Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “threat analysis”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 73 records · Page 4
All sourcesNASA NTRSDOE OSTI
DOE OSTI2025

Consequence Based Framework for Deployment of Cloud Solutions in the Digital Energy Transition

This study proposes a framework for evaluating cloud computing deployment in the electric sector, focusing on the digital transition of energy systems. It assesses the implications of cloud technology adoption, particularly in terms of security, operational resilience, and efficiency. The paper introduces a method for consequence-driven risk analysis, enabling utilities to prioritize and mitigate potential threats effectively. It also discusses the shared responsibility model in cloud computing, highlighting the need for collaborative security efforts. The research aims to provide utilities with a strategic assessment tool for cloud adoption, emphasizing the importance of security culture in enhancing cloud computing's role in critical infrastructure.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2021

Cyber Security Summer School 2021 [Slides]

LANL is committed to training the next generation of cyber security professionals and researchers for the US Department of Energy. Alumni are prepared to mitigate rapidly-evolving threats to national security by applying best-practice analysis and developing novel tools. The 2021 summer school ended with another recruiting success, recruiting 5 students into A-4,T, and NIE-- as staff or students. The research track students further strengthened LANL’s cyber mission by applying their skills to develop innovative solutions to help address national cyber threats. The investigation track students learned the necessary concepts and skills for responding effectively to cyber security incidents

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
DOE OSTI2025

Consequence Based Framework for Deployment of Cloud Solutions in the Digital Energy Transition

This study proposes a framework for evaluating cloud computing deployment in the electric sector, focusing on the digital transition of energy systems. It assesses the implications of cloud technology adoption, particularly in terms of security, operational resilience, and efficiency. The paper introduces a framework for consequence-driven applied risk analysis, enabling utilities to prioritize and mitigate potential threats effectively, and responsibly deploy cloud applications. It also discusses the shared responsibility model in cloud computing, highlighting the need for collaborative security efforts. The research aims to provide utilities with a strategic assessment tool for cloud adoption, emphasizing the importance of security culture in enhancing cloud computing's role in critical infrastructure.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2024

Could a Kilonova Kill: A Threat Assessment

Abstract Binary neutron star mergers produce high-energy emissions from several physically different sources, including a gamma-ray burst (GRB) and its afterglow, a kilonova (KN), and, at late times, a remnant many parsecs in size. Ionizing radiation from these sources can be dangerous for life on Earth-like planets when located too close. Work to date has explored the substantial danger posed by the GRB to on-axis observers; here we focus instead on the potential threats posed to nearby off-axis observers. Our analysis is based largely on observations of the GW170817/GRB 170817A multi-messenger event, as well as theoretical predictions. For baseline KN parameters, we find that the X-ray emission from the afterglow may be lethal out to ∼1 pc and the off-axis gamma-ray emission may threaten a range out to ∼4 pc, whereas the greatest threat comes years after the explosion, from the cosmic rays accelerated by the KN blast, which can be lethal out to distances up to ∼11 pc. The distances quoted here are typical, but the values have significant uncertainties and depend on the viewing angle, ejected mass, and explosion energy in ways we quantify. Assessing the overall threat to Earth-like planets, KNe have a similar kill distance to supernovae, but are far less common. However, our results rely on the scant available KN data, and multi-messenger observations will clarify the danger posed by such events.

Astronomy & Astrophysics↗
DOE OSTI2020

A thermodynamic analysis of hypervelocity impacts on metals

Hypervelocity impacts on solid surfaces generate and propagate shock waves and create extreme density, pressure, and temperature conditions. Understanding hypervelocity impacts requires a multi-physics approach at the intersection of fluid dynamics, solid mechanics, and quantum theory, which has the capability of spanning multiple different dominating physics regimes. These strong shock conditions found in hypervelocity impacts are studied in the context of high-speed collisions between spacecraft and meteoroids and debris. We study the problem of hypervelocity impacts on metals with the lens of understanding the processes that lead to the creation of an impact generated plasma. In order to characterize the impacting particle as well as its threat to spacecraft from the subsequent radiating plasma an analysis was performed that highlights how the kinetic energy of the impactor is deposited into a target, how the shock wave and shocked material in the target evolve, and how these effects can lead towards the creation of an impact plasma through heating. The analysis suggests that at low velocities the majority of the energy from a hypervelocity impact is stored in reversible elastic energy and does not contribute to strong heating. At higher impact velocities, nucleus and electron thermal components dominate, increasing the energy available for ionization. Overall, this work provides the complete set of state variable initial conditions for any study of hypervelocity impact plasma expansion and its effects.

