SEARCH · Engineering Papers

Results for “software security”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 757 records · Page 42

All sources NASA NTRS DOE OSTI

DOE OSTI2025

IoT Firmware Emulation and Its Security Application in Fuzzing: A Critical Revisit

As IoT devices with microcontroller (MCU)-based firmware become more common in our lives, memory corruption vulnerabilities in their firmware are increasingly targeted by adversaries. Fuzzing is a powerful method for detecting these vulnerabilities, but it poses unique challenges when applied to IoT devices. Direct fuzzing on these devices is inefficient, and recent efforts have shifted towards creating emulation environments for dynamic firmware testing. However, unlike traditional software, firmware interactions with peripherals that are significantly more diverse presents new challenges for achieving scalable full-system emulation and effective fuzzing. This paper reviews 27 state-of-the-art works in MCU-based firmware emulation and its applications in fuzzing. Instead of classifying existing techniques based on their capabilities and features, we first identify the fundamental challenges faced by firmware emulation and fuzzing. We then revisit recent studies, organizing them according to the specific challenges they address, and discussing how each specific challenge is addressed. We compare the emulation fidelity and bug detection capabilities of various techniques to clearly demonstrate their strengths and weaknesses, aiding users in selecting or combining tools to meet their needs. Finally, we highlight the remaining technical gaps and point out important future research directions in firmware emulation and fuzzing.

Zhou, Wei (ORCID:0000000178340839)↗

DOE OSTI2021

SSP Personality Programmer

The Personality Programmer software is used as means for entities to configure, deploy, and redeploy SSP devices. SAND2020-14337 O Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.

Hunt, TannerR.↗

DOE OSTI2021

HQ-Tracer

HQ-Tracer is a software plugin related to the open-source project Ghidra. It is used for taking an emulation instruction trace from open source platforms and displaying inside of Ghidra. It allows for software debugging, reverse engineering, and enables interactive forward and backward stepping and searching through the execution traces. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525. SAND2021-4552 O

Wright, ChristopherM.↗

DOE OSTI2020

BigDNA

SAND2020-13696 M BigDNA takes a user input fast DNA sequence and outputs overlapping long PCR primers for Gibson Assembly. The software can design primers that remove gene products, insert new gene products, or completely circularize long DNAs. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.

Porter, Kelley↗

DOE OSTI2022

Fugu v.0.1

SAND2021-15052 O Fugu provides a common software framework for designing and prototyping algorithms for spiking neuromorphic hardware and compiling to multiple hardware platforms. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.

Aimone, James↗

DOE OSTI2018

A Scalable HPC Insider Threat Monitoring System

Cyber Equations, Inc. is reporting on the results of its DOE SBIR Phase I project for the development of a Scalable HPC Insider Threat Monitoring System. This final report to the Department of Energy for Task DE-FOA-0001618 covers the period from 02/21/2017 to 02/20/2018 and summarizes the larger research accomplishments, which can be divided in theoretical and laboratory experiments. One of the many challenges for the U.S. Department of Energy (DOE) is the support of the high-performance computing (HPC) centers while providing quality information services, strategic vision, leadership, technical expertise, and capabilities necessary to enable the DOE to deliver effective, efficient, economical, and secure HPC services. In order to realize a secure DOE laboratory enterprise, DOE facilities operations must counter a wide range of cyber insider threats, from unsophisticated adversaries up to advanced, nation state sponsored actors. The DOE laboratories also presents an enormous insider attack surface of an ever-growing number of computers, networks, and devices all running a myriad of software. In addition, the DOE laboratories are connected to a variety of external organizations which multiplies the possibility of insider threat. During this SBIR project Cyber Equations developed a strategic combination of supervised and unsupervised machine learning techniques to control scale and classify whether entities, such as hosts, actors, or documents, are showing suspicious insider behavior. We conducted experiments using real cyber data to show that changes in observable behavior (e.g., changes in outbound traffic patterns) are indicative of attacks executing (e.g., insiders exfiltrating data, bots calling home, or an attack spreading). The features and methods we use, have been used in the anomaly detection research and development community for a significant amount of time and robust implementations are openly available. K-Means clustering, Decision Trees, and Support Vector Machine based classifiers are readily available through the R language and open source H20 machine learning framework. The Cyber Equations approach is novel in its use of these classifiers combined with Hadoop based parallel processing technology. The five stages of processing used by CyberInsider improve scalability and reduce the high number of false positives normally associated with network anomaly detection. In summary, the Cyber Equations has successfully accomplished all of its Phase I tasks and demonstrated the feasibility of the Insider Threat Monitoring System.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2021

UAS Tracker v.1.0

UAS Tracker software tracks events and correlates them to Global Navigation Satellite System (GNSS) timestamps for automated metric calculations. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525. SAND2021-3176 O

Stubbs, JaclynnJavonna↗

DOE OSTI2018

Development of Software Defined Radio Protocol for Acoustic Communication on Pipes

