SEARCH · Engineering Papers

Results for “detection network”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 685 records · Page 38

All sources NASA NTRS DOE OSTI

DOE OSTI2022

Detection of Stealthy False Data Injection Attacks in Unobservable Distribution Networks

In this paper, a composite scheme is proposed for detecting stealthy data manipulation attacks on distribution system which is unobservable with standard least squares based state estimators. This technique has three stages where the process of data imputation, voltage phasor estimation and the bad data detection are carried out in a systematic manner. The proposed approach is then integrated with moving target defense strategies which perturbs the network parameters to reveal stealthy false data injection attacks. The proposed approach is tested is validated on a three-phase, unbalanced 37-node distribution system and its results are presented. It is shown that the proposed approach has the ability to accurately detect the presence of FDI attacks using limited measurements (i.e., the test system is unobservable).

Rajasekaran, James K.↗

DOE OSTI2024

Detecting Anomalous Images in Astronomical Datasets

Abstract Environmental and instrumental conditions can cause anomalies in astronomical images, which can potentially bias all kinds of measurements if not excluded. Detection of the anomalous images is usually done by human eyes, which is slow and sometimes not accurate. This is an important issue in weak lensing studies, particularly in the era of large-scale galaxy surveys, in which image qualities are crucial for the success of galaxy shape measurements. In this work we present two automatic methods for detecting anomalous images in astronomical data sets. The anomalous features can be divided into two types: one is associated with the source images, and the other appears on the background. Our first method, called the entropy method, utilizes the randomness of the orientation distribution of the source shapes and the background gradients to quantify the likelihood of an exposure being anomalous. Our second method involves training a neural network (autoencoder) to detect anomalies. We evaluate the effectiveness of the entropy method on the Canada–France–Hawaii Telescope Lensing Survey (CFHTLenS) and Dark Energy Camera Legacy Survey (DECaLS DR3) data. In CFHTLenS, with 1171 exposures, the entropy method outperforms human inspection by detecting 12 of the 13 anomalous exposures found during human inspection and uncovering 10 new ones. In DECaLS DR3, with 17112 exposures, the entropy method detects a significant number of anomalous exposures while keeping a low false-positive rate. We find that although the neural network performs relatively well in detecting source anomalies, its current performance is not as good as the entropy method.

Astronomy & Astrophysics↗

NASA NTRS1992

A neural network-based estimator for the mixture ratio of the Space Shuttle Main Engine

In order to properly utilize the available fuel and oxidizer of a liquid propellant rocket engine, the mixture ratio is closed loop controlled during main stage (65 percent - 109 percent power) operation. However, because of the lack of flight-capable instrumentation for measuring mixture ratio, the value of mixture ratio in the control loop is estimated using available sensor measurements such as the combustion chamber pressure and the volumetric flow, and the temperature and pressure at the exit duct on the low pressure fuel pump. This estimation scheme has two limitations. First, the estimation formula is based on an empirical curve fitting which is accurate only within a narrow operating range. Second, the mixture ratio estimate relies on a few sensor measurements and loss of any of these measurements will make the estimate invalid. In this paper, we propose a neural network-based estimator for the mixture ratio of the Space Shuttle Main Engine. The estimator is an extension of a previously developed neural network based sensor failure detection and recovery algorithm (sensor validation). This neural network uses an auto associative structure which utilizes the redundant information of dissimilar sensors to detect inconsistent measurements. Two approaches have been identified for synthesizing mixture ratio from measurement data using a neural network. The first approach uses an auto associative neural network for sensor validation which is modified to include the mixture ratio as an additional output. The second uses a new network for the mixture ratio estimation in addition to the sensor validation network. Although mixture ratio is not directly measured in flight, it is generally available in simulation and in test bed firing data from facility measurements of fuel and oxidizer volumetric flows. The pros and cons of these two approaches will be discussed in terms of robustness to sensor failures and accuracy of the estimate during typical transients using simulation data.

