Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “threat analysis”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 55 records · Page 3
All sourcesNASA NTRSDOE OSTI
DOE OSTI2020

Data Requirements for Application of Risk-Based Dynamic Contingency Analysis to Evaluate Hurricane Impact to Electrical Infrastructure in Puerto Rico

This paper presents a risk-based dynamic contingency analysis framework that was used to evaluate the hurricane impact to electrical infrastructure in Puerto Rico. PNNL developed a scalable risk-based framework for identifying high-voltage transmission resilience improvements by classifying and prioritizing high-risk power grid contingencies (system failures) under hurricane impact. The risk-based framework is founded on grid outage definitions with their associated probabilities of occurrence from hurricane events, in combination with an impact assessment derived from detailed dynamic cascading failure analysis. This paper focuses on a discussion around data requirements for transmission resilience planning for hurricane events, derived from the development of the risk-based framework and its application to Puerto Rico. This paper launches an important first step in encouraging the engineering community and power system industry to move towards establishing resilience planning as a routine practice. Since actual results for Puerto Rico contain sensitive information, sample simulation results will be used to illustrate the data requirements and risk-based dynamic cascading framework on the Puerto Rico power grid, as well as demonstrate the potential for such a simulation framework. The paper includes a discussion on the lessons learned, importance and need for improved datasets that are not usually considered in traditional power system planning. The paper will also elaborate on how the scalable simulation framework and datasets might be expanded to larger footprints and leveraged for modelling other types of natural disasters.

DCAT, Puerto Rico, hurricane, Power System Stabili↗
DOE OSTI2024

Attack Surface of Renewable Energy Technologies

This slide deck presents an overview of the threat landscape for renewable energy technologies. It highlights he growing penetration of renewable resources and potential impact of an attack. Standard architectures are shared to highlight where vulnerabilities may exist and attack paths to reach critical infrastructure. We discuss threat actors and attack paths. Several recent events impacting renewable energy assets or companies are explained.

14 SOLAR ENERGY↗
DOE OSTI2026

Supporting U.S. National Security Through Cybersecurity Partnerships

At NLR, we're studying energy evolutions and threats to understand the challenges they pose and uncover ways to leverage grid advancements to achieve more secure, defensible, and reliable systems. Our integrated research approach bridges the gap between cyber threats and real-world consequences to deliver actionable solutions that reduce vulnerabilities and help strengthen U.S. national security.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2023

Comparison of Socio-Technical Threat Models

Given the adoption of emerging technologies and the increasing complexity of managing such systems with a lifecycle much shorter than that of critical infrastructure systems, there is a practical need to be able to analyze sociotechnical dependencies and their associated evolving risks. Threat models based on social influence techniques can be used to implement adversarial tactics analogous to the cyber kill chain and attested to within the MITRE ATT&CK for ICS framework including Initial Access, Persistence, Collection, and Impact. Furthermore, as with cyber disruptions, the impact of social influence threat models can have an asymmetric impact that is not spatially-localized. Finally, unlike cyber attacks with a reasonably short duration (ransomware takes days to months), social influence based attacks have the potential to persist for much longer as they are based on long-term strategic infrastructure investments within the private sector. Given the increased importance of electric vehicle charging stations as a long-term, strategic infrastructure investment within the Energy and Transportation Sectors, we provide initial results that compare the impact of a Loss of Availability (T0826) realized through cyber and social influence based threat models. The analysis employs techniques from automated reasoning and measures of network complexity to understand evolving dominance of EV payment and charging networks within geographic region of interest. Within this context, we compare the impact of a loss of availability due to ransomware versus that of loss of support due to a merger and acquisition. Results across several different metro areas will be provided.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2021

Development of data‐driven exponential integrators with application to modeling of delay photocurrents

Abstract Radiation‐induced photocurrent effects represent a threat to microelectronic components operating in space, manmade and terrestrial radiation environments. Analysis of these threats by circuit simulations requires accurate and computationally efficient compact models. Most existing compact models are based on closed form analytic solutions of the governing equations and require empirical assumptions and idealizations that can limit their validity. In this paper we formulate an alternative numerical, data‐driven approach that learns a compact model from data representative of the type of measurements one can obtain in an experimental facility. To develop the model we start from a generic discrete‐time dynamical system and then use physics knowledge to refine its structure. Numerical studies demonstrate the potential of the model and establish some empirical guidelines for its training.

