Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Attack detection”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 73 records · Page 4
All sourcesNASA NTRSDOE OSTI
DOE OSTI2024

Collection And Analysis Of Telemetry For The Cyote Heuristic

CATCH CLI focuses on gathering telemetry data, storing it in the Neo4j database, querying for Mitre ATT&CK patterns, and creating STIX 2.1 reports. Key Components: Analysis Modules: Analyze data to detect attack patterns. GoSTOTS Collection Engines: Collect telemetry data. These tools can be used together or individually. Analysis modules rely on data from specific engines to identify attack patterns. Source Code Organization: Engines: CATCH/catch/cmd/collection Modules: CATCH/catch/cmd/analysis CGUI Overview CATCH Graphical User Interface (CGUI) offers a graphical shell to execute CATCH CLI, allowing easy editing of: Analysis Modules Database configurations Profiles (collection and device settings) Neo4j Overview Neo4j is a graph database using the Cypher query language, storing data in JSON. It seamlessly integrates with STIX 2.1 data for: Data Submission: CATCH Collection Engines Data Querying: Analysis Modules CATCH modifies STIX 2.1 data for Neo4j submission and reverts it back during querying. STIG Overview Structured Threat Intelligence Graph (STIG) is a tool for creating, editing, querying, analyzing, and visualizing threat intelligence using STIX 2.1 and storing data in Neo4j. Usage Tools can be run: Manually (CLI): Refer to CATCH documentation User Interface: Run ./cgui/CGUI or go run ./cgui/ Additional Information Logging System: Detailed in the config documentation Further Documentation: Available for CATCH and CGUI

Madsen, MichaelJ. [Idaho National Laboratory (INL)↗
DOE OSTI2023

Design and Development of a High Fidelity Cyber-Physical Testbed

In order to ensure that future critical infrastructure systems are resilient to various types of such advanced and persistent threats, it is important to develop and integrate tailored solutions that holistically address cyber-attack detection and mitigation in a timely manner such that adverse system impacts that impact a large population are avoided. Further, it is essential to create environments that allow control, protection and communication to exist within a realistic environment to analyze the effects of adverse conditions and system operating modes. This project aims to establish a high-fidelity testbed environment for modeling and simulating a single microgrid all the way up to a network of microgrids along with baseline controls, protection, and associated cyber communication. This is an important activity because accurately modeling and simulating the various power-electronics-based DERs and loads in a microgrid is critical to adequately capturing their behaviors over a wide range of off-normal conditions, as well as to evaluate the resilience of the system using the developed controls. The work presented in this report focuses on the process of building this high-fidelity testbed and the associated experimentation it enables. The model enables the creation of high-fidelity use cases and associated datasets that have been used extensively within the initiative to study resilience and support novel control development and prototyping. The work heavily leverages existing capability that is part of the high-fidelity cyber-physical system experimentation lab to create a power hardware-in-the-loop setup. The report also details the creation of an automated model building platform that can enable high-fidelity real-time models to be built without much effort allowing existing low-fidelity models to be analyzed in higher fidelity. Lastly, the report also discusses efforts center around scaling to large complex power system models to make the experimentation more effective.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2022

Cyber-Physical Secure Observer-Based Corrective Control under Compromised Sensor Measurements

In this paper we introduce the objectives and design principles of corrective control under cyber-physical attacks. We propose two types of observer-based corrective control for both the open-loop stable and the open-loop unstable LTI systems. The basic idea of our corrective control design is to use the observer as the ground-truth during the attack, making the plant dynamics follow the observer behavior. This is the opposite to the no-attack-detected period in which the observer is designed to follow the plant dynamics. We show stability of the proposed control under compromised sensor measurements, and quantify the effects of the discrepancy between the observer and the plant. Numerical examples, with illustrations using microgrid energy dynamics, are presented to show benefits of the proposed corrective control.

Wu, Dan↗
DOE OSTI2023

Systems and methods for global cyber-attack or fault detection model

An industrial asset may have monitoring nodes that generate current monitoring node values representing a current operation of the industrial asset. An abnormality detection computer may detect when a monitoring node is currently being attacked or experiencing a fault based on a current feature vector, calculated in accordance with current monitoring node values, and a detection model that includes a decision boundary. A model updater (e.g., a continuous learning model updater) may determine an update time-frame (e.g., short-term, mid-term, long-term, etc.) associated with the system based on trigger occurrence detection (e.g., associated with a time-based trigger, a performance-based trigger, an event-based trigger, etc.). The model updater may then update the detection model in accordance with the determined update time-frame (and, in some embodiments, continuous learning).