Guo, T. H.↗

DOE OSTI2019

Learning Behavior of Distribution System Discrete Control Devices for Cyber-Physical Security

Conventional cyber-security intrusion detection systems monitor network traffic for malicious activity and indications that an adversary has gained access to the system. The approach discussed here expands the idea of a traditional intrusion detection system within electrical power systems, specifically power distribution networks, by monitoring the physical behavior of the grid. This is achieved through the use of high-rate distribution Phasor Measurement Units (PMUs), alongside SCADA packets analysis, for the purpose of monitoring the behavior of discrete control devices. In this work we present a set of algorithms for passively learning the control logic of voltage regulators and switched capacitor banks. Upon detection of an abnormal operation, the operator is alerted and further action can be taken. Finally, the proposed learning algorithms are validated on both simulated data and on measured PMU data from a utility pilot deployment site.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗

NASA NTRS1990

Rocket engine diagnostics using neural networks

Two problems in applying neural networks to fault detection and identification are (1) the complexity of the sensor data to fault mapping and (2) the lack of sufficient training data. Here, methods are derived and tested in an architecture which addresses these two problems. First, the sensor data to fault mapping is decomposed into three simpler mappings which perform sensor data compression, hypothesis generation, and sensor fusion. Efficient training is performed for each mapping separately. Second, the neural network which performs sensor fusion is structured to detect new unknown faults for which training examples were not presented. These methods were tested on a task of fault detection and identification in the Space Shuttle Main Engine (SSME). Results indicate that the decomposed neural network architecture can be trained efficiently, can identify faults for which it has been trained, and can detect the occurrence of faults for which it has not been trained.

Whitehead, Bruce A.↗

DOE OSTI2013

LINEBACkER: Bio-inspired Data Reduction Toward Real Time Network Traffic Analysis

Abstract—One essential component of resilient cyber applications is the ability to detect adversaries and protect systems with the same flexibility adversaries will use to achieve their goals. Current detection techniques do not enable this degree of flexibility because most existing applications are built using exact or regular-expression matching to libraries of rule sets. Further, network traffic defies traditional cyber security approaches that focus on limiting access based on the use of passwords and examination of lists of installed or downloaded programs. These approaches do not readily apply to network traffic occurring beyond the access control point, and when the data in question are combined control and payload data of ever increasing speed and volume. Manual analysis of network traffic is not normally possible because of the magnitude of the data that is being exchanged and the length of time that this analysis takes. At the same time, using an exact matching scheme to identify malicious traffic in real time often fails because the lists against which such searches must operate grow too large. In this work, we introduce an alternative method for cyber network detection based on similarity-measuring algorithms for gene sequence analysis. These methods are ideal because they were designed to identify similar but nonidentical sequences. We demonstrate that our method is generally applicable to the problem of network traffic analysis by illustrating its use in two different areas both based on different attributes of network traffic. Our approach provides a logical framework for organizing large collections of network data, prioritizing traffic of interest to human analysts, and makes it possible to discover traffic signatures without the bias introduced by expert-directed signature generation. Pattern recognition on reduced representations of network traffic offers a fast, efficient, and more robust way to detect anomalies.

Teuton, Jeremy R.↗

NASA NTRS2013

Sensor Data Qualification Technique Applied to Gas Turbine Engines

This paper applies a previously developed sensor data qualification technique to a commercial aircraft engine simulation known as the Commercial Modular Aero-Propulsion System Simulation 40,000 (C-MAPSS40k). The sensor data qualification technique is designed to detect, isolate, and accommodate faulty sensor measurements. It features sensor networks, which group various sensors together and relies on an empirically derived analytical model to relate the sensor measurements. Relationships between all member sensors of the network are analyzed to detect and isolate any faulty sensor within the network.

control↗

DOE OSTI2018

Detecting anomalous behavior via user authentication graphs

Significant and aggregate user authentication activity may be analyzed across a population of users and computers in one or more networks to differentiate between authorized users and intruders in a network, and/or to detect inappropriate behavior by otherwise authorized users. Dynamic graphs and graph models over user and computer authentication activity, including time-constrained models, may be used for the purposes of profiling and analyzing user behavior in computer networks. More specifically, an edge-based breadth first search of graphs may be used that enforces time-constraints while maintaining traditional breadth first search computational complexity equivalence.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2019

