Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “cyber modeling”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 73 records · Page 4
All sourcesNASA NTRSDOE OSTI
DOE OSTI2021

Foundations of Rigorous Cyber Experimentation

This report presents the results of the “Foundations of Rigorous Cyber Experimentation” (FORCE) Laboratory Directed Research and Development (LDRD) project. This project is a companion project to the “Science and Engineering of Cyber security through Uncertainty quantification and Rigorous Experimentation” (SECURE) Grand Challenge LDRD project. This project leverages the offline, controlled nature of cyber experimentation technologies in general, and emulation testbeds in particular, to assess how uncertainties in network conditions affect uncertainties in key metrics. We conduct extensive experimentation using a Firewheel emulation-based cyber testbed model of Invisible Internet Project (I2P) networks to understand a de-anonymization attack formerly presented in the literature. Our goals in this analysis are to see if we can leverage emulation testbeds to produce reliably repeatable experimental networks at scale, identify significant parameters influencing experimental results, replicate the previous results, quantify uncertainty associated with the predictions, and apply multi-fidelity techniques to forecast results to real-world network scales. The I2P networks we study are up to three orders of magnitude larger than the networks studied in SECURE and presented additional challenges to identify significant parameters. The key contributions of this project are the application of SECURE techniques such as UQ to a scenario of interest and scaling the SECURE techniques to larger network sizes. This report describes the experimental methods and results of these studies in more detail. In addition, the process of constructing these large-scale experiments tested the limits of the Firewheel emulation-based technologies. Therefore, another contribution of this work is that it informed the Firewheel developers of scaling limitations, which were subsequently corrected.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Systems and methods for global cyber-attack or fault detection model

An industrial asset may have monitoring nodes that generate current monitoring node values representing a current operation of the industrial asset. An abnormality detection computer may detect when a monitoring node is currently being attacked or experiencing a fault based on a current feature vector, calculated in accordance with current monitoring node values, and a detection model that includes a decision boundary. A model updater (e.g., a continuous learning model updater) may determine an update time-frame (e.g., short-term, mid-term, long-term, etc.) associated with the system based on trigger occurrence detection (e.g., associated with a time-based trigger, a performance-based trigger, an event-based trigger, etc.). The model updater may then update the detection model in accordance with the determined update time-frame (and, in some embodiments, continuous learning).

Xu, Rui↗
DOE OSTI2023

Hybrid Cyber-attack Detection in Photovoltaic Farms

Here, to address the cyber-physical security in PV farms, a hybrid cyber-attack detection is proposed in this manuscript. To secure PV farms, the proposed method integrates model-based and data-driven methods by fusing the detection score at the device and system levels. First, a model-based cyber-attack detection method is developed for each PV inverter. A residual between the estimation of the Kalman filter and measurement is calculated. By leveraging the calculated residual from all inverters, a squared Mahalanobis distance is developed for device detection score generation. At the system level, a convolutional neural network (CNN) is proposed to detect cyber-attack using the waveform data at the point of common coupling (PCC) in PV farms. To improve the CNN detection accuracy, a set of well-designed features are extracted from the raw waveform data. Finally, a weighted detection score fusion method is proposed to combine device and system detection scores by using their complementary strength. The feasibility and robustness of the proposed method are validated by testing cases and a comparative experiment.

14 SOLAR ENERGY↗
DOE OSTI2025

Cyber-Informed Engineering (CIE) Integration into Model- Based Systems Engineering (MBSE)

Engineering design in the field of industrial engineering, such as designing automated factories or warehouses, is critical for the effective operation of facilities. Any design flaws introduced early can result in significant capital expenses to correct. However, early-stage engineering design is inherently complex. The systems are not yet built, requiring designers to integrate various aspects, including digital engineering and cybersecurity, to support virtual representations throughout the design process. In this study, we propose an approach to integrate Cyber-Informed Engineering (CIE) principles into model-based systems engineering (MBSE). This approach facilitates the development of a digital thread for engineering systems, ensuring secure digital artifacts in the design of industrial engineering systems.

