a federated microservice architecture, the ecosystem comprises seven specialized tools centered around DeepLynx Nexus, a unified data catalog with hierarchical organization and graph-based navigation capabilities. The ecosystem includes: DeepLynx Stream for real-time timeseries data ingestion from industrial sources; DeepLynx Ingest for governed data uploads with formal review workflows; DeepLynx Lattice for ontology-based entity and relationship extraction; DeepLynx Run for workflow orchestration and secure AI/ML compute; DeepLynx Visualize for 3D digital twin visualization; and DeepLynx Insight for AI-assisted document analysis with traceable, grounded responses. Deployable in cloud, on-premise, or hybrid environments using containerized Docker applications and Helm charts, the DeepLynx ecosystem provides flexible infrastructure that adapts to organizational requirements. By consolidating project data into a unified data lake with role-based access controls and OAuth2 authentication, DeepLynx enables digital thread and digital twin capabilities that improve decision-making, reduce risk, and support complex engineering workflows throughout the project lifecycle.

42 - ENGINEERING↗

DOE OSTI2026

Hydrogeological assessment of CO2 containment assurance and wellbore integrity at a Gulf Coast storage site

Abstract A large-scale carbon capture and storage (CCS) initiative on the Texas Gulf Coast serves as a premier demonstration of the U.S. Department of Energy’s CarbonSAFE program. Targeting deep saline formations, specifically Oligo-Miocene deltaic sequences, the project aims to establish technical and commercial viability for geologic CO2 storage within a major industrial corridor. This study provides a rigorous hydrogeological assessment to support Class VI permitting by quantifying the high degree of containment security. Utilizing a compositional reservoir simulator, we developed a suite of 27 distinct simulation cases to evaluate vertical plume dynamics near both planned injection wells and proximal legacy infrastructure. To ensure numerical accuracy near wellbores, we implemented a refined mesh strategy, determining that a 5.6 ft × 5.6 ft grid refinement offered the optimal balance between computational efficiency and descriptive precision. The modeling framework utilized a systematic sensitivity-based approach to evaluate the mechanical redundancy of the subsurface system by performing a bounding analysis of wellbore interfaces against hypothetical high-permeability microannuli. By systematically isolating competing physical drivers, including permeability, porosity, gas hysteresis, thermal gradients, salinity, and solubility trapping (quantified via Henry’s law with dynamically adjusted coefficients), this work moves beyond binary assessments to establish a nuanced hierarchy of containment factors. The results confirm that primary trapping mechanisms (e.g., gas hysteresis and solubility), combined with the site's unique geomechanical stratigraphy, significantly restrict vertical mobility and reinforce the robust containment security of the reservoir. Baseline results demonstrate substantial vertical separation between the CO2 plume and the upper confining system, ensuring robust containment. Sensitivity analysis reveals that even under highly conservative bounding scenarios—assuming theoretical 10-Darcy pathways at specific wellbore locations—the 2,900-ft thick multi-layered confining zone remains a reliable barrier. In these hypothetical upper-bound cases, peak upward fluxes of CO2 and saltwater after 15 years of injection remain localized and dissipate rapidly within the lower sections of the confining interval, leaving the integrity of the seal uncompromised. Furthermore, the study identifies that while localized wellbore pathways define theoretical upper bounds of vertical migration, the Area of Review (AoR) is primarily sensitive to regional thermal gradients and hysteresis, which can influence the AoR by over 3,000 acres in pessimistic configurations. Also, primary trapping mechanisms, specifically gas hysteresis and solubility, work in tandem with the Gulf Coast’s unique geomechanical stratigraphy to significantly restrict vertical mobility. Ductile, smectite-rich mudstones facilitate natural borehole convergence and the self-healing of potential conduits, creating a natural geomechanical bridge that effectively mitigates migration potential at both current injection points and legacy-well locations. This comprehensive modeling effort demonstrates that the integration of high-resolution wellbore simulations and regional geomechanical observations confirms the long-term storage security of the studied site, providing a physics-based foundation for industrial-scale CCS deployments. This modeling framework establishes a baseline for future research into coupled geomechanical effects, such as time-dependent borehole convergence, to further refine long-term containment projections. Acknowledgements We thank the Gulf Coast Carbon Center (GCCC) at the Bureau of Economic Geology for foundational research support. We appreciate Alex Bump for technical guidance and David Hoffman for model mesh generation. This work used TACC’s Frontera cluster for simulations and CMG Ltd. software licenses provided to UT-Austin. This material is based upon work supported by the Department of Energy under Award Number DE-FE0032338. Disclaimer This material is based upon work supported by the U.S. Department of Energy’s Fossil Energy and Carbon Management Office under the CarbonSAFE program, award Number DE-FE0032338. The views expressed herein do not necessarily represent the views of the U.S. Department of Energy or the United States Government.