Bochev, Pavel↗
DOE OSTI2022

Evaluation of Joint Cyber/Safety Risk in Nuclear Power Systems

This report presents an analysis of the Emergency Core Cooling System (ECCS) for a generic Boiling Water Reactor (BWR)-4 NPP. The Electric Power Research Institute (EPRI) developed Hazards and Consequences Analysis for Digital Systems (HAZCADS) process is applied to the ECCS and its subsystems to identify unsafe control actions (UCAs) which act as possible cyber events of concern. The analysis is performed for two design basis events: Small-break Loss of Coolant Accident (SLOCA) and general transients (TRANS), such as unintended reactor trip. In previous work, HAZCADS UCAs were combined with other cyber-attack analysis to develop a risk-informed approach; however, this was for a single system. This report explores advanced systems engineering modeling approaches to model the interactions between digital assets across multiple systems which may be targeted by cyber adversaries. The complex and interdependent design of digital systems has the potential to introduce emergent cyber properties that are generally not covered by hazard analyses nor formal nuclear Probabilistic Risk Assessment (PRA). The R&D and supporting analysis presented here explores approaches to predict and manage how interdependent system properties effect risk. To show the potential impact of a successful cyber-attack to formal PRA event tree probabilities, HAZCADS analysis was also used. HAZCADS was also used to model the automatic depressurization system (ADS) automatic actuation. This analysis extended to an integrated system analysis for common-cause failure (CCF). In this aspect, the HAZCADS analysis continued by analyzing plant design details for system connectivity in support of critical plant functions. A dependency matrix was developed to depict the integrated functionality of the interconnected systems. Areas of potential CCF are indicated. Future work could include adversary attack development to show how CCF could be caused, resulting in PRA events. Across the multiple systems that comprise the ECCS, the analysis shows that the change in such probabilities was very different between systems. This indicates that some systems have a larger potential risk impact from successful cyber-attack or digital failure, which indicates a need for these systems to have a higher priority for design and defensive measures. Furthermore, we were able to establish that a risk analysis using any arbitrary threat model establishes an ordering of components with regard to cyber-risk. This ordering can be used to influence the overall system design with an eye to lowering risk, or as a way to understand real-time risk to operational systems based on a current threat landscape. Expert knowledge of both the analysis process and the system being analyzed is required to perform a HAZCADS analysis. The need for a tiered risk analysis is demonstrated by the results of this report.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
DOE OSTI2020

Threat Reduction Research Networks: Fostering Sustainable Collaborations Through Trainings for Genomics for Biosurveillance

Scientific research communities can be represented as heterogeneous or multidimensional networks encompassing multiple types of entities and relationships. These networks might include researchers, institutions, meetings, and publications, connected by relationships like authorship, employment, and attendance. We describe a method for efficiently and flexibly capturing, storing, and extracting information from multidimensional scientific networks using a graph database. The database structure is based on an ontology that captures allowable types of entities and relationships. This allows us to construct a variety of projections of the underlying multidimensional graph through database queries to answer specific research questions. We demonstrate this process through a study of the U.S. Biological Threat Reduction Program (BTRP), which seeks to develop Threat Reduction Networks to build and strengthen a sustainable international community of biosecurity, biosafety, and biosurveillance experts to address shared biological threat reduction challenges. Networks like these create connectional intelligence among researchers and institutions around the world, and are central to the concept of cooperative threat reduction. Our analysis focuses on a series of seven BTRP genome sequencing training workshops, showing how they created a growing network of participants and countries over time, which is also reflected in coauthorship relationships among attendees. By capturing concept and relationship hierarchies, our ontology-based approach allows us to pose general or specific questions about networks within the same framework. This approach can be applied to other research communities or multidimensional social networks to capture, analyze, and visualize different types of interactions and how they change over time.

59 BASIC BIOLOGICAL SCIENCES↗
NASA NTRS2016

Cyber-Threat Assessment for the Air Traffic Management System: A Network Controls Approach

