Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “detection network”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 73 records · Page 4
All sourcesNASA NTRSDOE OSTI
DOE OSTI2025

Self-Supervised and Interpretable Anomaly Detection Using Network Transformers

Machine learning and deep neural networks (DNNs) have been proposed as a tool to identify anomalies in computer network communications. However, due the obfuscated nature of off-the-shelf machine learning models, their output often does not provide enough information to isolate the source of the anomaly to take corrective measures. In this article, we introduce the network transformer (NeT), a DNN model for anomaly detection that incorporates the graph structure of the communication network in order to improve interpretability. Further, the presented approach has the following advantages: first, enhanced interpretability by incorporating the graph structure of computer networks; second, provides a hierarchical set of features that enables analysis at different levels of granularity; second, self-supervised training that does not require labeled data. The NeT model was evaluated on a set of anomalous scenarios executed in a real industrial control system. The presented approach successfully identified the anomalies, the devices affected, and the specific connections causing the anomalies, providing a data-driven hierarchical approach to analyze the behavior of a cyber network.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2019

Network Community Detection on Small Quantum Computers

In recent years, a number of quantum computing devices with small numbers of qubits have become available. A hybrid quantum local search (QLS) approach that combines a classical machine and a small quantum device to solve problems of practical size is presented. Herein, the proposed approach is applied to the network community detection problem. QLS is hardware-agnostic and easily extendable to new quantum computing devices as they become available. It is demonstrated to solve the 2-community detection problem on graphs of sizes of up to 410 vertices using the 16-qubit IBM quantum computer and D-Wave 2000Q, and compare their performance with the optimal solutions. The results herein demonstrate that QLS performs similarly in terms of quality of the solution and the number of iterations to convergence on both types of quantum computers and it is capable of achieving results comparable to state-of-the-art solvers in terms of quality of the solution including reaching the optimal solutions.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

Using convolutional neural networks to detect edge localized modes in DIII-D from Doppler backscattering measurements

In H-mode tokamak plasmas, the plasma is sometimes ejected beyond the edge transport barrier. These events are known as edge localized modes (ELMs). ELMs cause a loss of energy and damage the vessel walls. Understanding the physics of ELMs, and by extension, how to detect and mitigate them, is an important challenge. In this paper, we focus on two diagnostic methods—deuterium-alpha (D α ) spectroscopy and Doppler backscattering (DBS). The former detects ELMs by measuring Balmer alpha emission, while the latter uses microwave radiation to probe the plasma. DBS has the advantages of having a higher temporal resolution and robustness to damage. These advantages of DBS diagnostic may be beneficial for future operational tokamaks, and thus, data processing techniques for DBS should be developed in preparation. In sight of this, we explore the training of neural networks to detect ELMs from DBS data, using D α data as the ground truth. With shots found in the DIII-D database, the model is trained to classify each time step based on the occurrence of an ELM event. The results are promising. When tested on shots similar to those used for training, the model is capable of consistently achieving a high f1-score of 0.93. Furthermore, this score is a performance metric for imbalanced datasets that ranges between 0 and 1. We evaluate the performance of our neural network on a variety of ELMs in different high confinement regimes (grassy ELM, RMP mitigated, and wide-pedestal), finding broad applicability. Beyond ELMs, our work demonstrates the wider feasibility of applying neural networks to data from DBS diagnostic.

70 PLASMA PHYSICS AND FUSION TECHNOLOGY↗
DOE OSTI2025

Adaptive Client Selection in Federated Learning: A Network Anomaly Detection Use Case