42 ENGINEERING↗
DOE OSTI2024

Analyzing Risks of Virtual Private Network Connections

The use of Splunk for analyzing VPN logs is an effective approach for identifying vulnerabilities in network endpoints. Splunk, a powerful platform for searching, monitoring, and analyzing machine-generated data, enables organizations to aggregate VPN logs in real-time, providing insights into network activity, user behavior, and potential security risks. By indexing VPN traffic and authentication logs, security teams can track abnormal patterns such as multiple failed login attempts, unusual IP addresses, or unexpected changes in bandwidth usage, all of which could indicate potential vulnerabilities or breaches. With Splunk’s advanced search and reporting capabilities, users can create custom dashboards and alerts to detect suspicious activities. Automated searches can flag endpoints exhibiting unusual behavior, while correlation analysis can identify links between compromised devices and broader network vulnerabilities. In particular, Splunk's machine learning capabilities can be leveraged to predict and prevent threats by identifying trends that might otherwise be missed in traditional log analysis. This proactive approach to monitoring VPN logs allows for the early detection of security weaknesses, enabling rapid response and minimizing potential damage to network integrity. By enhancing endpoint visibility, Splunk plays a crucial role in securing remote connections and safeguarding sensitive information. Additionally, Splunk’s automation and alerting features allow teams to create custom workflows that notify them of vulnerable or misconfigured endpoints identified through Shodan. This synergy between Splunk’s log analysis and Shodan’s device intelligence enhances an organization’s ability to proactively identify and mitigate security risks, improving the overall resilience of their VPN infrastructure.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Quantitative Power System Resilience Metrics and Evaluation Approach

Power system resilience is an emerging topic and plays an essential role in helping the power industry understand and respond to the increasing threats of extreme weather events. The first step of power system resilience analysis is to introduce metrics to quantify the resilience reasonably. Existing resilience metrics are typically restrained by the limited data for extreme event modeling and fall short in terms of physical interpretation and comparability. This paper develops novel quantitative metrics to evaluate power system resilience in pre- and post-event contexts. The developed metrics illustrate clear physical meanings and can be effectively used to compare resilience across different systems under different extreme events. Moreover, the developed metrics can be applied to both transmission and distribution systems. Simulation on a distribution system is employed to validate the effectiveness of the proposed resilience metrics and resilience evaluation approach.

power system resilience↗
DOE OSTI2025

Defensive Cybersecurity Architecture Design Using Force-on-Force Cyber-Physical Modeling

Currently, nuclear power plant physical security systems are highly dependent on air-gaps as a protective measure against cyber-threats. Cyber-physical threats become more likely as advanced cyber-threat capabilities to jump air-gaps transition into common use. Defending against the emerging threat of cyber-enabled physical intrusions is poorly understood. The consequence of these cyber-physical attacks has no quantitative analysis method to inform risk-informed, performance-based cybersecurity approaches. By modifying the physical security simulation tool Dante, cyber-physical threat consequence was able to be analyzed on a notional facility. The results of this analysis are used to design a Defensive Cybersecurity Architecture (DCSA) for the physical security system to produce example resilience measures for this notional facility. A DCSA defines security levels to provide a graded approach for defending plant functions, and security zones for trusted communication between systems. This approach can be applied to real world systems to produce physical protection systems and response measures that are resilient to cyber-physical threats.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

PipeSight: A High-Performance Computing Platform for Pipeline Integrity Management