Detecting anomalous behavior via user authentication graphs

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2024

Model-Based Detection of Coordinated Attacks (DCA) in Distribution Systems

The fast-paced growth in digitization of smart grid components enhances system observability and remote-control capabilities through efficient communication. However, enhanced connectivity results in heightened system vulnerability towards cybersecurity risks in the cyber-physical power system. Coordinated cyber-attacks (CCA), when undetected, lead to system-wide impact in terms of large disturbances or widespread outages. Detecting CCA in the cyber layer is critical to thwart cyber-attacks in real-time before the attack impacts the physical system. The challenge of locating CCA stems from the complex grid dynamics, making it difficult to distinguish between normal operational variations and cyber-attack impact. CCA often employs multiple attack vectors targeting geographically distributed components, further complicating CCA identification. Existing research in intrusion detection is primarily focused on the transmission network and limited to detecting individual attacks. In this paper, a novel proactive DCA strategy is proposed for early detection of CCA by establishing correlations among distinct attack events through model-based reinforcement learning that utilizes abductive reasoning to conclude the attacker goal. The solution includes understanding the system model, learning the system dynamics, and correlating individual cyber-attacks to extract the attacker’s objective. The developed learning algorithm identifies the most probable attack path to reach the attacker’s objective by predicting the next attack steps. A DNP3-based cyber-physical co-simulation testbed is developed to test the proposed algorithm using the IEEE 13-node test feeder.

24 POWER TRANSMISSION AND DISTRIBUTION↗

NASA NTRS1999

A Diagnostic Analysis of the Kennedy Space Center LDAR Network

The performance characteristics of the Kennedy Space Center Lightning Detection and Ranging (LDAR) network are investigated at medium-far range (50-300 km). A 19 month noise-filtered sample of LDAR observations is examined, from which it is determined that the "climatological" VHF source density as observed by LDAR falls off approximately 10 dB every 71 km of ground range from the network centroid. The underlying vertical distribution of LDAR sources is approximately normally distributed with a mean of 9 km and a standard deviation of 2.7 km, implying that loss of below-horizon sources has a negligible effect on column-integrated source densities within 200 km ground range. At medium to far ranges, location errors are primarily radial and have a slightly asymmetric distribution whose first moment increases as r(exp 2). A range calibration derived from these results is used to normalize source density maps on monthly, daily and hourly time scales and yields significant improvements in correlation with NLDN ground strike densities.

Boccippio, Dennis J.↗

DOE OSTI2021

Mapping SIEM Vulnerabilities in STIG

SIEM (Security Information and Event Management) tools monitor network traffic and allow users to quickly detect problems in their networks. Because of the valuable information processed by SIEM tools, it is important to understand their vulnerabilities. STIG (Structured Threat Intelligence Graph) is an application created at INL used to visualize data related to cyber threats. Using STIG can allow users to understand vulnerabilities related to their SIEM products and how to protect their systems.

99 GENERAL AND MISCELLANEOUS↗

DOE OSTI2017

Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data Streams

Analysis of an organization’s computer network activity is a key component of early detection and mitigation of insider threat, a growing concern for many organizations. Raw system logs are a prototypical example of streaming data that can quickly scale beyond the cognitive power of a human analyst. As a prospective filter for the human analyst, we present an online unsupervised deep learning approach to detect anomalous network activity from system logs in real time. Our models decompose anomaly scores into the contributions of individual user behavior features for increased interpretability to aid analysts reviewing potential cases of insider threat. Using the CERT Insider Threat Dataset v6.2 and threat detection recall as our performance metric, our novel deep and recurrent neural network models outperform Principal Component Analysis, Support Vector Machine and Isolation Forest based anomaly detection baselines. For our best model, the events labeled as insider threat activity in our dataset had an average anomaly score in the 95.53 percentile, demonstrating our approach’s potential to greatly reduce analyst workloads.