Federated Learning (FL) has become a ubiquitous approach for training machine learning models on decentralized data, addressing the myriad privacy concerns inherent in traditional centralized methods. However, the efficiency of FL depends on effective client selection and robust privacy preservation mechanisms. Inadequate client selection may lead to suboptimal model performance, while insufficient privacy measures risk exposing sensitive data. This paper proposes a client selection framework for FL that integrates differential privacy and fault tolerance. Our adaptive approach dynamically adjusts the number of selected clients based on model performance and system constraints, ensuring privacy through calibrated noise addition. We evaluate our method on a network anomaly detection use case using the UNSW-NB15 and ROAD datasets. Results show up to a 7% increase in accuracy and a 25% reduction in training time compared to FedL2P. Moreover, we highlight the trade-offs between privacy budgets and model performance, with higher privacy budgets reducing noise and improving accuracy. Our fault tolerance mechanism, while causing a slight performance drop, enhances robustness to client failures. Statistical validation using Mann-Whitney U tests confirms the significance of these improvements (p < 0.05).

Marfo, William [University of Texas at El Paso,Dep↗
DOE OSTI2017

Path scanning for the detection of anomalous subgraphs and use of DNS requests and host agents for anomaly/change detection and network situational awareness

A system, apparatus, computer-readable medium, and computer-implemented method are provided for detecting anomalous behavior in a network. Historical parameters of the network are determined in order to determine normal activity levels. A plurality of paths in the network are enumerated as part of a graph representing the network, where each computing system in the network may be a node in the graph and the sequence of connections between two computing systems may be a directed edge in the graph. A statistical model is applied to the plurality of paths in the graph on a sliding window basis to detect anomalous behavior. Data collected by a Unified Host Collection Agent ("UHCA") may also be used to detect anomalous behavior.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2019

Path scanning for the detection of anomalous subgraphs and use of DNS requests and host agents for anomaly/change detection and network situational awareness

A system, apparatus, computer-readable medium, and computer-implemented method are provided for detecting anomalous behavior in a network. Historical parameters of the network are determined in order to determine normal activity levels. A plurality of paths in the network are enumerated as part of a graph representing the network, where each computing system in the network may be a node in the graph and the sequence of connections between two computing systems may be a directed edge in the graph. A statistical model is applied to the plurality of paths in the graph on a sliding window basis to detect anomalous behavior. Data collected by a Unified Host Collection Agent (“UHCA”) may also be used to detect anomalous behavior.

Neil, Joshua Charles↗
DOE OSTI2024

SNNPG: Using Spiking Neural Networks to Detect Attacks in the Power Grid

We explore the potential of Spiking Neural Networks (SNN) to enhance the security of power grid operations by detecting False Data Injection (FDI) attacks. These attacks manipulate PMU readings, leading to erroneous control decisions and grid disruptions. We develop a method to convert Phase Measurement Unit (PMU) data into spike trains, capturing both temporal and spatial dimensions. Using an SNN model, we conduct evaluations with simulated power grid data, showcasing accuracy in detecting FDI attacks. SNN models rapidly identify anomalies in real-time PMU data, safeguarding grid operations by alerting operators to irregular readings and preventing incorrect decisions.

artificial intelligence↗
DOE OSTI2021

Individual Wave Detection and Tracking within a Rotating Detonation Engine through Computer Vision Object Detection applied to High-Speed Images

Known for their simplistic design and continuous detonation, rotating detonation engines (RDEs) constitute a majority of current pressure gain combustion (PGC) research efforts. Experimental RDE operation times have been continuously extended through the use of rig cooling techniques. As the window of observable behavior is expanded, and as the technology matures toward eventual integration within gas turbines, monitoring techniques must evolve to better match industrial diagnostics. High-speed image analysis techniques prove useful to capture and evaluate the unsteady detonation behavior within the RDE. Traditional image analysis techniques, however, require extensive processing times which prohibit simultaneous monitoring. To better address this problem, a computer vision object detection methodology is proposed to quickly detect individual detonation waves within a single down-axis image. Detonation waves are detected in individual images by the implemented computer vision method You Only Look Once (YOLO) object detection network. In order to detect detonation waves, the network must first be trained using RDE images of interest, for which each required phase of network development is outlined. Detection of waves is improved through proper treatment of the collected image set, variation of Intersection over Union (IoU) and confidence thresholding, and through a parametric study of annotation dimensions. Each detected wave is described by its location and rotational direction, and locations are tracked to calculate wave velocity across each frame, leading to a timestep resolution of 20 µs. Wave velocities are also calculated through a series of frames, leading to a suitable average velocity estimation using as few as 10 frames. Uncertainty analysis accounting for variation in camera framerate, pixel width and annotation centroid locations estimates a total uncertainty of ±4.3% for velocity calculations, using the smallest annotation boxes. This method offers great reductions in processing times, as a step toward real-time monitoring of detonation waves within an RDE. Improving on previous studies, this technique is impartial to wave modes not included in the original training set and calculates wave velocities independent of high-speed pressure data. The ability to isolate waves within predicted bounding boxes will likely facilitate analysis of pixel intensity variation as an estimation of wave strength in future work.