Air transportation networks are being disrupted with increasing frequency by failures in their cyber- (computing, communication, control) systems. Whether these cyber- failures arise due to deliberate attacks or incidental errors, they can have far-reaching impact on the performance of the air traffic control and management systems. For instance, a computer failure in the Washington DC Air Route Traffic Control Center (ZDC) on August 15, 2015, caused nearly complete closure of the Centers airspace for several hours. This closure had a propagative impact across the United States National Airspace System, causing changed congestion patterns and requiring placement of a suite of traffic management initiatives to address the capacity reduction and congestion. A snapshot of traffic on that day clearly shows the closure of the ZDC airspace and the resulting congestion at its boundary, which required augmented traffic management at multiple locations. Cyber- events also have important ramifications for private stakeholders, particularly the airlines. During the last few months, computer-system issues have caused several airlines fleets to be grounded for significant periods of time: these include United Airlines (twice), LOT Polish Airlines, and American Airlines. Delays and regional stoppages due to cyber- events are even more common, and may have myriad causes (e.g., failure of the Department of Homeland Security systems needed for security check of passengers, see [3]). The growing frequency of cyber- disruptions in the air transportation system reflects a much broader trend in the modern society: cyber- failures and threats are becoming increasingly pervasive, varied, and impactful. In consequence, an intense effort is underway to develop secure and resilient cyber- systems that can protect against, detect, and remove threats, see e.g. and its many citations. The outcomes of this wide effort on cyber- security are applicable to the air transportation infrastructure, and indeed security solutions are being implemented in the current system. While these security solutions are important, they only provide a piecemeal solution. Particular computers or communication channels are protected from particular attacks, without a holistic view of the air transportation infrastructure. On the other hand, the above-listed incidents highlight that a holistic approach is needed, for several reasons. First, the air transportation infrastructure is a large scale cyber-physical system with multiple stakeholders and diverse legacy assets. It is impractical to protect every cyber- asset from known and unknown disruptions, and instead a strategic view of security is needed. Second, disruptions to the cyber- system can incur complex propagative impacts across the air transportation network, including its physical and human assets. Also, these implications of cyber- events are exacerbated or modulated by other disruptions and operational specifics, e.g. severe weather, operator fatigue or error, etc. These characteristics motivate a holistic and strategic perspective on protecting the air transportation infrastructure from cyber- events. The analysis of cyber- threats to the air traffic system is also inextricably tied to the integration of new autonomy into the airspace. The replacement of human operators with cyber functions leaves the network open to new cyber threats, which must be modeled and managed. Paradoxically, the mitigation of cyber events in the airspace will also likely require additional autonomy, given the fast time scale and myriad pathways of cyber-attacks which must be managed. The assessment of new vulnerabilities upon integration of new autonomy is also a key motivation for a holistic perspective on cyber threats.

Complex Networks↗
NASA NTRS2009

Declining Global Per Capita Agricultural Production and Warming Oceans Threaten Food Security

Despite accelerating globalization, most people still eat food that was grown locally. Developing countries with weak purchasing power tend to import as little food as possible from global markets, suffering consumption deficits during times of high prices or production declines. Local agricultural production, therefore, is critical to both food security and economic development among the rural poor. The level of local agricultural production, in turn, will be controlled by the amount and quality of arable land, the amount and quality of agricultural inputs (fertilizer, seeds, pesticides, etc.), as well as farm-related technology, practices, and policies. In this paper we discuss several emerging threats to global and regional food security, including declining yield gains that are failing to keep up with population increases, and warming in the tropical Indian Ocean and its impact on rainfall. If yields continue to grow more slowly than per capita harvested area, parts of Africa, Asia, and Central and Southern America will experience substantial declines in per capita cereal production. Global per capita cereal production will potentially decline by 14 percent between 2008 and 2030. Climate change is likely to further affect food production, particularly in regions that have very low yields due to lack of technology. Drought, caused by anthropogenic warming in the Indian and Pacific Oceans, may also reduce 21 st century food availability by disrupting Indian Ocean moisture transports and tilting the 21 st century climate toward a more El Nino-like state. The impacts of these circulation changes over Asia remain uncertain. For Africa, however, Indian Ocean warming appears to have already reduced main growing season rainfall along the eastern edge of tropical Africa, from southern Somalia to northern parts of the Republic of South Africa. Through a combination of quantitative modeling of food balances and an examination of climate change, we present an analysis of emerging threats to global food security.

Funk, Chris C.↗
DOE OSTI2020

A Systematic Evidence Based Performance Approach to Regulation of Nuclear Sites in England and Wales - 20058