42 - ENGINEERING↗
DOE OSTI2020

Adaptive Neuro Fuzzy Inference System for Cyber-Intrusion Detection in a Smart Grid

The evolution of the power grid has brought increasing deployment of advance metering infrastructure, penetration of intelligent electronic devices, and integration of physical power system components with information and communications technologies. With the fast-expanding connectivity, cyber vulnerabilities arise due to the use of internet-based communication systems. These systems are targets of cyber-intrusions which attempt to disturb the normal power system functions. Traditional intrusion detection algorithms have been developed without an explicit model of the cyber components. In this paper, an algorithm to detect false data injections in the power system is proposed considering both cyber and physical models of the power system. The algorithm is based on an Adaptive Neuro Fuzzy Inference System (ANFIS) which collects information from state variables of the cyber-physical system to meet the performance requirements of the grid. Simulations of the proposed approach using the IEEE 13-bus test system validate the effectiveness of this artificial intelligence-based algorithm.

Adaptive Neuro Fuzzy Inference System (ANFIS), cyb↗
DOE OSTI2023

High-fidelity model-driven deception platform for cyber-physical systems

Methods are described for protecting a cyber-physical system against a potential attacker of the system. The methods include a method of generating a plurality of examples for a training data set and training a system model using the training data set to generate a decoy configured to generate a synthetic output that mimics historical outputs generated by the system for a given historical system context. Also described is a method including receiving a system context of a cyber-physical system; receiving an inquiry into the system by a potential attacker; applying a system model to the system context and the inquiry; obtaining from the system model a synthetic output that mimics how a component of the system would respond to the inquiry given the system context; and providing the synthetic output to the potential attacker.

Edgar, Thomas W.↗
DOE OSTI2022

Model-Based Diagnostics and Mitigation of Cyber Threats

The report summarizes key tasks performed to develop a toolkit for detecting cyber-attack events in instrumentation and control (I&C) systems of nuclear power plants. The toolkit connects the state-of-the-art GPWR Simulator with the RELAP5 code providing best-estimate nuclear steam supply system (NSSS) analyses, via the application programming interface (API), and allows users to introduce potential cyber-attack scenarios into power plant operational simulation. This summary for the project reflects topical reports submitted during the project as well as a journal paper published in 2022. The focus areas of the summary include: (1) modeling I&C systems for the AP1000 Generation III+ nuclear plant and GPWR simulator, (2) simulation and monitoring of plant response to cyber-attack events, (3) API structure for the toolkit interfacing the GPWR simulator and RELAP5 code, and (4) restructuring of the three-loop NSSS software of GPWR to model the two-loop AP1000 structure. Discussed in some details are (a) the attack tree analysis assessing the susceptibility of the AP1000 I&C system, resulting in reactor trips, in terms of the attack possibility and component sensitivity and (b) realistic estimation of the time to steam generator trip due to cyber-intrusions in the GPWR Simulator. Finally, sample demonstrations of the cyber-security tool kit, in the form of the GPWR-RELAP5 API, are summarized.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2023

Encrypted model predictive control design for security to cyberattacks

Abstract In recent years, cyber‐security of networked control systems has become crucial, as these systems are vulnerable to targeted cyberattacks that compromise the stability, integrity, and safety of these systems. In this work, secure and private communication links are established between sensor–controller and controller–actuator elements using semi‐homomorphic encryption to ensure cyber‐security in model predictive control (MPC) of nonlinear systems. Specifically, Paillier cryptosystem is implemented for encryption‐decryption operations in the communication links. Cryptosystems, in general, work on a subset of integers. As a direct consequence of this nature of encryption algorithms, quantization errors arise in the closed‐loop MPC of nonlinear systems. Thus, the closed‐loop encrypted MPC is designed with a certain degree of robustness to the quantization errors. Furthermore, the trade‐off between the accuracy of the encrypted MPC and the computational cost is discussed. Finally, two chemical process examples are employed to demonstrate the implementation of the proposed encrypted MPC design.