58 GEOSCIENCES↗

DOE OSTI2026

Hydrogeological assessment of CO2 containment assurance and wellbore integrity at a Gulf Coast storage site

Abstract A large-scale carbon capture and storage (CCS) initiative on the Texas Gulf Coast serves as a premier demonstration of the U.S. Department of Energy’s CarbonSAFE program. Targeting deep saline formations, specifically Oligo-Miocene deltaic sequences, the project aims to establish technical and commercial viability for geologic CO2 storage within a major industrial corridor. This study provides a rigorous hydrogeological assessment to support Class VI permitting by quantifying the high degree of containment security. Utilizing a compositional reservoir simulator, we developed a suite of 27 distinct simulation cases to evaluate vertical plume dynamics near both planned injection wells and proximal legacy infrastructure. To ensure numerical accuracy near wellbores, we implemented a refined mesh strategy, determining that a 5.6 ft × 5.6 ft grid refinement offered the optimal balance between computational efficiency and descriptive precision. The modeling framework utilized a systematic sensitivity-based approach to evaluate the mechanical redundancy of the subsurface system by performing a bounding analysis of wellbore interfaces against hypothetical high-permeability microannuli. By systematically isolating competing physical drivers, including permeability, porosity, gas hysteresis, thermal gradients, salinity, and solubility trapping (quantified via Henry’s law with dynamically adjusted coefficients), this work moves beyond binary assessments to establish a nuanced hierarchy of containment factors. The results confirm that primary trapping mechanisms (e.g., gas hysteresis and solubility), combined with the site's unique geomechanical stratigraphy, significantly restrict vertical mobility and reinforce the robust containment security of the reservoir. Baseline results demonstrate substantial vertical separation between the CO2 plume and the upper confining system, ensuring robust containment. Sensitivity analysis reveals that even under highly conservative bounding scenarios—assuming theoretical 10-Darcy pathways at specific wellbore locations—the 2,900-ft thick multi-layered confining zone remains a reliable barrier. In these hypothetical upper-bound cases, peak upward fluxes of CO2 and saltwater after 15 years of injection remain localized and dissipate rapidly within the lower sections of the confining interval, leaving the integrity of the seal uncompromised. Furthermore, the study identifies that while localized wellbore pathways define theoretical upper bounds of vertical migration, the Area of Review (AoR) is primarily sensitive to regional thermal gradients and hysteresis, which can influence the AoR by over 3,000 acres in pessimistic configurations. Also, primary trapping mechanisms, specifically gas hysteresis and solubility, work in tandem with the Gulf Coast’s unique geomechanical stratigraphy to significantly restrict vertical mobility. Ductile, smectite-rich mudstones facilitate natural borehole convergence and the self-healing of potential conduits, creating a natural geomechanical bridge that effectively mitigates migration potential at both current injection points and legacy-well locations. This comprehensive modeling effort demonstrates that the integration of high-resolution wellbore simulations and regional geomechanical observations confirms the long-term storage security of the studied site, providing a physics-based foundation for industrial-scale CCS deployments. This modeling framework establishes a baseline for future research into coupled geomechanical effects, such as time-dependent borehole convergence, to further refine long-term containment projections. Acknowledgements We thank the Gulf Coast Carbon Center (GCCC) at the Bureau of Economic Geology for foundational research support. We appreciate Alex Bump for technical guidance and David Hoffman for model mesh generation. This work used TACC’s Frontera cluster for simulations and CMG Ltd. software licenses provided to UT-Austin. This material is based upon work supported by the Department of Energy under Award Number DE-FE0032338. Disclaimer This material is based upon work supported by the U.S. Department of Energy’s Fossil Energy and Carbon Management Office under the CarbonSAFE program, award Number DE-FE0032338. The views expressed herein do not necessarily represent the views of the U.S. Department of Energy or the United States Government.

