SEARCH · Engineering Papers

Results for “spoofing”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 55 records · Page 3

All sources NASA NTRS DOE OSTI

DOE OSTI2022

A Machine Learning Method for the Forensics Attribution of Separated Plutonium

Plutonium (Pu) source attribution would be a powerful tool to support nuclear nonproliferation efforts. This capability to find the source of a Pu sample would act as a deterrent to smuggling efforts, and also help regulatory agencies verify declared nuclear activities. Work at Texas A&M University yielded a nuclear forensics methodology, which is capable of determining separated Pu’s reactor of origin, fuel burnup, and the time since irradiation (TSI)—three parameters of interest. The methodology used a set of ten intra-element isotopic ratios found in separated Pu, which was compared to a library of isotopic ratio values produced using neutronics simulations for reactors of interest. By calculating the probability that unknown Pu sample’s isotopic ratio set matched a set in the library, the methodology could predict the three parameters of interest of the sample. One shortcoming of this methodology was an inability to correctly attribute spoofed Pu, where Pu sourced from two different reactors or two different fuel burnup levels are mixed. A new methodology to rectify this vulnerability using machine learning (ML) technique is developed, instead of the maximum likelihood calculation previously used and the results are satisfactory. The ML approach leverages the existing simulated data for training the algorithm, but use them efficiently by only using intra-element isotope ratios that contribute to the attribution one of the three parameters at a time. Previously, all isotope ratios were used to attribute all three parameters together. The new methodology attributes the Pu parameters in three steps, one for each parameter, rather than resolving all of the three parameters simultaneously like the previous maximum likelihood approach. First, a support vector machine classifier with a set of seven isotopic ratios finds the reactor of origin and a set of regression models trained using gaussian process predicts the burnup with a different set of seven isotopes. Finally, TSI is calculated analytically using decay equations. Thus far, the new methodology is capable of attributing pure Pu samples and has been validated using experimental data. The next step will to be augment the classifier training data set with spoofed Pu data.

73 NUCLEAR PHYSICS AND RADIATION PHYSICS↗

DOE OSTI2021

Multifractal Characterization of Distribution Synchrophasors for Cybersecurity Defense of Smart Grids

“Source ID Mix” spoofing emerged as a new type of cyber-attack on Distribution Synchrophasors (DS) where adversaries have the capability to swap the source information of DS without changing the measurement values. Accurate detection of such a highly-deceptive attack is a challenging task especially when the spoofing attack happens on short fragments of DS recorded within a relatively small geographical scale. Herein this letter proposes an effective approach to detect this cyber-attack by realizing the multifractal characteristics of DS measurements. First, the multifractal cross-correlation of DS measured at multiple intra-state locations is revealed. Then the derived correlation is integrated with weighted two-dimensional multifractal surface interpolation to reconstruct quasi high-resolution signals. Finally, informative location-specific signatures are extracted from the high-resolution DS and they are integrated with advanced machine learning techniques for source authentication. Experiments using the real-life DS are performed to verify the proposed method.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2021

Best Practices for Timing Attack Mitigation

GPS signals play essential roles in the electric subsector by providing precision timing used to synchronize and record measurements from a range of equipment. However, previous research has demonstrated that GPS signals can be spoofed or jammed relatively easily in order to interfere with timing-reliant equipment. This document outlines utility best practices for mitigating against timing attacks in the electric subsector based on an assessment of the difficulty and impact of realistic timing attacks and testing of the effectiveness of technologies capable of mitigating them. This analysis builds on research establishing the vulnerability of GPS-reliant timing equipment to jamming and spoofing by elaborating the difficulty, consequences, and mitigations for timing attacks that adversaries might realistically attempt. While timing attacks are relatively low-cost, low-sophistication, and capable of systemic consequences in the electric subsector, they can be effectively mitigated through well-targeted and diverse mitigations.