The Phase I feasibility study completed as part of this project has led to a number of innovative technologies being developed and has laid the foundation for a successful Phase II effort to commercialize a platform for managing the integrity of pipelines for the damage mechanisms of the new, hybrid-energy based economy. To ground the development efforts and direction of the project, an extensive market research and customer discovery effort was undertaken early in Phase I. Through this effort, a number of pipeline owners and operators were interviewed, and the following key findings were discovered about the pipeline industry: • Small pipeline operators do not have the central engineering groups necessary to perform their own independent analysis of inspection data, but instead rely on summarized tally sheets provided to them by inspection service providers. • The time it takes to go from an inspection to a completed engineering assessment, even for small segments of pipeline, can take anywhere from 30-120 days. During this delay, critical threats can (and have been known to) cause failures. • Uncertainty is often not accounted for in the assessment of pipeline integrity. The tally sheets provided by third-party service providers are almost always deterministic in nature, identifying threats that present a concern only to the current (not the future) integrity of the pipeline. • It is uncommon to apply the latest technologies to perform advanced assessments of damaged pipelines. There is a desire to use more advanced analysis capabilities to assess threats. Many pipeline operators indicated that they would often excavate a pipeline to perform an inspection and find that the damage was not as bad as they anticipated, thus using limited resources unnecessarily. Companies are not consistent in their use of inspection data to determine corrosion rates, and those that do only calculate deterministic corrosion rates. • The industry has prominently relied on time-based inspections but has recently started to transition to risk-based inspections. However, there appears to be no uniform guidance on how to do so while properly accounting for all sources of uncertainty. • Companies are not storing inspection data in a manner that allows for the ready determination of temporal trends. • Predictive maintenance principles and practices are beginning to be used by early adopters • Some pipelines are being re-purposed to transport different process fluids than they were designed for, e.g., H 2 and CO 2 rich process streams to serve the new hybrid-energy based economy, which are presenting new integrity concerns for the existing pipeline network that crisscrosses the United States. As a result of these discoveries, we were able to target the development efforts in Phase I to best serve the needs of the industry. In Phase I, we developed a way to correlate multiple large-scale scans of the pipeline to determine a probabilistic corrosion rate that accounts for all sources of error and uncertainty in the inspection process. This probabilistic corrosion rate can be used to predict the future thickness distribution of the pipe wall. We demonstrate how this analysis may be performed in an analytical fashion and has been implemented in such a manner that it can be readily distributed using GPU computing through integration of the Kokkos programming model. We also make a very novel extension of the analytical corrosion rate model to Bayesian Networks (an explainable AI technique) that can account for non-parametric distributions of corrosion rates. With the predictions made above for the probabilistic corrosion rate and corresponding future distribution of the pipe wall thickness, we can assess the integrity of the pipeline through the use of a probabilistic engineering assessment. We developed a novel screening data analysis approach that can rapidly identify ‘hotspots’ (local thin areas) where the integrity of the pipeline is a concern. Once more, we implemented this screening approach in C++ to leverage GPU computing via the Kokkos programming model. After the critical hotspots are identified, we developed a program that can automatically generate an advanced finite element model of the damaged regions. Since the number of damaged regions that require advanced analysis can number in the thousands, we integrated an open-source container-native workflow engine for orchestrating parallel jobs on the cloud. Initially, these advanced numerical models were only designed to account for loading due to internal pressure. However, in a slight pivot from the initial Phase I proposal, we developed a complete pipe stress analysis program (called Simflex) which can simulate the complete pipeline and its response to thermal expansion, pressure, thermal bowing, weight, wind, earthquake, support displacement, support friction and external forces. This pipe stress analysis program was written generically, to handle any piping system, but contains the features needed to model long pipelines (i.e., it incorporates a model for soil mechanics and can account for the nonlinear boundary conditions necessary to simulate long underground pipelines). This pipe stress analysis program can simulate any segment of the pipeline (simple or complex) under any set of conditions and loads, to determine the supplemental loads (axial forces and bending moments) at the location of damage. This enables the most accurate state of stress to be accounted for in the pipeline, which can prove critical when evaluating the integrity of a damaged region. In the process of developing the technologies to perform the integrity assessment of the pipeline, we also extended one of the industry standard approaches for performing the assessment of local thin areas that extend more in the circumferential direction than the longitudinal direction of the pipeline. This approach was presented to the API 579-1/AS ME FFS-1 steering committee in November 2021 for consideration in the next edition of the industry standard for Fitness-For-Service (expected to be released in 2023). To help pipeline operators make decisions with the results on any integrity assessment, we developed a new approach to the life-cycle management of pipelines which uses a Bayesian Decision Network. The network is designed to help pipeline operators plan and prioritize inspection activities and ultimately make smarter, more cost-effective decisions. The Bayesian approach accounts for all sources of uncertainty and carries them through to the final optimal decisions, providing a probabilistic framework for optimizing inspection intervals. The proof-of-concept networks developed in the feasibility study are complete, verified, and are focused on a subset of the pipeline. To expand this novel approach to the scale necessary for an entire network of pipelines in Phase II, we will leverage the DOE-funded Bengi solver for industrial-scale decision making with Bayesian Networks [22]. Once implemented, we will be able to provide the pipeline industry with a much-needed tool for optimal inspection planning using truly explainable artificial intelligence (XAI). To handle all of these advanced capabilities into a cloud-based platform, the architecture of the Equity Engineering Cloud (EEC) was extended to include Argo Workflows, a framework capable of distributing and managing a massive number of jobs that consume their own resources, such that thousands of serial finite element simulations can be run in parallel. As part of this substantial undertaking, we also integrated Argo Continuous Delivery (CD) into the EEC, to aid with the rapid prototyping and iterations that will be imperative to the success of the PipeSight platform’s Agile development process in Phase II. As part of the pipe stress analysis program, we also developed a custom visualizer that leverages the DOE-funded VTK visualization library. We added custom contouring capabilities and a means for interacting visually with both the inputs and outputs of the pipe stress analysis program. We also developed routines for automating the post-processing of the finite element simulations to determine if any failure criteria are met and to visualize the deformations, stresses and strains in ParaView using the exodus II file format (a subset of netCDF).