Johnson, Kristyn↗
DOE OSTI2021

Individual Wave Detection and Tracking within a Rotating Detonation Engine through Computer Vision Object Detection applied to High-Speed Images

Known for their simplistic design and continuous detonation, rotating detonation engines (RDEs) constitute a majority of current pressure gain combustion (PGC) research efforts. Experimental RDE operation times have been continuously extended through the use of rig cooling techniques. As the window of observable behavior is expanded, and as the technology matures toward eventual integration within gas turbines, monitoring techniques must evolve to better match industrial diagnostics. High-speed image analysis techniques prove useful to capture and evaluate the unsteady detonation behavior within the RDE. Traditional image analysis techniques, however, require extensive processing times which prohibit simultaneous monitoring. To better address this problem, a computer vision object detection methodology is proposed to quickly detect individual detonation waves within a single down-axis image. Detonation waves are detected in individual images by the implemented computer vision method You Only Look Once (YOLO) object detection network. In order to detect detonation waves, the network must first be trained using RDE images of interest, for which each required phase of network development is outlined. Detection of waves is improved through proper treatment of the collected image set, variation of Intersection over Union (IoU) and confidence thresholding, and through a parametric study of annotation dimensions. Each detected wave is described by its location and rotational direction, and locations are tracked to calculate wave velocity across each frame, leading to a timestep resolution of 20 µs. Wave velocities are also calculated through a series of frames, leading to a suitable average velocity estimation using as few as 10 frames. Uncertainty analysis accounting for variation in camera framerate, pixel width and annotation centroid locations estimates a total uncertainty of ±4.3% for velocity calculations, using the smallest annotation boxes. This method offers great reductions in processing times, as a step toward real-time monitoring of detonation waves within an RDE. Improving on previous studies, this technique is impartial to wave modes not included in the original training set and calculates wave velocities independent of high-speed pressure data. The ability to isolate waves within predicted bounding boxes will likely facilitate analysis of pixel intensity variation as an estimation of wave strength in future work.

Johnson, Kristyn↗
DOE OSTI2023

Graph neural networks for detecting anomalies in scientific workflows

Identifying and addressing anomalies in complex, distributed systems can be challenging for reliable execution of scientific workflows. We model these workflows as directed acyclic graphs (DAGs), where the nodes and edges of the DAGs represent jobs and their dependencies, respectively. We develop graph neural networks (GNNs) to learn patterns in the DAGs and to detect anomalies at the node (job) and graph (workflow) levels. We investigate workflow-specific GNN models that are trained on a particular workflow and workflow-agnostic GNN models that are trained across the workflows. Our GNN models, which incorporate both individual job features and topological information from the workflow, show improved accuracy and efficiency compared to conventional learning methods for detecting anomalies. While joint trained with multiple scientific workflows, our GNN models reached an accuracy more than 80% for workflow level and 75% for job level anomalies. In addition, we illustrate the importance of hyperparameter tuning method in our study that can significantly improve the metric(s) measure of evaluating the GNN models. Finally, we integrate explainable GNN methods to provide insights on job features in the workflow that cause an anomaly.