Xu, Rui↗
DOE OSTI2025

Adaptive anomaly detection for identifying attacks in cyber-physical systems: A systematic literature review

Modern cyberattacks in cyber-physical systems (CPS) rapidly evolve and cannot be deterred effectively with most current methods, which focus on characterizing past threats. Adaptive anomaly detection (AAD) is among the most promising techniques to detect evolving cyberattacks, with an emphasis on fast data processing and model adaptation. AAD has been researched extensively; however, to the best of our knowledge, our work is the first systematic literature review (SLR) on current research in this field. We present a comprehensive SLR, gathering 397 relevant papers and systematically analyzing 65 of them (47 research and 18 survey papers) on AAD in CPS from 2013 to November 2023. We introduce a novel taxonomy considering attack types, CPS application, learning paradigm, data management, and algorithms. Our findings show that most studies addressed either model adaptation or data processing, but rarely both simultaneously. This indicates a research gap in fully adaptive solutions. We also categorize algorithms, datasets, and attack characteristics, and summarize strengths and weaknesses across the literature. Our review provides a structured and accessible reference for researchers and practitioners, offering insights into key trends and highlighting limitations in current approaches. Finally, we outline several future research directions, including the need for integrated real-time processing and adaptive learning, explainability, and uncertainty quantification in AAD for CPS.

Adaptation↗
DOE OSTI2025

Securing Smart Manufacturing: Detection of Cyber-Physical Attacks in CNC-Based Systems

As Industry 4.0 advances, the integration of computer numerical control (CNC) machines and advanced manufacturing technologies is transforming production into smart manufacturing systems that blend physical and digital processes as cyber-physical systems. However, this increased cyber-physical connectivity exposes manufacturing systems to cyber threats that can cause severe operational and financial disruptions. This paper presents a comparative study on cyber attacks and anomaly detection techniques in manufacturing, focusing on network traffic from CNC machines. The data extracted from network packets includes machine commands and control signals exchanged between the machine's interface and control system, crucial for maintaining operational integrity. We explore two types of cyber attacks, design modification and command injection, which pose substantial risks to CNC machine productivity and system integrity. Our investigation involves experiments on a real CNC system, highlighting the urgent need for effective detection mechanisms. To address these threats, we evaluate three anomaly detection methods: dynamic time warping (DTW), rolling average, and a deep learning, long short-term memory (LSTM) time-series-based autoencoder. Each is assessed for its effectiveness in identifying anomalous behaviors caused by the attacks. Our findings demonstrate the unique strengths and limitations of each detection technique, providing a deeper understanding of their applicability in realworld manufacturing environments. The comparative analysis indicates that while certain methods are highly effective against specific attack types, others offer broader applicability across different attacks. This study contributes to the accurate detection of anomalies in CNC machining processes, thereby enhancing the reliability and security of smart manufacturing systems against diverse cyber threats.

Williams, Bethanie [Tennessee Technological Univer↗
DOE OSTI2024

Using Signal Clustering Similarity for Detecting CAN Masquerade Attacks

The computer code assumes that time series representing the physical signals of the vehicle have been extracted from the CAN bus. The main input of the computer code is the multivariate time series representation of the signals in the CAN bus. The computer code cluster these time series using agglomerative hierarchical clustering from benign and attack datasets. Based on this, it generates probability distributions from the similarity of the obtained clusters based in each scenario---benign and attack---using the CluSim method (https://github.com/Hoosier-Clusters/clusim). Finally, it compares how a new data collection compares with the previous distribution to provide and probability score for an intrusion.