Nuclear Science Engineering Division at Argonne has been developing a new method of transmitting information via acoustic waves on pipes in a nuclear facility. This method provides the capability to communicate information from within the containment building under the conditions of total power outage following a severe accident. Compared to traditional RF communications, acoustic communications allows for signal transmission across thick concrete barriers, and better information security due to spatial confinement of the signal. Data of interest consists of sensor readings, voice, and images. Transmission of images is most challenging because corruption of the header string might render the reconstructed image unreadable.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

DOE OSTI2020

Document Management: A Focused Analysis on the Configuration Management Process at Y-12 National Security Complex

The configuration management process at Y-12 is a crucial process to ensure safe operations and compliance with Department of Energy (DOE) regulations and requirements. This process is evaluated utilizing systems-thinking methodology in order to understand the current operational flow, with the ultimate goal of building an easily understandable, representative model. This model offers insights on key areas of waste and provides a potential solution by modernizing rate limiting steps: a software implementation to update the traditional document management system and make it paperless. Stakeholders of the software implementation are identified in order to define characteristic requirements of an effective product and the anticipated benefit is evaluated. Ultimately, this project is an effort to increase the quality of life for all stakeholders, while improving the capacity, throughput, and effectiveness of a necessary process at Y-12.

42 ENGINEERING↗

DOE OSTI2023

Reinforcement Learning Approach to Cybersecurity in Space (RELACSS)

Securing satellite groundstations against cyber-attacks is vital to national security missions. However, these cyber threats are constantly evolving. As vulnerabilities are discovered and patched, new vulnerabilities are discovered and exploited. In order to automate the process of discovering existing vulnerabilities and the means to exploit them, a reinforcement learning framework is presented in this report. We demonstrate that this framework can learn to successfully navigate an unknown network and detect nodes of interest despite the presence of a moving target defense. The agent then exfiltrates a file of interest from the node as quickly as possible. This framework also incorporates a defensive software agent that learns to impede the attacking agents progress. This setup allows for the agents to work against each other and improve their abilities. We anticipate that this capability will help uncover unforeseen vulnerabilities and the means to mitigate them. The modular nature of the framework enables users to swap out learning algorithms and modify the reward functions in order to adapt the learning tasks to various use cases and environments. Several algorithms, viz., tabular Q learning, deep Q networks, proximal policy optimization, advantage actor-critic, generative adversarial imitation learning, are explored for the agents and the results highlighted. The agent learns to solve the tasks in a light-weight abstract environment. Once the agent learns to perform sufficiently well, it can be deployed in a minimega virtual machine environment (or a real network) with wrappers that map abstract actions to software commands. The agent also uses a local representation of the actions called a ‘slot-mechanism’. This allows the agent to learn in a certain network and generalize it to different networks. The defensive agent learns to predict the actions taken by an offensive agent and uses that information to anticipate the threat. This information can then either be used to raise an alarm or to take actions to thwart the attack. We believe that with the appropriate reward design, a representative environment, and action set, this framework can be generalized to tackle other cybersecurity tasks. By sufficiently training these agents, we can anticipate vulnerabilities leading to robust future designs. We can also deploy automated defensive agents that can help secure satellite groundstation and their vital national security missions.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

DOE OSTI2019

TestSNAP

TestSNAP is a stand-alone prototype of the SNAP force kernel used in the LAMMPS molecular dynamics code. It contains synthetic input data (neighbor atom positions) and reference output data (forces on atoms) for several different SNAP models. The prototype performs the force calculation repeatedly, checking the results against the reference data. At the end it reports the grind time [msec/atomstep] and RMS force error [eV/A]. This allows performance experts to quickly test new hardware and software strategies, obtain a realistic performance estimate and verify that the computation was performed correctly. SAND2019-12243 M Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy's National Nuclear Security Administration under contract DE-NA0003525.

Thompson, Aidan↗

DOE OSTI2021

X-Ray Toolkit Mobile (Android)

X-Ray Toolkit Mobile (Android) is a software application for acquiring and processing digital images. The application runs on mobile devices running Android operating systems. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525 SAND2021-1981 O

Harris, JamesZ.↗

DOE OSTI2021

Remote Target Engagement System (RTES) Generation 4 ("Gen 4")

RTES is designed to provide teleoperation of remote weapon platform capability at defensive physical protection locations requiring active lethal capabilities for final access denial. Multiple operator consoles allow for coordinated engagement of many weapon platforms by one or more operator consoles. This results in faster response times, increased effectiveness, and increased survivability from removing response force from harm's way increasing survivability. This software is developed against DoD requirements and has been safety and functionally reviewed and approved for operational use. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525. SAND2021-1935 O

Klingler, KristopherR.↗

DOE OSTI2026

Datashare

Datashare facilitates communication and data sharing within local networks in potentially dangerous situations such as an explosive ordnance disposal. During such events, there is a need to transmit information rapidly around the incident area. It is a distributed database that does not require an internet connection for operation. In addition, Datashare interfaces with XTK and other software applications, allowing for seamless integration and data management. Datashare supports video calls over the network, enabling real-time communication among users. This software serves to organize, package, and share between responders on location and export data to those off location. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.