97 MATHEMATICS AND COMPUTING↗
NASA NTRS2012

Future Expansion of the Lightning Surveillance System at the Kennedy Space Center and the Cape Canaveral Air Force Station, Florida, USA

The NASA Kennedy Space Center (KSC) and the Air Force Eastern Range (ER) use data from two cloud-to-ground (CG) lightning detection networks, the Cloud-to-Ground Lightning Surveillance System (CGLSS) and the U.S. National Lightning Detection Network (NLDN), and a volumetric mapping array, the lightning detection and ranging II (LDAR II) system: These systems are used to monitor and characterize lightning that is potentially hazardous to launch or ground operations and hardware. These systems are not perfect and both have documented missed lightning events when compared to the existing lightning surveillance system at Launch Complex 39B (LC39B). Because of this finding it is NASA's plan to install a lightning surveillance system around each of the active launch pads sharing site locations and triggering capabilities when possible. This paper shows how the existing lightning surveillance system at LC39B has performed in 2011 as well as the plan for the expansion around all active pads.

Mata, C. T.↗
DOE OSTI2017

Performance Assessment of the CTBTO Noble Gas Network to Detect Nuclear Explosions

Atmospheric radioxenon levels are monitored worldwide by the Comprehensive Nuclear-Test-Ban Treaty Organisation (CTBTO) to detect emissions from nuclear explo-sions. Our paper examines the global network that has been set up to take routine air samples and to determine the atmospheric radioxenon concentrations. It is hypothesised that the monitoring system aims at the detection and localisation of radioxenon relea-ses. Both capabilities are dependent on background levels, explosive yields, leakage rates, transport time, choice of xenon isotope and number and locations of monitoring stations. And for each parameter, the global capabilities to detect and localise emissions from nuclear explosions are analysed. Recommendations for the future of the background sources and the development of the monitoring system are derived.

54 ENVIRONMENTAL SCIENCES↗
NASA NTRS2008

Classification of Small Negative Lightning Reports at the KSC-ER

The NASA Kennedy Space Center (KSC) and Air Force Eastern Range (ER) operate an extensive suite of lightning sensors because Florida experiences the highest area density of ground strikes in the United States, with area densities approaching 16 fl/sq km/yr when accumulated in 10x10 km (100 sq km) grids. The KSC-ER use data derived from two cloud-to-ground (CG) lightning detection networks, the "Cloud-to-Ground Lightning Surveillance System" (CGLSS) and the U.S. National Lightning Detection Network (TradeMark) (NLDN) plus a 3-dimensional lightning mapping system, the Lightning Detection and Ranging (LDAR) system, to provide warnings for ground operations and to insure mission safety during space launches. For operational applications at the KSC-ER it is important to understand the performance of each lightning detection system in considerable detail. In this work we examine a specific subset of the CGLSS stroke reports that have low values of the negative inferred peak current, Ip, i.e. values between 0 and -7 kA, and were thought to produce a new ground contact (NGC). When possible, the NLDN and LDAR systems were used to validate the CGLSS classification and to determine how many of these reported strokes were first strokes, subsequent strokes in a pre-existing channel (PEC), or cloud pulses that the CGLSS misclassified as CG strokes. It is scientifically important to determine the smallest current that can reach the ground either in the form of a first stroke or by way of a subsequent stroke that creates a new ground contact. In Biagi et al (2007), 52 low amplitude, negative return strokes ([Ip] < or = 10 kA) were evaluated in southern Arizona, northern Texas, and southern Oklahoma. The authors found that 50-87% of the small NLDN reports could be classified as CG (either first or subsequent strokes) on the basis of video and waveform recordings. Low amplitude return strokes are interesting because they are usually difficult to detect, and they are thought to bypass conventional lightning protection that relies on a sufficient attractive radius to prevent "shielding failure" (Golde, 1977). They also have larger location errors compared to the larger current events. In this study, we use the estimated peak current provided by the CGLSS and the results of our classification to determine the minimum Ip for each category of CG stroke and its probability of occurrence. Where possible, these results are compared to the findings in the literature.