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2026

Performing Numerical Analysis of Cybersecurity Options Using Dynamic Risk Analysis Tool EMRALD

Cyberattacks can have many different attack paths, durations, and goals. There are also many different mitigation options involving hardware, software, and/or humans. Considering a cyber threat should involve defense-in-depth methods and a quantitative or numerical evaluation of overall effectiveness against dynamic, time-dependent attacks to make cost and risk-informed decisions. Typical cyberattack modeling methods only provide a qualitative evaluation. The main areas of cybersecurity are confidentiality, integrity, and availability. For companies with cyber-physical systems such as advanced nuclear reactors, cyber-related safety is a requirement set by North American Electric Reliability and the U.S. Nuclear Regulatory Commission. They are also concerned about availability or reliability as a business case. As cyber threats are evolving to a business-for-hire structure, more attacks may focus on disrupting business success and reliability, causing financial and economic stability risk. Companies want to know business reliability and recovery from those threats, and that requires modeling physical behavior of the targets. Dynamic-state-based and Markov-based modeling provides a method for better cyber scenario modeling with different tools having issues such as state-base explosion. Dynamic modeling enables time and conditional features not found in other numerical evaluation methods. EMRALD (Event Modeling Risk Assessment using Lined Diagrams) is a dynamic risk analysis modeling and simulation tool and has features that reduce modeling issues. It has been used to model different time-dependent events including plant behavior and operator procedures. As a general modeling tool, EMRALD can also be used to model cyberattack scenarios with varying mitigation options and quantify effectiveness, producing numerical data for risk-informed decisions. This paper uses EMRALD to demonstrate that dynamic numerical risk analysis can be used for cyber threat modeling to provide insights for design decision-making and optimize defense strategies. Keywords: cyber modeling; cyber-physical systems; numerical cyber modeling