Tuor, Aaron R.↗

DOE OSTI2021

Man‐in‐the‐middle attacks and defence in a power system cyber‐physical testbed

Abstract Man‐in‐The‐Middle (MiTM) attacks present numerous threats to a smart grid. In a MiTM attack, an intruder embeds itself within a conversation between two devices to either eavesdrop or impersonate one of the devices, making it appear to be a normal exchange of information. Thus, the intruder can perform false data injection (FDI) and false command injection (FCI) attacks that can compromise power system operations, such as state estimation, economic dispatch, and automatic generation control (AGC). Very few researchers have focused on MiTM methods that are difficult to detect within a smart grid. To address this, we are designing and implementing multi‐stage MiTM intrusions in an emulation‐based cyber‐physical power system testbed against a large‐scale synthetic grid model to demonstrate how such attacks can cause physical contingencies such as misguided operation and false measurements. MiTM intrusions create FCI, FDI, and replay attacks in this synthetic power grid. This work enables stakeholders to defend against these stealthy attacks, and we present detection mechanisms that are developed using multiple alerts from intrusion detection systems and network monitoring tools. Our contribution will enable other smart grid security researchers and industry to develop further detection mechanisms for inconspicuous MiTM attacks.

Wlazlo, Patrick↗

DOE OSTI2025

Threat Hunt Guide for BESS Environments

The rapid digitalization of the electric grid - driven by the integration of inverter-based resources (IBRs), battery energy storage systems (BESS), and advanced grid control platforms - has significantly enhanced grid efficiency, visibility, and flexibility. However, this evolution also introduces new cybersecurity risks, particularly through supply chain dependencies and operational blind spots at the grid edge. To address these challenges, Idaho National Laboratory (INL), through the Department of Energy (DOE) Office of Cybersecurity, Energy Security, and Emergency Response (CESER) Rapid Risk initiative, conducted a series of rapid risk assessment engagements with energy organizations across the United States. Drawing on lessons learned from these engagements, INL developed the following threat hunting guide for asset owners and operators (AOOs) to enhance their cybersecurity visibility within BESS and IBR systems. The guide demonstrates how to use passive network monitoring to baseline device behavior, detect adversarial activity, and investigate anomalies without disrupting operations. By implementing these practices, energy sector stakeholders can improve coordination between cybersecurity and operations teams and strengthen the resilience of distributed energy resources (DERs) within the modern power grid. Prior to implementing any network monitoring, packet capture, or threat hunting activity described in this guide, AOOs are strongly advised to review applicable governance frameworks, legal requirements, and organizational policies. This guide is intended for informational and educational purposes only. It does not replace compliance with any federal, state, or local cybersecurity mandates or industry standards. Implementation of described configurations, technologies, or analytic workflows is performed at the discretion and responsibility of the asset owner and operator.

25 - ENERGY STORAGE↗

DOE OSTI2023

Hybrid Cyber-attack Detection in Photovoltaic Farms

Here, to address the cyber-physical security in PV farms, a hybrid cyber-attack detection is proposed in this manuscript. To secure PV farms, the proposed method integrates model-based and data-driven methods by fusing the detection score at the device and system levels. First, a model-based cyber-attack detection method is developed for each PV inverter. A residual between the estimation of the Kalman filter and measurement is calculated. By leveraging the calculated residual from all inverters, a squared Mahalanobis distance is developed for device detection score generation. At the system level, a convolutional neural network (CNN) is proposed to detect cyber-attack using the waveform data at the point of common coupling (PCC) in PV farms. To improve the CNN detection accuracy, a set of well-designed features are extracted from the raw waveform data. Finally, a weighted detection score fusion method is proposed to combine device and system detection scores by using their complementary strength. The feasibility and robustness of the proposed method are validated by testing cases and a comparative experiment.

14 SOLAR ENERGY↗

DOE OSTI2023

Investigating Anomalies in Compute Clusters: An Unsupervised Learning Approach

As compute clusters continue to grow in scale and complexity, the frequency of detected anomalies in their operation significantly increases. Timely detection of anomalous events is vital to maintain system efficiency and availability. This study presents an attentionbased graph neural network (GNN) for detecting anomalies in clusters at the compute node level and for providing detailed root cause analysis. We show the effectiveness of attention-based GNNs to accurately detect and localize anomalies on real-world datasets.