24 POWER TRANSMISSION AND DISTRIBUTION↗

NASA NTRS2010

Enabling IP Header Compression in COTS Routers via Frame Relay on a Simplex Link

NASA is moving toward a networkcentric communications architecture and, in particular, is building toward use of Internet Protocol (IP) in space. The use of IP is motivated by its ubiquitous application in many communications networks and in available commercial off-the-shelf (COTS) technology. The Constellation Program intends to fit two or more voice (over IP) channels on both the forward link to, and the return link from, the Orion Crew Exploration Vehicle (CEV) during all mission phases. Efficient bandwidth utilization of the links is key for voice applications. In Voice over IP (VoIP), the IP packets are limited to small sizes to keep voice latency at a minimum. The common voice codec used in VoIP is G.729. This new algorithm produces voice audio at 8 kbps and in packets of 10-milliseconds duration. Constellation has designed the VoIP communications stack to use the combination of IP/UDP/RTP protocols where IP carries a 20-byte header, UDP (User Datagram Protocol) carries an 8-byte header, and RTP (Real Time Transport Protocol) carries a 12-byte header. The protocol headers total 40 bytes and are equal in length to a 40-byte G.729 payload, doubling the VoIP latency. Since much of the IP/UDP/RTP header information does not change from IP packet to IP packet, IP/UDP/RTP header compression can avoid transmission of much redundant data as well as reduce VoIP latency. The benefits of IP header compression are more pronounced at low data rate links such as the forward and return links during CEV launch. IP/UDP/RTP header compression codecs are well supported by many COTS routers. A common interface to the COTS routers is through frame relay. However, enabling IP header compression over frame relay, according to industry standard (Frame Relay IP Header Compression Agreement FRF.20), requires a duplex link and negotiations between the compressor router and the decompressor router. In Constellation, each forward to and return link from the CEV in space is treated independently as a simplex link. Without negotiation, the COTS routers are prevented from entering into the IP header compression mode, and no IP header compression would be performed. An algorithm is proposed to enable IP header compression in COTS routers on a simplex link with no negotiation or with a one-way messaging. In doing so, COTS routers can enter IP header compression mode without the need to handshake through a bidirectional link as required by FRF.20. This technique would spoof the routers locally and thereby allow the routers to enter into IP header compression mode without having the negotiations between routers actually occur. The spoofing function is conducted by a frame relay adapter (also COTS) with the capability to generate control messages according to the FRF.20 descriptions. Therefore, negotiation is actually performed between the FRF.20 adapter and the connecting COTS router locally and never occurs over the space link. Through understanding of the handshaking protocol described by FRF.20, the necessary FRF.20 negotiations messages can be generated to control the connecting router, not only to turn on IP header compression but also to adjust the compression parameters. The FRF.20 negotiation (or control) message is composed in the FRF.20 adapter by interpreting the incoming router request message. Many of the fields are simply transcribed from request to response while the control field indicating response and type are modified.

Nguyen, Sam P.↗

DOE OSTI2021

Impact of cyberattacks on safety and stability of connected and automated vehicle platoons under lane changes

Connected and automated vehicles (CAVs) offer a huge potential to improve the operations and safety of transportation systems. However, the use of smart devices and communications in CAVs introduce new risks. CAVs would leverage vehicle to vehicle (V2V) and vehicle to infrastructure (V2I) communication, thus providing additional system access points compared to traditional systems. Automation makes these systems more vulnerable and increases the consequences of cyberattacks. This study utilizes an infrastructure-based communication platform consisting of cooperative adaptive cruise control and lane control advisories developed by the authors to perform cyber risk assessment of CAVs. The study emulates three types of cyberattacks (message falsification, dedicated denial of service, and spoofing attacks) in a representative traffic environment consisting of multiple CAV platoons and lane change events to analyze the safety and stability impacts of the cyberattacks. Simulation experiments using VISSIM reveals that traffic stream and CAV string is unstable under all three types of cyberattacks. The worst case is represented by the message falsification attack. Increases in volatility are observed over a no attack case, with variations increasing by an average of 43%–51% along with an increase of over 3000 crash conflicts. Similarly, lane change crash conflicts are observed to be more severe compared to rear end crash conflicts, showing a higher probability of severe injuries. Further, the case of slight cyberattack on a single CAV also creates significant disruption in the traffic stream. Analysis of variance (ANOVA) reveals the statistical significance of the results. Furthermore, these results pave the way for future design of secure systems from a monitoring perspective.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2022

Data from the Development Evolution of a Vehicle for Custom Control

In order to develop custom controllers intended to operate vehicles on a live highway, a series of data collection-focused tests were performed at increasing stages of complexity. Modern vehicles with features like Adaptive Cruise Control (ACC) feature a rich set of sensors and drive-by-wire mechanisms. The presented stages of data collection begins with the analysis of raw data provided by various vehicles, and eventually results in spoofing Controller Area Network (CAN) protocols for sending control commands to operate a vehicle. This paper covers the data and technical efforts needed at various stages. The raw data and tools to plot the data are also publicly available.