97 - MATHEMATICS AND COMPUTING↗
DOE OSTI2021

Survey of Cyber Risk Analysis Techniques for Use in the Nuclear Industry

Using traditional probabilistic risk analysis methods for severe accident safety risk management on non-digital systems, structures, and components at nuclear power plants is well-established. In contrast, cyber risk analysis of digital assets is still an immature field with unproven techniques due, in part, to the continuously changing threat environment and the challenge of digital assets failing in unexpected ways. As the nuclear fleet continues to adopt digital instrumentation and control systems, it is increasingly important to have effective and efficient cyber risk analysis techniques to support risk management decisions, such as risk elimination by system redesign or risk mitigation by implementation of prioritized security controls. To understand the state of the art in cyber risk analysis for future research, we surveyed 36 publications across ten application domains. We describe our survey methodology and rate each technique based upon scope, adoptability, and repeatability. In this work, we examine the unique constraints of the nuclear industry and outline the strengths and weaknesses of using the cyber risk analysis techniques in the industry, highlighting gaps with current techniques. We also discuss challenges and potential research directions for advancing the science for both existing and new advanced reactors.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2020

Sandia's Integrated Methodology for Energy and Infrastructure Resilience Analysis

Sandia National Laboratories' (Sandia) Resilient Energy Systems (RES) Strategic Initiative is establishing a strategic vision for U.S. energy systems' resilience through threat-informed research and development, enabling energy and interdependent infrastructure systems to successfully adapt in an environment of accelerating change. A key challenge in promoting energy systems resilience lies in developing rigorous resilience analysis methodologies to quantify system performance. Resilience analysis methodologies should enable evaluation of the consequences of various disruptions and the relative effectiveness of potential mitigations. To address this challenge, RES synthesized the common components of Sandia's resilience frameworks into an integrated methodology for energy and infrastructure resilience analysis. This report documents, demonstrates, and extends this methodology.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2022

Optimal Electric Grid Black Start Restoration Subject to Intentional Threats

Efficient restoration of the electric grid from significant disruptions – both natural and manmade – that lead to the grid entering a failed state is essential to maintaining resilience under a wide range of threats. Restoration follows a set of black start plans, allowing operators to select among these plans to meet the constraints imposed on the system by the disruption. Restoration objectives aim to restore power to a maximum number of customers in the shortest time. Current state-of-the-art for restoration modeling breaks the problem into multiple parts, assuming a known network state and full observability and control by grid operators. These assumptions are not guaranteed under some threats. This paper focuses on a novel integration of modeling and analysis capabilities to aid operators during restoration activities. A power flow-informed restoration framework, comprised of a restoration mixed-integer program informed by power flow models to identify restoration alternatives, interacts with a dynamic representation of the grid through a cognitive model of operator decision-making, to identify and prove an optimal restoration path. Application of this integrated approach is illustrated on exemplar systems. Validation of the restoration is performed for one of these exemplars using commercial solvers, and comparison is made between the steps and time involved in the commercial solver, and that required by the restoration optimization in and of itself, and by the operator model in acting on the restoration optimization output. Publications and proposals developed under this work, along with a path forward for additional expansion of the work, and summary of what was achieved, are also documented.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

Stable Element Doping of Sol-gel Toward Simulating Environmental Matrix in Surrogate Explosive Nuclear Debris

Training nuclear forensic analysis personnel in post-detonation scenarios is of critical importance to nuclear threat response capabilities. Thus, realistic nuclear debris simulants which resemble the size, color, elemental composition, and radionuclide content of actual nuclear fallout from a recent detonation would be valuable for training nuclear first responders in realistic scenarios. As nuclear fallout types vary significantly in each of these parameters based on detonation environment (rural, urban, maritime etc.) and collection location, the ability to tailor each of these parameters accurately in simulated debris would be of immense benefit to the post-detonation analysis community for training both in-field collections and triage and the validation of laboratory level nuclear forensic techniques. Sol-gel synthesis techniques can provide the tunability of size, shape and composition required for producing surrogate nuclear debris of a wide variety. The sol-gel process consists of forming a metal oxide material, often silica, through polymerization of a metal-alkoxy precursor. In this work, we characterize the ability to load the sol-gel particles with secondary elemental components such as iron, aluminum, and calcium toward approximating the elemental composition of debris from various detonation environments and demonstrate the ability to produce particles with controllable size, shape, and color. We also demonstrate quantitative radionuclide encapsulation toward reproducing the radionuclide content of actual fallout from a recent detonation. Finally, we then employ these techniques in producing simulated aerodynamic debris samples with realistic elemental matrix composition and radionuclide content simulating a recent uranium-fueled detonation taking place in a rural desert environment and compare it to historic fallout from the Nevada Nuclear Security Site.