Eldridge, Bryce [Sandia National Lab. (SNL-CA), Li↗

DOE OSTI2017

EV Everywhere Sandia Appendix

Sandia National Laboratories has a large cybersecurity research program supporting the Department of Energy as well as other federal departments and agencies. Fundamental research helps us stay ahead of threats. Sandia’s research efforts in cybersecurity are focused in three broad areas: 1. Trusted hardware, software, and systems 2. Networks and systems architectures and analysis 3. Effective cyber defense systems Research is conducted in state-of-the-art facilities with extensive computing and information science capabilities, which range from architectures and algorithms to advanced modeling and simulation. Three areas of active research most applicable to connected vehicle security are: Red Team Assessments, Emulytics™, and Supply Chain Risk Management.

97 MATHEMATICS AND COMPUTING↗

NASA NTRS1996

Hypercars: The next industrial revolution

The auto industry -- one-seventh of the GNP, and the highest expression of the Iron Age -- is about to trigger the biggest transformation in industrial structure since the microchip. Ultralight cars molded from net-shape advanced composites can be several-fold lighter than present steel cars, yet safer, sportier, and more comfortable, durable, and beautiful. Modern hybrid-electric drives boost efficiency approximately 1.3-1.5x in heavy steel cars, but approximately 5-20x in ultralight, very slippery plafforms. Synergistically combined into ultralight-hybrid 'hypercars,' these elements can yield state-of-the-shelf family cars that average 150-300+ mi/gal -- twice that with state-of-the-art technologies -- yet can also be superior in all other respects, probably including cost: carbon-fiber monocoques can actually be cheaper to mass-produce that steel unibodies. Designing cars more like aircraft and less like tanks requires not only an approximately 400-500 kg curb mass and very low air and road drag, but also an aerospace philosophy of engineering integration. Mass, cost, and complexity turn out to compound with heavy hybrids but to decompound with ultralight hybrids, owing partly to radical simplification. Excellent aerodynamics, preferable including advanced techniques for passive boundary-layer control, will be the key to successful design integration. Transforming automaking is a competitive and environmental imperative, could form the nucleus of a green industrial Renaissance, and would enhance national security by, among other things, saving as much oil as OPEC now extracts. However, this transformation faces serious cultural barriers. For example, hypercars will be more like computers with wheels than like cars with chips -- they'll have an order of magnitude more code than today's cars -- but Detroit is not a software culture. Just the transition from stamped and welded steel to integrated and adhesive-joined synthetics is difficult enough. Nonetheless, hypercars are rapidly heading to market in the late 1990s, because approximately 25 current and intending automakers are eager to capture their potentially decisive competitive advantages -- including order-of-magnitude reductions in product cycle time, tooling cost, assembly effort, and parts count. Hypercars will succeed, and may well sweep the market, not because of mandates or subsidies, but because of manufacturers' quest for competitive advantage and customers' desire for better, smarter cars.

Lovins, Amory B.↗

DOE OSTI2023

Cyber-Informed Engineering Principles: What’s in it for me?

CIE is an emerging method to integrate cybersecurity considerations into the conception, design, development, and operation of any physical system that has digital connectivity, monitoring, or control. CIE complements—but does not replace—the application of cybersecurity standards or practices currently in place within an organization. Rather, it expands cybersecurity decisions into the engineering space, not by asking engineers to become cyber experts, but by calling on engineers to apply engineering tools and make engineering decisions that improve cybersecurity outcomes. CIE examines the engineering consequences that a sophisticated cyber attacker could achieve, and drives engineering changes that may provide deterministic mitigations to limit or eliminate those consequences. Engineers and technicians that design critical energy infrastructure installations can integrate the 12 principles of CIE into each phase of the engineering lifecycle, from concept to retirement. These principles are aimed at system or design engineers, operators, and technicians, rather than software engineers or operational cybersecurity practitioners, because the engineers who design, build, operate, and maintain the physical infrastructure are best positioned to leverage a system’s engineering design to diminish the severity of cyber attacks or digital technology failures. This approach creates new opportunities for engineering teams—and not just cybersecurity teams—to secure the system using the physics and mechanics of engineering controls—not just digital monitoring and controls.

99 GENERAL AND MISCELLANEOUS↗

DOE OSTI2023

HeatMap

SAND2021-14230 O HeatMap generates geospatial wildfire fuel models by applying machine learning algorithms to satellite imagery and weather station data. The code then leverages wildfire behavior software FlamMap to determine fire spread. It also uses PSLF software to model grid impacts and display data analytics for grid components that have been impacted by wildfire. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.

Danford, Forest↗