99 GENERAL AND MISCELLANEOUS↗

DOE OSTI2022

PUF-Based Two-Factor Authentication Protocol for Securing the Power Grid Against Insider Threat

Recent advances in smart grid technologies have enabled additional distributed control paradigms that allow more efficient and reliable operation. However, this creates new security concerns for the grid, such as attackers using spoofed grid control devices to generate false measurements. This paper introduces a two-factor authentication protocol leveraging standard public-key cryptography as one authentication factor and a hardware-based fingerprint, known as a Physical Unclonable Function, as a second authentication factor. This protocol incurs a small overhead and prevents cyber-attacks even when an adversary is able to compromise the cryptographic keys stored in the non-volatile memory of an intelligent control device.

42 ENGINEERING↗

DOE OSTI2026

Secure Time Synchronization in Power Grids and Network HIL Synchrophasor Testing

Reliable and secure time synchronization underpins the monitoring and control functions of modern power grids. As GPS-based timing infrastructures grow more susceptible to spoofing and jamming, their vulnerabilities pose escalating risks to grid stability. This work investigates a secure, resilient timing framework that can serve as an alternative or redundant source for power grids, with a particular focus on synchrophasorbased applications. A candidate timing system architecture is evaluated to guarantee trustworthy time dissemination, even in degraded conditions. A network hardware-in-the-loop testing of two synchrophasors validates the concepts, demonstrating enhanced timing integrity, improved detection of timing anomalies, and sustained observability during adverse timing events.

Wu, Ori [ORNL] (ORCID:0000000326723410)↗

DOE OSTI2020

Model-Free Data Authentication for Cyber Security in Power Systems

With the development and wide deployment of measurement equipment, data can be automatically measured and visualized for situation awareness in power systems. However, the cyber security of power systems is also threated by data spoofing attacks. This letter proposed a measurement data source authentication (MDSA) algorithm based on feature extraction techniques including ensemble empirical mode decomposition (EEMD) and fast Fourier transform (FFT), and machine learning for real-time measurement data classification. Compared with previous work, the proposed algorithm can achieve higher accuracy of MDSA using a shorter window of data from closely located synchrophasor measurement sensors.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2021

Pulsar-Calibrated Timing Source for Synchronized Sampling

The Global Positioning System (GPS) is critical to the real-time synchronized sampling of phasor measurement units (PMUs). Unfortunately, GPS signals are occasionally unstable due to several factors such as weak satellite signal and GPS spoofing, thereby leaving the PMU with a degraded sampling performance. In this letter, a novel Pulsar-calibrated Timing Source (PTS) is proposed as the alternative timing source for synchronized sampling. Further, the PTS can generate the timing signal with a 1 μs drift error within 91 holdover minutes to ensure continuity of sampling accuracy. Experimental tests are conducted and the results reveal the reliability and accuracy of the PTS for PMU synchronization.

42 ENGINEERING↗

DOE OSTI2023

Multiplicity counting using organic scintillators to distinguish neutron sources: An advanced teaching laboratory

In this advanced instructional laboratory, students explore complex detection systems and nondestructive assay techniques used in the field of nuclear physics. After setting up and calibrating a neutron detection system, students carry out timing and energy deposition analyses of radiation signals. Through the timing of prompt fission neutron signals, multiplicity counting is used to carry out a special nuclear material (SNM) nondestructive assay. Our experimental setup is comprised of eight trans-stilbene organic scintillation detectors in a well-counter configuration, and measurements are taken on a spontaneous fission source as well as two (α,n) sources. By comparing each source's measured multiplicity distribution, the resulting measurements of the (α,n) sources can be distinguished from that of the spontaneous fission source. Such comparisons prevent the spoofing, i.e., intentional imitation, of a fission source by an (α,n) neutron source. This instructional laboratory is designed for nuclear engineering and physics students interested in organic scintillators, neutron sources, and nonproliferation radiation measurement techniques.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗

DOE OSTI2024

A comprehensive guide to CAN IDS data and introduction of the ROAD dataset

Although ubiquitous in modern vehicles, Controller Area Networks (CANs) lack basic security properties and are easily exploitable. A rapidly growing field of CAN security research has emerged that seeks to detect intrusions or anomalies on CANs. Producing vehicular CAN data with a variety of intrusions is a difficult task for most researchers as it requires expensive assets and deep expertise. To illuminate this task, we introduce the first comprehensive guide to the existing open CAN intrusion detection system (IDS) datasets. We categorize attacks on CANs including fabrication (adding frames, e.g., flooding or targeting and ID), suspension (removing an ID’s frames), and masquerade attacks (spoofed frames sent in lieu of suspended ones). We provide a quality analysis of each dataset; an enumeration of each datasets’ attacks, benefits, and drawbacks; categorization as real vs. simulated CAN data and real vs. simulated attacks; whether the data is raw CAN data or signal-translated; number of vehicles/CANs; quantity in terms of time; and finally a suggested use case of each dataset. State-of-the-art public CAN IDS datasets are limited to real fabrication (simple message injection) attacks and simulated attacks often in synthetic data, lacking fidelity. In general, the physical effects of attacks on the vehicle are not verified in the available datasets. Only one dataset provides signal-translated data but is missing a corresponding “raw” binary version. This issue pigeon-holes CAN IDS research into testing on limited and often inappropriate data (usually with attacks that are too easily detectable to truly test the method). The scarcity of appropriate data has stymied comparability and reproducibility of results for researchers. As our primary contribution, we present the Real ORNL Automotive Dynamometer (ROAD) CAN IDS dataset, consisting of over 3.5 hours of one vehicle’s CAN data. ROAD contains ambient data recorded during a diverse set of activities, and attacks of increasing stealth with multiple variants and instances of real (i.e. non-simulated) fuzzing, fabrication, unique advanced attacks, and simulated masquerade attacks. To facilitate a benchmark for CAN IDS methods that require signal-translated inputs, we also provide the signal time series format for many of the CAN captures. Our contributions aim to facilitate appropriate benchmarking and needed comparability in the CAN IDS research field.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2020

Supporting Cyber Security of Power Distribution Systems by Detecting Differences Between Real-time Micro-Synchrophasor Measurements and Cyber-Reported SCADA (Final Report)

As modern power grids tend towards greater levels of automation and communication, the challenges of identifying and mitigating vulnerabilities to cyber-attacks are ones that are increasingly demanding attention. Today’s power system has evolved to form the foundational bedrock of modern society, and an attack on this infrastructure could prove disastrous. In this project we were tasked to investigate the use of distribution synchrophasors as an independent isolated sensor network with which we can corroborate, or flag potentially spoofed,Supervisory Control And Data Acquisition (SCADA) data. We adapted an approach to marry the underlying physical properties of power systems with the network communications used by power systems in order to offer insights unattainable by either data stream isolation. While the concept of intrusion detection systems (IDS) is well understood for monitoring network traffic and traditional IT computing systems, the approach discussed in this report is motivated by several key notions: first, current SCADA communications alone presents an incomplete view of the grid. Second, the power grid, and the equipment controlling it, is grounded by laws of physics. Given this, we leverage high-frequency physical grid measurements to understand the physical condition of the grid, and combine this with SCADA. While high-frequency physical grid measurements and SCADA communication over Internet Protocol (IP) networks are fundamentally disparate information sources, when collectively examined through appropriate lenses, they offer a much more nuanced depiction of the grid.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2021

Responding To A Downed Unmanned Aircraft System (UAS) Platform

A drone may be forced down as part of a kinetic Counter-UAS action or as a spoof signal with a command to land immediately. A drone could also be incidentally discovered by an employee or by a random patrol. In each case, the platform should be considered a suspicious package until it can be determined to be nonhazardous by qualified personnel.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗

DOE OSTI2021

Cybersecurity Certification Recommendations for Interconnected Grid Edge Devices and Inverter Based Resources