The Environment Agency for England has developed a systematic evidence-based approach to pursue our strategic environmental objectives for the regulation of nuclear sites. We use an annual evidence review process to ensure effective and efficient targeting of limited resources to achieve those objectives. Over the last 8 years, we have been developing and refining this approach to ensure risk-based and value driven regulation. The approach comprises nuclear site and nuclear sector review processes known as Site Environment Review (SER) and Nuclear Environment Review (NER). This approach complements our regulation of nuclear site permit holders under the Environmental Permitting Regulations (EPR). We deliver our regulation of nuclear sites in England and Wales alongside the Office for Nuclear Regulation. The SER process involves the lead regulator for each nuclear site assessing the permit holder's environmental performance across 14 themes, set within the context of the site's main activities and associated waste disposals. Our themes include environmental leadership, resources and climate change, radioactive waste management, facility management and decommissioning, groundwater, and environmental radiological protection. We use evidence from site inspections and working within our subject matter groups to grade current and predicted future environmental performance. We are particularly interested in sustainability and the application of Best Available Techniques (BAT) to prevent the creation, and minimise the disposal, of radioactive wastes. We use risk analysis (strengths, weaknesses, threats and opportunities) to examine performance against our strategic environmental objectives, which are set out, in our 5-year Nuclear Delivery Plan (NDP). The output supports the targeting of our resources at each nuclear site. We consult the relevant permit holders on the SER priorities and use their feedback to refine our plans. We expect all permit holders to take account of our priorities when considering their own programmes of work, objectives and plans. The NER process brings together what we learn and achieve through regulation across the sector. It provides input to planning priorities, supported by qualitative and semi-quantitative evidence. It covers the 28 nuclear sites in England and Wales and spans the same 14 environmental themes. During the process we collate, compile and summarise evidence from the SERs and other sources such as inspection reports and evidence from our other nuclear work programmes. The output is the NER annual report. This provides a snapshot of the status of the nuclear sector and gives insights to enable us to regulate more efficiently and effectively. It also takes account of cross-cutting issues and risks such as changes in international standards, domestic policy, regulatory framework, domestic standards and guidance, learning from experience such as incidents, events and good practice, and innovation, research and development. It provides graphics that illustrate the grading of environmental performance for the nuclear sector across the fourteen environmental themes. This analysis allows benchmarking of nuclear site's environmental performance and the visualisation provides a convenient comparison of performance across themes, sites, and over time. We use this intelligence to inform our investment in training and development of our staff, and our cross-cutting engagement on strategic issues with government, the Nuclear Decommissioning Authority (NDA) and other corporate organisations. Adopting this approach can provide benefits with organisational reputation, stakeholder participation and ensuring value from the public investment. This paper describes the history of the SER/NER process, a selection of outputs from the process and ideas for improvement. The paper will be of interest to other regulators and organisations across the world that are interested in supporting continuous improvement. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗
NASA NTRS2021

The spatial distribution of ionospheric threats to WAAS integrity, 2000 – 2019: a systematic analysis

The United States’ Wide Area Augmentation System (WAAS) broadcasts data to facilitate aircraft navigation. This paper examines the spatial dependence of ionospheric disturbances that have threatened the accuracy and reliability of position estimates derived from these data over the period 2000 – 2019. We address two distinct aspects of this spatial dependence: (1) the geographic distribution of these threats, in particular, in relation to geomagnetic latitude, and (2) the geometric dependence of threats relative to the locations of the receiver sites that comprise the WAAS network. We analyze threat distributions in terms of the various means that WAAS employs to mitigate these threats, including the Extreme Storm Detector, the Moderate Storm Detector, local irregularity detectors, and the ionospheric threat model. Distinct distributions are presented for threats occurring in Solar Cycle 23 and those of Solar Cycle 24. To study the geometric dependence of threats on receiver locations, we use as a metric the distance separating a threat from the centroid of the nearest Ncentroid receivers. Large values of this metric identify threats at or beyond the edge of coverage. We conclude by discussing the implications of our results for WAAS operations.

Altshuler, Eric↗
DOE OSTI2022

Automated Threat Information Generation

Manual malware analysis is time consuming and is not scalable. This poster describes tools that INL has developed that automate and codify threat information.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2020

Vulnerabilities in Artificial Intelligence and Machine Learning Applications and Data

Artificial intelligence (AI) applications driven by machine learning (ML) are transformational technologies within the international nuclear security regime. Advancements realized by AI—faster and improved data insights, more efficient and automated processes, reductions in human error—enable nuclear security applications such as behavior analysis for insider threat mitigation, source tracking of stolen nuclear material, and facial recognition software for physical protection. In addition to the advantages, however, there are also inherent vulnerabilities and threats associated with its use and risk mitigations must be built into any AI/ML-enabled systems. This work provides a background on AI and ML and different data types used in the field, including open-source intelligence information (OSINT) that is discoverable by AI tools and application data that are used by AI tools for decision-making and automation. Current and potential AI applications and vulnerabilities related to their use within the nuclear security regime are also discussed.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
NASA NTRS2011

L-Band Digital Aeronautical Communications System Engineering - Initial Safety and Security Risk Assessment and Mitigation