58 GEOSCIENCES↗

DOE OSTI2026

Resilience Measurement Framework For Post-deployment Artificial Intelligence (ai) Integrated Systems

Resilience is largely defined as the ability to adapt or recover from adverse conditions, stresses, attacks, or compromises on systems that use or are enabled by digital resources. In Artificial Intelligence Management and Research for Advanced Networked Testbed Hub (AMARANTH), resilience is measured in the amount of time it took from the beginning of a testing period for the model to reach predictions outside of the original 95% confidence interval or using the Kullback-Leibler (KL) divergence theorem, the Population Stability Index (PSI), and traditional methods such as root mean squared error (RMSE) threshold. Artificial Intelligence (AI) model drift is of significant concern when deploying AI-integrated systems into critical and/or secure environments. Drift can impact resilience of the AI-integrated system post-deployment and requires consistent maintenance and upkeep to ensure the model is accurate and precise. To quantify model drift and predict the point when a model's drift becomes unacceptable, we describe using Kullback-Leibler (KL) divergence, Population Stability Index (PSI) and/or confidence interval width estimations to determine the point of failure and time to failure of a model post-deployment. Through simple code functions, the KL-divergence, PSI, confidence interval, and root mean squared (RMSE) point of failures can be used to derive when a model needs to be maintained as well as the impact of adversarial action through statistical means.

Yockey, Patience [Idaho National Laboratory (INL),↗

DOE OSTI2026

Towards Secure Autonomous Vehicles: An Integrated Edge and Multi-Modal Machine Learning Framework for Intrusion Detection

Autonomous vehicles (AVs) are vulnerable to cyberattacks targeting both internal communication networks and external perception sensors. While edge-based intrusion de- tection for Controller Area Network (CAN) buses offers real-time protection, it cannot detect cross-modal threats. Conversely, multi-modal fusion approaches improve coverage but often lack efficiency for in-vehicle deployment. This thesis integrates two complemen- tary solutions: (1) a lightweight, edge-deployable machine learning framework for CAN bus intrusion detection, and (2) a late-fusion system combining CAN FD and LiDAR data. Together, they form a hierarchical defense capable of handling single-modality and coordi- nated attacks. Simulations show that CAN-only models reach 93% accuracy on simulated DoS, spoofing, replay, and fuzzy attacks, while the fusion system achieves 0.87 AUC and 0.82 F1-score at 2 ms latency. This unified framework establishes a scalable, explainable, and field-ready strategy for AV cybersecurity.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2023

Ameliorating Global Challenges: Globalization, Geopolitics, Basic & Applied Research, and Research Security

We are confronted with a myriad of global challenges, from extreme weather events, occurring at higher frequencies than at any point in history, to pollution, food insecurity, clean water shortages, and fundamentally limited natural resources and materials. The largest number of people inhabit our planet today and enjoy the highest standard of living - though not equally distributed across the world - compared to any prior moment in history. To sustain this quality of life, we are largely reliant on fossil fuel sources, which are responsible for more greenhouse gas emissions by weight each day than the collective weight of all humans that inhabit the planet. Ameliorating these global challenges will require elements of solutions that include advances in basic and applied research, innovative global engineering, materials discovery, new technologies, manufacturing at scale, resilient and adaptable infrastructure, carbon-free energy sources and storage technologies, and new supply chain networks and markets. Success will require constructive collaborative efforts between researchers in countries located in every continent of this planet. For any of these goals to be realized in a timely fashion, geopolitical leaders must become better educated about this existential challenge and incentivized to act.

applied research↗

DOE OSTI2021

A quantum encryption design featuring confusion, diffusion, and mode of operation