Escalating deployment of PV and grid-edge devices on the distribution grid has increased the sustainability and efficiency of the electric grid. However, the increasing number of distributed energy resources (DERs) deployed creates a heightened cyber-physical interdependency on the distribution grid and thus creates more vectors for cyber-attacks to exploit through information and communication technology (ICT) systems and networks. For example, control signal packets can be modified, intercepted, or corrupted due to vulnerabilities in communication protocols used by microgrid controllers and grid edge devices for power control. Therefore, to mitigate and prevent cyber-attacks on grid edge devices and the inverter-based resources connected to the distribution grid, the U.S. Department of Solar Energy Technologies Office (SETO) awarded funding to the National Renewable Energy Laboratory and Sandia National Laboratory (SNL) to research, develop, and harmonize cybersecurity standards for Photovoltaic (PV) systems and for other kinds of DERs. To help develop a standard for DER cybersecurity, NREL established certification recommendations and test cases, in consensus with the solar industry and UL, for ensuring intrinsic design security for DERs. These recommendations were developed to bolster the cybersecure functionalities such as TLS, MAC, CRL, session resumption/renegotiation, and password, system, and service security management within the DER devices. The proposed test cases verify authentication, authorization, confidentiality, and data integrity for data and communications of DERs that use Transmission Control Protocol/Internet Protocol (TCP/IP). They were also developed to protect DER communications from eavesdropping, replay, man-in-the-middle, denial of service (DoS), spoofing through security certificates, least-privilege violation, and brute-force credentials. This report, which has been validated and reviewed by UL, expands upon those test cases to provide DER cybersecurity certification recommendations which increase DER resiliency and help to mitigate cyber-attacks. UL's collaboration with NREL and approval of this document will accelerate the adoption of a UL standard for DER cybersecurity.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2021

Tempus Project (Final Report)

This final technical report tracks the accomplishments of the Tempus Project to the statement of project objectives and resulting deliverables. The objective of the Tempus project was to develop and demonstrate the capabilities of a secure, modular, and customizable time synchronization platform that provides layers of protection from GPS spoofing attacks and other vulnerabilities. These vulnerabilities present a challenge to power system operators utilizing GPS-based time synchronization, as time synchronization increasingly plays a critical role in the efficient and reliable operation of power systems. The Tempus project addressed these concerns through the development of a secure, customizable time synchronization platform. The Tempus platform applies a layered approach to time security that protects from manipulation of timing systems used by power utilities. The Tempus platform consists of a component framework utilizing modularized time sources and customizable manipulation detection algorithms. With multiple time sources, and comparisons between sources and tracking sudden or subtle changes to the timing phase and time information, the Tempus system can detect and mitigate compromised timing sources.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2024

Use of Legacy Maritime Protocols Increases Exploitability of Virtual Aids to Navigation

With increased reliance on Virtual Aid(s) to Navigation (VAtoN) - also known as electronic Aid(s) to Navigation (eAtoN), or virtual buoys - a cyber event is likely to cause disruption to international maritime shipping. VAtoN has no physical hardware for visual reference and displays only on a vessel’s Electronic Chart Display Information System (ECDIS) and Automatic Radar Plotting Aid (ARPA); therefore, mariners must rely on the accuracy of the information provided. As VAtoN uses the National Maritime Electronics Association (NMEA) 0183 protocol for both Global Navigation Satellite System (GNSS) and Automatic Identification System (AIS), an insecure protocol that has been proven susceptible to spoofing, denial, and manipulation, the likelihood of a cyber-related event increases substantially.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

DOE OSTI2024

Cyber Resilience in the Cast Timing System

Our task within the DarkNet project was to test the cyber resiliency of the Center for Alternate Synchronization and Timing’s (CAST) framework. We focused our testing on two of the core pieces of CAST’s implementation, a Juniper MX204 router and the Precision Time Protocol (PTP). In this report, we cover the following attempted methods of attack on our targets: ping flood, fork bomb, network protocol fuzzing, ARP poisoning, and IGMP spoofing. We found that delaying certain packets, specifically Delay Request, had a significant impact on the Offset from Master and Observed Drift timing statistics.

97 MATHEMATICS AND COMPUTING↗