Suryavanshi, Atharva↗
DOE OSTI2025

Deep Cyber-Physical Situational Awareness for Energy Systems: A Secure Foundation for Next-Generation Energy Management

This document provides the final report for the CYPRES project. The purpose is (1) to highlight and summarize its major accomplishments and (2) to provide guidance on how its outcomes have informed and can inform important additional research and technology transfer. The goal of CYPRES was the research, development, and demonstration of a security-oriented next generation cyber-physical EMS for electric power systems that detects malicious and abnormal events through the fusion of cyber and physical data. To achieve this, the CYPRES project team researched, developed, and built a prototype of the solution, referred to as the CYPRES EMS. The CYPRES EMS is a proof-of-concept cyber-physical platform that demonstrates the management of the energy system, communications, security, and cyber-physical grid modeling and analytics. As part of the capabilities of the CYPRES EMS, the team designed and developed a suite of power system applications for monitoring, risk analyses, detection, and control that are inherently cyberaware. At its core, the project aimed to research, develop, and demonstrate a security-oriented next-generation cyber-physical Energy Management System (EMS) capable of detecting malicious and abnormal events through the innovative fusion of cyber and physical data. This approach represents a fundamental shift from traditional EMS, reimagining how critical infrastructure can be protected through unified cyber-aware and physics-aware secure data flow pipelines. The project’s cornerstone deliverable, the CYPRES EMS, serves as a proof-of-concept cyber-physical platform that revolutionizes the management of energy systems, communications, security, and cyber-physical grid modeling and analytics. This prototype implements a comprehensive suite of power system applications for monitoring, risk analyses, detection, and control, all designed with inherent cyber awareness. The system’s architecture extends from end-devices in the field through to control center applications, establishing a secure and resilient control framework that addresses the challenges posed by diverse devices of unknown trustworthiness connecting to modern power systems. Through this innovative approach to deep cyber-physical situational awareness, the CYPRES project not only advances the state-of-the-art in energy infrastructure protection but also establishes a new paradigm for how EMS can be designed, deployed, and operated in an increasingly complex threat landscape. The findings and developments from this project provide crucial insights for stakeholders across the energy sector, offering a blueprint for enhancing the reliability and resilience of our nation’s critical energy infrastructure in the face of evolving cyber threats.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

Cyber-Attack Detection for Active Neutral Point Clamped (ANPC) Photovoltaic (PV) Converter using Kalman Filter

With the upgrading of communication technology, cyber threats to power converters are increasing. In this paper, a model-based cyber-attack detection methodology is proposed for the interleaved Active neutral point clamped (ANPC) Photovoltaic (PV) converter. The proposed methodology identifies cyber-attacks using two estimations based on the Kalman filter and the state-space model of the ANPC PV converter. The residual between the two estimations is analyzed from a statistical perspective. Based on the Cumulative Sum (CUSUM) Control Chart, the standard errors shift of the residual is used to identify cyber-attacks. Besides, to validate the feasibility of the proposed methodology, several conditions are considered in the simulation, including white noise in the sensor, irradiance variation, and cyber-attacks in the PV converter. Furthermore, the simulation result demonstrates the proposed method can identify cyber-attacks in the ANPC PV converter.

14 SOLAR ENERGY↗
DOE OSTI2024

Scalable Control Co-design for Resilient-by-Design Cyber Physical Systems

Critical infrastructure networks, such as power and transportation networks, are often modelled as cyber-physical systems. With ever increasing complexity of these systems, there is a need for newer and more relevant metrics and design tools that will co-optimize the physical system components and control policies to guarantee resilience against cyber and natural threats. To this end, a simulation-based control co-design computational framework that will concurrently determine the system and control parameters of a cyber-physical system to meet pre-specified resilience, operational and economic objectives has been developed. The capabilities of the developed co-design engine are demonstrated by designing the physical components and control parameters of a microgrid system that will meet its resiliency objectives when subjected to various cyber and physical threats.