Abstract Quantum cryptography—the application of quantum information processing and quantum computing techniques to cryptography has been extensively investigated. Two major directions of quantum cryptography are quantum key distribution (QKD) and quantum encryption, with the former focusing on secure key distribution and the latter focusing on encryption using quantum algorithms. In contrast to the success of the QKD, the development of quantum encryption algorithms is limited to designs of mostly one-time pads (OTP) that are unsuitable for most communication needs. In this work we propose a non-OTP quantum encryption design utilizing a quantum state creation process to encrypt messages. As essentially a non-OTP quantum block cipher the method stands out against existing methods with the following features: 1. complex key-ciphertext relation (i.e. confusion) and complex plaintext-ciphertext relation (i.e. diffusion); 2. mode of operation design for practical encryption on multiple blocks. These features provide key reusability and protection against eavesdropping and standard cryptanalytic attacks.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2021

Multifractal Characterization of Distribution Synchrophasors for Cybersecurity Defense of Smart Grids

“Source ID Mix” spoofing emerged as a new type of cyber-attack on Distribution Synchrophasors (DS) where adversaries have the capability to swap the source information of DS without changing the measurement values. Accurate detection of such a highly-deceptive attack is a challenging task especially when the spoofing attack happens on short fragments of DS recorded within a relatively small geographical scale. Herein this letter proposes an effective approach to detect this cyber-attack by realizing the multifractal characteristics of DS measurements. First, the multifractal cross-correlation of DS measured at multiple intra-state locations is revealed. Then the derived correlation is integrated with weighted two-dimensional multifractal surface interpolation to reconstruct quasi high-resolution signals. Finally, informative location-specific signatures are extracted from the high-resolution DS and they are integrated with advanced machine learning techniques for source authentication. Experiments using the real-life DS are performed to verify the proposed method.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2025

Synergistic effects of Al, Ga, and In doping on ZnO nanorod arrays grown via citrate-assisted hydrothermal technique for highly efficient and fast scintillator screens

To be used as efficient alpha particle scintillator in the fields of nuclear security, nuclear nonproliferation and high-energy physics, scintillator screens must have high light output and fast decay properties. While there has been a great deal of progress in scintillation efficiency, achieving fast decay time properties are still a challenge. In this work, the near band edge (NBE) UV luminescence and alpha particle induced scintillation properties of vertically aligned densely packed ZnO nanorods (NRs) doped with Al, Ga, and In have been thoroughly investigated. The high crystalline hexagonal wurtzite structure with a strong orientation through the c -axis plane (002) and aspect ratios in the range 13–22 have been observed for all ZnO NRs. Electron paramagnetic resonance (EPR) analysis exhibited paramagnetic signals at g ≈ 1.96 for all ZnO NRs. A cost effective green hydrothermal synthesis technique was employed to grow well-aligned NRs. Using citrate as an additive acting as a strong reducing agent in the solution during the crystal growth, defects on the surface are significantly suppressed, thereby enhancing the NBE UV emission. Significantly higher NBE UV emission was observed from the top surface of ZnO NRs in cathodoluminescence (CL) microscopy. Results show that citrate assisted donor doping of ZnO NRs not only reduces the defect emission and NBE self-absorption, but also induces fast decay time (~ 600–700 ps), which makes ZnO NRs a good candidate for fast alpha particle scintillator screens used in associated particle imaging for time and direction tagging of individual neutrons generated in D–T and D–D neutron generators.

36 MATERIALS SCIENCE↗

DOE OSTI2021

Mapping the scattered family tree of fission neutrons

A statistically predicted tendency for neutrons produced inside fission reactors to form in clusters can cause asymmetrical energy production that is counterbalanced, at least in part, by the spontaneous fission of radioactive material in the reactor. This neutron-clustering effect theory has been demonstrated in a nuclear reactor for the first time and was described in an article published by Los Alamos National Laboratory. The findings of a study supported by the Department of Energy’s Nuclear Criticality Safety Program, funded through the National Nuclear Security Administration, and carried out in collaboration with two French nuclear agencies—the Institute for Radiological Protection and Nuclear Safety (IRSN) and the Atomic Energy Commission (CEA)—could improve reactor safety and lead to more accurate simulations, according to LANL. The team found that a complete die-off was avoided in the small reactor because spontaneous fission—nuclear splitting of radioactive material inside reactors that is not caused by direct impact from a fission neutron—creates more neutrons. The balance of fission chain reactions and spontaneous fission lessens the impact of energy bursts created by clustering neutrons.