Ward, Jennifer G.↗
DOE OSTI2022

ThunderSecure: deploying real-time intrusion detection for 100G research networks by leveraging stream-based features and one-class classification network

Nowadays, data generated by large-scale scientific experiments are on the scale of petabytes per month. These data are transferred through dedicated high-bandwidth networks (40/100G) across distributed sites for processing, storage, and analysis. Like general purpose networks, research networks experience intrusions. However, monitoring anomalies in such high-speed network traffics is challenging given current cyber-infrastructure. Moreover, traditional network intrusion detection systems (NIDS) are signature based. However, anomaly patterns are difficult to define and that rulesets are often not updated frequently enough to reflect the changes of attack behaviors. We present ThunderSecure, a high-throughput, unsupervised learning-based intrusions detection system for 100G research networks. ThunderSecure implements an efficient packet processing and detection pipeline using multi-cores and GPUs. It extracts statistical and temporal features from real-time network data streams and feeds them to a one-class anomaly detection network. A baseline of normal distribution will be created based on the training observation. Testing traffic deviated from the learned profile will be marked as anomalies. We trained ThunderSecure on hundreds of billions of science data packets mirrored from two 100G network connections at Fermi National Accelerator Laboratory. The detection performance was evaluated on traffic captured from the same research network days and weeks after the training with different types of attack flows injected. Results show that ThunderSecure can recognize science data traffic captured long after the training and made nearly certain detection on the segment of the streams where anomalous flows were injected.

100G research network↗
NASA NTRS1992

Application of space-time neural networks to detect tether skiprope phenomenon in space operations

The feasibility of operating tethered payloads in earth orbit will be studied during a space shuttle flight scheduled for 1992. Tethered systems may exhibit a circular transverse oscillation or skiprope phenomenon due to interaction between the earth's magnetic field and current pulsing through the tether. Effective damping of this skiprope motion depends on rapid and accurate detection of its magnitude and phase. Satellite attitude motion has characteristic oscillations as well as many other perturbations and therefore the relationship between skiprope parameters and attitude time history is very complex and nonlinear. A space-time neural network (STNN) for filtering satellite rate gyro data is proposed for rapid detection and prediction of skiprope magnitude and phase. A validated orbital operations simulator and STNN software will be used for training and testing of this skiprope detection system. The advantages of STNNs are discussed and STNN configurations and preliminary results are presented.

Lea, Robert N.↗
DOE OSTI2018

Compression Analytics for Classification and Anomaly Detection within Network Communication

Here, the flexibility of network communication within Internet protocols is fundamental to network function, yet this same flexibility permits the possibility of malicious use. In particular, malicious behavior can masquerade as benign traffic, thus evading systems designed to catch misuse of network resources. However, perfect imitation of benign traffic is difficult, meaning that small unintentional deviations from normal can occur. Identifying these deviations requires that the defenders know what features reveal malicious behavior. Herein we present an application of compression-based analytics to network communication that can reduce the need for defenders to know a priori what features they need to examine. Motivating the approach is the idea that compression relies on the ability to discover and make use of predictable elements in information, thereby highlighting any deviations between expected and received content. We introduce a so-called “slice compression” score to identify malicious or anomalous communication in two ways. First, we apply normalized compression distances (NCDs) to classification problems and discuss methods for reducing the noise by excising application content (as opposed to protocol features) using slice compression. Second, we present a new technique for anomaly detection, referred to as slice compression for anomaly detection (SCADe). A diverse collection of datasets are analyzed to illustrate the efficacy of the proposed approaches. While our focus is network communication, other types of data are also considered to illustrate the generality of the method.

97 MATHEMATICS AND COMPUTING↗
NASA NTRS2004

Statistical analysis of geodetic networks for detecting regional events

We present an application of hidden Markov models (HMMs) to analysis of geodetic time series in Southern California. Our model fitting method uses a regularized version of the deterministic annealing expectation-maximization algorithm to ensure that model solutions are both robust and of high quality.

geodetic networks↗