Lu, Yiyang↗

NASA NTRS2011

NASA Tech Briefs, January 2011

The topics include: 1) Distributed Aerodynamic Sensing and Processing Toolbox; 2) Collaborative Supervised Learning for Sensor Networks; 3) Hazard Detection Software for Lunar Landing; 4) Onboard Nonlinear Engine Sensor and Component Fault Diagnosis and Isolation Scheme; 5) Network-Capable Application Process and Wireless Intelligent Sensors for ISHM; 6) Interface Supports Multiple Broadcast Transceivers for Flight Applications; 7) FPGA Sequencer for Radar Altimeter Applications; 8) Miniature Sapphire Acoustic Resonator - MSAR; 9) Process-Hardened, Multi-Analyte Sensor for Characterizing Rocket Plume Constituents; 10) SAD5 Stereo Correlation Line-Striping in an FPGA; 11) Hybrid Composite Cryogenic Tank Structure; 12) Nanoscale Deformable Optics; 13) Reliability-Based Design Optimization of a Composite Airframe Component; 14) Zinc Oxide Nanowire Interphase for Enhanced Lightweight Polymer Fiber Composites; 15) Plasma Igniter for Reliable Ignition of Combustion in Rocket Engines; 16) Wire Test Grip Fixture; 17) A Sub-Hertz, Low-Frequency Vibration Isolation Platform; 18) Carbon Nanofibers Synthesized on Selective Substrates for Nonvolatile Memory and 3D Electronics; 19) Nanoparticle/Polymer Nanocomposite Bond Coat or Coating; 20) High-Resolution Wind Measurements for Offshore Wind Energy Development; 21) Spring Tire; 22) Marsviewer 2008; 23) Mission Services Evolution Center Message Bus; 24) Major Constituents Analysis for the Vehicle Cabin Atmosphere Monitor; 25) Astronaut Health Participant Summary Application; 26) Adaption of the AMDIS Method to Flight Status on the VCAM Instrument; 27) Natural Language Interface for Safety Certification of Safety-Critical Software; 28) Cryogenic Caging for Science Instrumentation; 29) Wide-Range Neutron Detector for Space Nuclear Applications; 30) In Situ Guided Wave Structural Health Monitoring System; 31) Multiplexed Energy Coupler for Rotating Equipment; 32) Attitude Estimation in Fractionated Spacecraft Cluster Systems; 33) Full Piezoelectric Multilayer-Stacked Hybrid Actuation/Transduction Systems; 34) Active Flow Effectors for Noise and Separation Control; 35) Method and System for Temporal Filtering in Video Compression Systems; 36) Apparatus for Measuring Total Emissivity of Small, Low-Emissivity Samples; 37) Multiple-Zone Diffractive Optic Element for Laser Ranging Applications; 38) Simplified Architecture for Precise Aiming of a Deep-Space Communication Laser Transceiver; 39) Two-Photon-Absorption Scheme for Optical Beam Tracking; 40) High-Sensitivity, Broad-Range Vacuum Gauge Using Nanotubes for Micromachined Cavities; 41) Wide-Field Optic for Autonomous Acquisition of Laser Link; 42) Extracting Zero-Gravity Surface Figure of a Mirror; 43) Modeling Electromagnetic Scattering From Complex Inhomogeneous Objects; 44) Visual Object Recognition and Tracking of Tools; 45) Method for Implementing Optical Phase Adjustment; 46) Visual SLAM Using Variance Grid Maps; 47) Rapid Calculation of Spacecraft Trajectories Using Efficient Taylor Series Integration; 48) Efficient Kriging Algorithms; 49) Predicting Spacecraft Trajectories by the WeavEncke Method; 50) An Augmentation of G-Guidance Algorithms; 51) Comparison of Aircraft Icing Growth Assessment Software; 52) Silicon-Germanium Voltage-Controlled Oscillator at 105 GHz; 53) Estimation of Coriolis Force and Torque Acting on Ares-1; 54) Null Lens Assembly for X-Ray Mirror Segments; and 55) High-Precision Pulse Generator.

Source record↗