73 NUCLEAR PHYSICS AND RADIATION PHYSICS↗

DOE OSTI2025

Model-based Hierarchical Reinforcement Learning for Improved Physical Security Design: A Prototype

Prior work in FY24 developed an adversarial AI agent aid in path analysis of physical protection systems. This agent, trained using a model-based reinforcement learning algorithm, was able to successfully learn the most vulnerable path in facilities. It was able to extend the current state of practice for physical protection design by exhibiting dynamic behavior based on current environmental conditions. Whereas PathTrace largely performs a static, graph-based analysis, the AI agent was able to make decisions based on relative position in the facility, current conditions (was the adversarial agnet discovered?), and proximity to secondary targets. The agent demonstrated some novel capabilities, but had limitations that need to be resolved before it can be used for production purposes. For example, the adversarial agent generalizes poorly and takes a relatively long time to train. Nonetheless, there is still considerable promise for developing the adversarial agent further in order to explore even richer, more dynamic behaviors (e.g., adversary motivations, environmental debris, and more). This work considers a complementary idea; development of a planning agent. The planning agent is envisioned as an auto-complete-like tool that can help accelerate security system design by human experts. The agent would respect existing barriers and sensors placed by a human expert while offering cost-effective suggestions (i.e., implicitly balancing effectiveness with cost) to improve the design. The goal is for this agent to be part of an expert’s toolbox, not to totally upend the current state-of-practice, or to displace human experts. The ultimate goal would be concurrent training of both the adversarial and planning agent together, to learn entirely through self-play. This would represent an entirely new way of performing system deign. We selected a hierarchical, model-based reinforcement learning algorithm to serve as the planning agent. This is an extension of concepts used in the prior FY24 adversarial agent work. There, we had a single agent acting an environment. Here, we have two different sub-agents (policies), working together, to form a complete agent. There is a manager policy, which can select abstract goals on slower time scales, and a worker, which performs primitive actions to reach goals selected by the manager. It is worth noting that this class of algorithm is challenging to work with. From our understanding, our work is one of the first successful uses of model-based reinforcement learning (MBRL) in nuclear energy1 , and likely the first hierarchical model-based reinforcement learning application in nuclear energy. Further, this work is one of the first known attempts to apply AI to perform a design tasks in nuclear energy. Consequently, there were significant implementation challenges and the bulk of the work was focused on successful implementation and algorithm design. The results presented here are very low technology readiness level as a consequence of the lack of related literature, but still represent a significant step forward in the pursuit of applied AI for design.

42 ENGINEERING↗

DOE OSTI2022

DER Cybersecurity Detection and Response Suite

SAND2024-08475O The Distributed Energy Resource (DER) Cybersecurity Detection and Response Suite is a solution for distributed energy resource (DER) systems. The DER Security Orchestration, Automation, and Response (SOAR) solution that uses alerts from signature- and behavior-based Intrusion Detection Systems are intended to be deployed as bump-in-the-wire (BITW) devices in front of DER equipment. The fielded application would use multiple intrusion detection systems that report data to SOAR to respond to cyberattacks. The suite consists of two software components: • The proactive intrusion detection and mitigation system (PIDMS) secures grid-edge photovoltaic smart inverters and other equipment in distributed energy resource systems. It is a distributed BITW solution; cyber and physical data are automatically processed using network inspection tools and custom machine learning algorithms to detect abnormal events and correlate cyber-physical events. • The Security Orchestration, Automation, and Response for Distributed Energy Resources (SOAR4DER) application ingests data from several intrusion detection systems to quickly block attacks and revert DER systems to good states. Using a collection of intrusion detection system technologies on a BITW device, it incorporates physical and cyber data to detect abnormal and potential malicious behaviors. Multiple SOAR playbooks then use the intrusion detection system data streams to automatically defend the system. SOAR4DER system testing showed detection and response times under 30 seconds for all adversary reconnaissance, denial-of-service attacks, malicious Modbus commands, brute-force logins, and machine-in-the-middle attacks. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.