This document is being provided as part of ITT's NASA Glenn Research Center Aerospace Communication Systems Technical Support (ACSTS) contract NNC05CA85C, Task 7: "New ATM Requirements--Future Communications, C-Band and L-Band Communications Standard Development." ITT has completed a safety hazard analysis providing a preliminary safety assessment for the proposed L-band (960 to 1164 MHz) terrestrial en route communications system. The assessment was performed following the guidelines outlined in the Federal Aviation Administration Safety Risk Management Guidance for System Acquisitions document. The safety analysis did not identify any hazards with an unacceptable risk, though a number of hazards with a medium risk were documented. This effort represents a preliminary safety hazard analysis and notes the triggers for risk reassessment. A detailed safety hazards analysis is recommended as a follow-on activity to assess particular components of the L-band communication system after the technology is chosen and system rollout timing is determined. The security risk analysis resulted in identifying main security threats to the proposed system as well as noting additional threats recommended for a future security analysis conducted at a later stage in the system development process. The document discusses various security controls, including those suggested in the COCR Version 2.0.

Zelkin, Natalie↗
NASA NTRS2012

Analysis of CSIRT/SOC Incidents and Continuous Monitoring of Threats

Security Operations Centers (SOC) contain a wealth of data which, if properly classified and tagged upfront, can yield a wealth of real-time information about your organizations IT Security posture, risks, and threats. These include answers to relevant and actionable questions such as: What are our biggest threats? Who is attacking us and what do they want? What controls are working or not working? How effective was the new technology we just implemented? What is our ROI?

Wang, John↗
DOE OSTI2023

idaholab/cape2stix

This software allows for the conversion, extraction, and transformation of malware behavior data from "Malware Configuration And Payload Extraction" (CAPEv2) sandbox reports, to Structured Threat Information eXpression (STIX). This allows for further analysis to be performed, sharing of threat data, and transit to a graph database.

Cutshaw, Michael [Idaho National Laboratory (INL),↗
DOE OSTI2026

Cyote-attack Chain Estimator

Attack Chain Estimator (ACE) Application Overview The Attack Chain Estimator (ACE) Application is a sophisticated tool designed for the ingestion, classification, sequencing, and enrichment of cybersecurity threat reports. This application leverages advanced machine learning models and extensive historical data to provide comprehensive insights into cyber threats, specifically targeting Industrial Control Systems (ICS). Purpose The primary functions of the ACE Application include: Ingestion of Cybersecurity Threat Reporting: Capable of ingesting text-based threat reports in markdown or text file format. Supports ingestion of structured data from other sources in STIX/JSON format. Classification of Report’s Text-Based Events: Utilizes a DeBERTa classifier, specifically trained on cybersecurity data, to map the events to MITRE ATT&CK for ICS Tactics and Techniques. Classification is performed using multiple Jupyter notebooks and machine learning workflows hosted as FastAPI microservices: regex_data deberta_base_35_train_hft_classifier_mlflow.ipynb hft_regex_classifier_mlflow.ipynb param_train_hft_classifier_mlflow.ipynb regex_tactic_tech.ipynb Ordering of Tactics, Techniques, and Observable Events: Sequences the identified tactics, techniques, and events to form a coherent attack chain. Enrichment with Historical Attack Chain Details: Enhances the attack chain with details from historical attacks using a Markov model developed from CyOTE Precursor Analysis Report data. The Markov model is available as a FastAPI endpoint for seamless integration. Enrichment with Adversary Emulation Capabilities Data: Integrates adversary emulation capabilities data using MITRE Caldera for OT adversary abilities UUIDs. Export of Output Files: Provides options to export the enriched attack chain in JSON or CSV formats. Routing of Output to Other Applications: Facilitates routing of output to various platforms and applications, including: Threat Intelligence Platforms COREII Scout for Threat Intelligence Analysis COREII Modeling and Simulation for Adversary Emulation Technical Description The ACE Application is an advanced cybersecurity tool designed to provide detailed threat analysis and sequence generation. It is built on a robust architecture that integrates natural language processing, machine learning, and historical data modeling. Key Components: Data Ingestion Module: Handles the input of threat reports and data from various formats, ensuring flexibility in data sources. Classification Engine: Employs DeBERTa-based classifiers hosted as FastAPI microservices to analyze and classify threat report events in accordance with the MITRE ATT&CK framework for ICS. Sequence Generator: Orders the classified events into a logical attack chain, providing clear insight into the sequence of tactics and techniques used in the threat. Enrichment Engine: Integrates historical data and adversary emulation capabilities to enhance the attack chain with valuable context and additional details. The historical data enrichment is powered by a Markov model, which is available as a FastAPI endpoint. Export and Routing Module: Facilitates the export of the enriched attack chain in multiple formats and routes the output to designated applications for further analysis or emulation.

Paul, Tony [Idaho National Laboratory (INL), Idaho↗