Moriano, Pablo↗
DOE OSTI2021

Detecting False Data Injection Attacks in Smart Grids: A Semi-Supervised Deep Learning Approach

The dependence on advanced information and communication technology increases the vulnerability in smart grids under cyber-attacks. Recent research on unobservable false data injection attacks (FDIAs) reveals the high risk of secure system operation, since these attacks can bypass current bad data detection mechanisms. To mitigate this risk, this paper proposes a data-driven learning-based algorithm for detecting unobservable FDIAs in distribution systems. We use autoencoders for efficient dimension reduction and feature extraction of measurement datasets. Further, we integrate the autoencoders into an advanced generative adversarial network (GAN) framework, which successfully detects anomalies under FDIAs by capturing the unconformity between abnormal and secure measurements. Also, considering that the datasets collected from practical power systems are partially labeled due to expensive labeling costs and missing labels, the proposed method only requires a few labeled measurement data in addition to unlabeled data for training. Numerical simulations in three-phase unbalanced IEEE 13-bus and 123-bus distribution systems validate the detection accuracy and efficiency of this method.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

Detection of Control Injection Attacks using Energy Data Anomalies in CNC Machining

The widespread adoption of networked devices, sophisticated automation, and data-driven processes in the industry - also known as Industry 4.0 - has boosted the quantity and quality of manufacturing products. With these benefits, however, comes a substantial increase in the attack surface of these systems. In addition to affecting the readiness and the quality of critical products, the attacks against manufacturing processes and systems carry the potential to have severe physical consequences, including human injury and death. In this paper we present the results of a remote network-based control injection attack on a CNC mill. Specifically, we focus on the impact of this type of the attack on the movement of CNC mill during operation. Evaluating the physical effect of these attacks on a workpiece, we provide machine agnostic, affordable, and scalable solution for their monitoring. We then demonstrate a simple threshold-based method for the detection of these attacks and evaluate the effectiveness of detection.

Taylor, Curtis↗
DOE OSTI2023

Detection of False Data Injection Attacks in Battery Stacks Using Input Noise-Aware Nonlinear State Estimation and Cumulative Sum Algorithms

Grid-scale battery energy storage systems (BESSs) are vulnerable to false data injection attacks (FDIAs), which could be used to disrupt state of charge (SoC) estimation. Inaccurate SoC estimation has negative impacts on system availability, reliability, safety, and the cost of operation. In this article a combination of a Cumulative Sum (CUSUM) algorithm and an improved input noise-aware extended Kalman filter (INAEKF) is proposed for the detection and identification of FDIAs in the voltage and current sensors of a battery stack. The series-connected stack is represented by equivalent circuit models, the SoC is modeled with a charge reservoir model and the states are estimated using the INAEKF. Further, the root mean squared error of the states’ estimation by the modified INAEKF was found to be superior to the traditional EKF. By employing the INAEKF, this article addresses the research gap that many state estimators make asymmetrical assumptions about the noise corrupting the system. Additionally, the INAEKF estimates the input allowing for the identification of FDIA, which many alternative methods are unable to achieve. The proposed algorithm was able to detect attacks in the voltage and current sensors in 99.16% of test cases, with no false positives. Utilizing the INAEKF compared to the standard EKF allowed for the identification of FDIA in the input of the system in 98.43% of test cases.

25 ENERGY STORAGE↗
DOE OSTI2024

Achieving Cyber-Resilience for Power Systems using a Learning, Model-Assisted Blockchain Framework

The secure integration and management of distributed energy resources (DER) and power aggregators in the electric grid requires secure communications and a physics-aware Command and Control (C2) strategy. A Blockchain (BC)-based overlay network was developed to provide a security layer for the existing power grid network that mitigates risks in current and legacy network and C2 protocols. By integrating a Model-Assisted Machine Learning (MAML) framework with a Secure Blockchain Overlay Network (SBON) a defense-in-depth strategy was achieved. In our approach, the MAML framework leveraged a smart contract framework to gather network data and learn the dynamics of DER to develop detection strategies for attacks targeting sensors and actuators used by DER. The MAML framework learned dynamical systems models for individual DERs to detect sensor attacks. For DER we utilized a Digital Twin (DT) to accelerate the learning process for a model resistant to stealthy attacks. The project created DT for PV inverters and BESS. The DTs were coupled with a model-assisted, data-driven learning of DER behavior. Specifically, we evaluated architectures for model-based learning with model-free fine-tuning. Additionally, differential privacy techniques were used to obfuscate data, while still allowing the computation of attack detection results based on obfuscated data. The SBON developed leverages a private permissioned blockchain network orchestrated with the Hyperledger Fabric framework. To connect the cyber world, which orchestrates the blockchain fabric, and the physical world where the power network resides, we developed a system implementation to enable the secure interaction of the physical world and the abstracted blockchain.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

Enhancing Automotive Intrusion Detection Through Multi-Modal Fusion: A CAN FD-LiDAR Approach