Johnson, Jay↗

DOE OSTI2021

Simple, Secure, Internet Delivery of MOOSE-based Applications

Application packaging and distribution are the final steps for delivering software to end-users; both are frequently neglected when creating scientific software. Commercial businesses rely on electronic distribution systems that have rendered disk drives obsolete. Still, national laboratories continue to rely heavily on removable media to distribute and limit access to controlled applications. With increasing concerns of unauthorized copying of sensitive applications, a modern distribution system that utilizes cryptographically secure communication and authentication protocols has been developed. This new distribution system will secure the chain of custody for nuclear software while simultaneously simplifying access to these tools. This report summarizes four primary advancements made toward the secure distribution of Nuclear Energy Advanced Modeling and Simulation (NEAMS)-developed, Multiphysics Object Oriented Simulation Environment (MOOSE)-based applications: application installation, package distribution, automated package building, and distribution of documentation. NEAMS is currently developing more than ten separate applications based on the open-source MOOSE Framework. Distribution of these applications has primarily been accomplished by distributing source code, with end-users compiling the applications themselves. This work created a mechanism where MOOSE applications can be installed in a similar way to any other software. This allows both administrators and end-users simplified access to runnable executables. With this new installation capability, it was then possible to rethink distribution. A new, secure capability for delivering MOOSE-based applications over the internet has been created. This system requires unique cryptographic tokens for authentication, greatly securing the custody chain for software. Once granted access, installation of any NEAMS code can be accomplished with these terminal commands: "conda install ncrc" "ncrc install ncrc-bison." After these two commands (and authenticating) the BISON application will be securely down- loaded from Idaho National Laboratory (INL)’s servers, installed, and ready to use. To enable this new distribution capability to be successful, the open-source Continuous Integration, Verification, Enhancement, and Testing (CIVET) Continuous Integration (CI) capability was augmented to add Continuous Delivery (CD). CD enables the automated building and packaging of MOOSE-based applications as they are modified by development teams, ensuring that our customers can obtain up-to-date versions of the software at any time. The need for instruction on how to use these applications was addressed through modifications to the MOOSE documentation system. The MooseDocs capability, which enables robust documentation of MOOSE-based applications, has been extended to allow both for the installation of documentation and the packaging of documentation with installed applications. Together, these enhancements form the core of a new, secure distribution mechanism for nuclear simulation tools. In concert with the Nuclear Computational Resource Center (NCRC), NEAMS- developed applications will now be straightforward to obtain securely.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2022

Approach and Model Used to Represent a Timeline Analysis for Security Design Enhancements

Next-generation reactors will be able to use risk to inform and performance base the licensing of many aspects of the reactor, facility, and site design, including attributes of physical security. There are several factors related to security, including site topography, reactor design, and physical protection system components, to consider when designing the physical protection system into the overall facility design and plan of operation. With the versatility of advanced reactors, especially micro reactors, methods are needed to simplify and quickly evaluate potential timelines for designing a site configuration. This report describes an approach to generate qualitative and quantitative insights using a risk-informed simulation. The modeling process is described in detail, focusing on three aspects: (1) the facility mission time (the time required to control the plant until safe), (2) the attacker timeline (the time to potential sabotage), and (3) the response timeline (the time to counter the facility attack). The modeling capabilities also are extended to include facility physical phenomena such as thermal-hydraulics and heat transfer to capture realistic representation of dynamic changes to a facility. While the plant models and examples are hypothetical and do not represent a real facility, these modeling approaches could be used for future security-by-design engineering in advanced reactors. The outputs and insights from the modeling approach may be used to modify and optimize the security posture of a facility by efficiently making modifications to the model and seeing the overall impact from the modification. Lastly, use of the approach described in this report can also provide the technical basis for a physical protection program, describing how the facility and security strategy will cope with off-normal events.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