36 MATERIALS SCIENCE↗
DOE OSTI2022

Stable Element Doping of Sol-gel Toward Simulating Environmental Matrix in Surrogate Explosive Nuclear Debris

Training nuclear forensic analysis personnel in post-detonation scenarios is of critical importance to nuclear threat response capabilities. Thus, realistic nuclear debris simulants which resemble the size, color, elemental composition, and radionuclide content of actual nuclear fallout from a recent detonation would be valuable for training nuclear first responders in realistic scenarios. As nuclear fallout types vary significantly in each of these parameters based on detonation environment (rural, urban, maritime etc.) and collection location, the ability to tailor each of these parameters accurately in simulated debris would be of immense benefit to the post-detonation analysis community for training both in-field collections and triage and the validation of laboratory level nuclear forensic techniques. Sol-gel synthesis techniques can provide the tunability of size, shape and composition required for producing surrogate nuclear debris of a wide variety. The sol-gel process consists of forming a metal oxide material, often silica, through polymerization of a metal-alkoxy precursor. In this work, we characterize the ability to load the sol-gel particles with secondary elemental components such as iron, aluminum, and calcium toward approximating the elemental composition of debris from various detonation environments and demonstrate the ability to produce particles with controllable size, shape, and color. We also demonstrate quantitative radionuclide encapsulation toward reproducing the radionuclide content of actual fallout from a recent detonation. Finally, we then employ these techniques in producing simulated aerodynamic debris samples with realistic elemental matrix composition and radionuclide content simulating a recent uranium-fueled detonation taking place in a rural desert environment and compare it to historic fallout from the Nevada Nuclear Security Site.

36 MATERIALS SCIENCE↗
DOE OSTI2021

Stability Impact of IEEE 1547 Operational Mode Changes Under High DER Penetration in the Presence of Cyber Adversary

The IEEE 1547 standard addresses the integration of Distributed Energy Resources (DER) into Area Electric Power Systems (AEPS). The updated standard, released in 2018 with revisions ongoing, specifies the need for more flexible settings, requiring the DER to remain connected during certain disturbances and provide voltage support via active and reactive power modes. With these increased capabilities comes increased risks, and our analysis of the standard has produced potential settings combinations, which, while allowable under the standard, may actually create instability. This contradicts the main purpose of the revised standard. Since the DER must support a communication interface through which the AEPS operator can change settings, adversarial mode changes are possible via a cyberattack. This concern is heightened as DER penetration increases, where under a reasonable threat model, an attacker could affect multiple DER simultaneously. We have conducted a simulation analysis of potentially adverse combinations of mode change and ridethrough parameters on a hypothetical AEPS with varying degrees of DER penetration. We conclude that certain adverse mode changes, whether through error or cyberattack, can lead to unstable conditions with DER penetrations as low as 24% of the AEPS system capacity.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

The Evolution of Volatile Memory Forensics

The collection and analysis of volatile memory is a vibrant area of research in the cybersecurity community. The ever-evolving and growing threat landscape is trending towards fileless malware, which avoids traditional detection but can be found by examining a system’s random access memory (RAM). Additionally, volatile memory analysis offers great insight into other malicious vectors. It contains fragments of encrypted files’ contents, as well as lists of running processes, imported modules, and network connections, all of which are difficult or impossible to extract from the file system. For these compelling reasons, recent research efforts have focused on the collection of memory snapshots and methods to analyze them for the presence of malware. However, to the best of our knowledge, no current reviews or surveys exist that systematize the research on both memory acquisition and analysis. We fill that gap with this novel survey by exploring the state-of-the-art tools and techniques for volatile memory acquisition and analysis for malware identification. For memory acquisition methods, we explore the trade-offs many techniques make between snapshot quality, performance overhead, and security. For memory analysis, we examined the traditional forensic methods used, including signature-based methods, dynamic methods performed in a sandbox environment, as well as machine learning-based approaches. We summarize the currently available tools, and suggest areas for more research.

Nyholm, Hannah↗