As vehicles become smarter and more autonomous, they increasingly depend on advanced sensors and communication technologies to operate securely. However, such growing dependence on technology—whether it’s CAN (Controller Area Network) for internal communication or LiDAR (Light Detection and Ranging) for sensing the world around them—also expands the attack surface for the types of cyber attacks. Traditional intrusion detection systems (IDS) typically monitor these systems in isolation, limiting their ability to detect sophisticated, crosssystem attacks. To address this, we propose a multi-modal fusion approach that combines real-world CAN FD signals (from the HCRL dataset) with LiDAR features (from the nuScenes dataset) to enhance attack detection. Our method employs a twostage ensemble approach. Calibrated XGBoost and LightGBM models initially process CAN FD (Fuzzing Data) and LiDAR data independently, detecting timing anomalies and space abnormalities. They are subsequently logarithmically combined with a logistic regression meta-model along with 17 engineered features capturing cross-modal behavior, prediction conflicts, and nonlinear interactions. This approach achieves an AUC of 0.87 and an F1-score of 0.82, surpassing single-modality baselines and early fusion methods, at merely 2 ms inference latency. Compared with deep learning competitors, it is 3 times more efficient, providing a lightweight, interpretable, and real time solution to automotive cybersecurity.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

Trust-Based Detection and Mitigation of Cyber Attacks in Distributed Cooperative Control of Islanded AC Microgrids

In this study, we address the challenge of detecting and mitigating cyber attacks in the distributed cooperative control of islanded AC microgrids, with a particular focus on detecting False Data Injection Attacks (FDIAs), a significant threat to the Smart Grid (SG). The SG integrates traditional power systems with communication networks, creating a complex system with numerous vulnerable links, making it a prime target for cyber attacks. These attacks can lead to the disclosure of private data, control network failures, and even blackouts. Unlike machine learning-based approaches that require extensive datasets and mathematical models dependent on accurate system modeling, our method is free from such dependencies. To enhance the microgrid’s resilience against these threats, we propose a resilient control algorithm by introducing a novel trustworthiness parameter into the traditional cooperative control algorithm. Our method evaluates the trustworthiness of distributed energy resources (DERs) based on their voltage measurements and exchanged information, using Kullback-Leibler (KL) divergence to dynamically adjust control actions. We validated our approach through simulations on both the IEEE-34 bus feeder system with eight DERs and a larger microgrid with twenty-two DERs. The results demonstrated a detection accuracy of around 100%, with millisecond range mitigation time, ensuring rapid system recovery. Additionally, our method improved system stability by up to almost 100% under attack scenarios, showcasing its effectiveness in promptly detecting attacks and maintaining system resilience. These findings highlight the potential of our approach to enhance the security and stability of microgrid systems in the face of cyber threats.

Computer Science↗
DOE OSTI2024

Building Intelligence with Layered Defense Using Security-Constrained Optimization and Security Risk Detection (BUILD-SOS): A Probabilistic Approach

In this project, we employ a layered protection strategy incorporating advanced optimization and detection techniques using a probabilistic approach. The probabilistic approach is not only applied when detecting cyber attacks, but also incorporated in control strategies, which greatly increases the attacking difficulties. Hackers need to understand both probabilistic detection algorithms and uncertainty modeling methods in control in order to execute any effective attacks. The end-to-end solutions enable us to provide Building Intelligence with Layered Defense using Security-Constrained Optimization and Security Risk Detection (BUILD-SOS).

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗
DOE OSTI2024

Online Dynamic Cyber-Attack Diagnosis in Power Electronics Systems Based on Few-Shot Learning

With increasing exposure to software-based sensing and control, power electronics systems are facing higher risks of cyber-physical attacks. To ensure system stability and minimize potential economic losses, it is critical to monitor the operating states and detect those attacks at the early stage. However, anomaly detection and diagnosis of attacks are still challenging, especially when labeled anomaly data is difficult or even infeasible to obtain. To overcome this problem, we propose a Few-Shot Learning (FSL) based approach for cyber-attack diagnosis leveraging the waveform data. To the best of our knowledge, this work is the first attempt at leveraging FSL for cyber-attack diagnosis in power electronics systems. Extensive experimental results demonstrate that our proposed approach can achieve comparable diagnosis accuracy with the state-of-the-art data-driven methods using less than 0.04% of the training samples.

Li, Qi↗