42 ENGINEERING↗
DOE OSTI2021

Modeling Data Flows with Network Calculus in Cyber-Physical Systems: Enabling Feature Analysis for Anomaly Detection Applications

The electric grid is becoming increasingly cyber-physical with the addition of smart technologies, new communication interfaces, and automated grid-support functions. Because of this, it is no longer sufficient to only study the physical system dynamics, but the cyber system must also be monitored as well to examine cyber-physical interactions and effects on the overall system. To address this gap for both operational and security needs, cyber-physical situational awareness is needed to monitor the system to detect any faults or malicious activity. Techniques and models to understand the physical system (the power system operation) exist, but methods to study the cyber system are needed, which can assist in understanding how the network traffic and changes to network conditions affect applications such as data analysis, intrusion detection systems (IDS), and anomaly detection. In this paper, we examine and develop models of data flows in communication networks of cyber-physical systems (CPSs) and explore how network calculus can be utilized to develop those models for CPSs, with a focus on anomaly and intrusion detection. This provides a foundation for methods to examine how changes to behavior in the CPS can be modeled and for investigating cyber effects in CPSs in anomaly detection applications.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

FIREWHEEL

SAND2024-16910O FIREWHEEL is a tool for experiment orchestration that assists a user in building and controlling repeatable experiments of distributed network systems at any scale. This version also includes FIREWHEEL v2.7 and its associated companion model components. With FIREWHEEL, users can easily construct modular parts of a cyber system, called Model Components. The Model Components can be combined to form an experiment. Most experiments are then instantiated using an emulation tool, such as minimega.

Kajder, Thomas↗
DOE OSTI2023

A Computational Framework for Control Co-Design of Resilient Cyber–Physical Systems With Applications to Microgrids

Critical infrastructure networks, such as power and transportation networks, can be modelled as cyber-physical systems. As the complexity of such systems grow, there is need for developing metrics and design tools that will co-optimize the physical components of the system and the control policies to guarantee resilience against cyber and natural threats. To that end, we develop a simulation-based control co-design computational framework that will concurrently determine the system and control parameters of a cyber-physical system to meet pre-specified resilience, operational and economic objectives. Here, the capabilities of the developed co-design engine is demonstrated by designing the physical components and control parameters of a microgrid system that will meet its resiliency objectives when subjected to various cyber and physical threats.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Experimental Validation of a Command and Control Traffic Detection Model

Network intrusion detection systems (NIDS) are commonly used to detect malware communications, including command-and-control (C2) traffic from botnets. NIDS performance assessments have been studied for decades, but mathematical modeling has rarely been used to explore NIDS performance. This paper details a mathematical model that describes a NIDS performing packet inspection and its detection of malware's C2 traffic. Here, the paper further describes an emulation testbed and a set of cyber experiments that used the testbed to validate the model. These experiments included a commonly used NIDS (Snort) and traffic with contents from a pervasive malware (Emotet). Results are presented for two scenarios: a nominal scenario and a “stressed” scenario in which the NIDS cannot process all incoming packets. Model and experiment results match well, with model estimates mostly falling within 95 % confidence intervals on the experiment means. Model results were produced 70-3000 times faster than the experimental results. Consequently, the model's predictive capability could potentially be used to support decisions about NIDS configuration and effectiveness that require high confidence results, quantification of uncertainty, and exploration of large parameter spaces. Furthermore, the experiments provide an example for how emulation testbeds can be used to validate cyber models that include stochastic variability.

mathematical model↗
DOE OSTI2025

Coreii - Scout

COREII Scout employs React, Vite, TypeScript, Tailwind, and Daisy UI for its graphical user interface (GUI), offering both dark and light modes. The code is modular, with components and reusable wrappers to enhance efficiency. The primary goal of COREII Scout is to aid analysts in collecting and analyzing various sources related to cyber attacks, utilizing models to automate the report writing process. It uses Named Entity Recognition (NER), a type of Natural Language Processing (NLP), to extract key entities from each source. Analysts review and classify these entities using the COREII Attack Chain Estimator (ACE), adding their comments. Ultimately, a Large Language Model (LLM) generates a detailed report with user guidance. This setup ensures a streamlined and effective approach to cyber attack analysis and reporting.

Pluth, Adam [Idaho National Laboratory (INL), Idah↗