SEARCH · Engineering Papers

Results for “Secure by Design”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 775 records · Page 43

All sources NASA NTRS DOE OSTI

DOE OSTI2022

A Call to Arms Control: Synergies between Nonproliferation Applications of Neutrino Detectors and Large-Scale Fundamental Neutrino Physics Experiments (A Snowmass White Paper)

The High Energy Physics community can benefit from a natural synergy in research activities into next-generation large-scale water and scintillator neutrino detectors, now being studied for remote reactor monitoring, discovery and exclusion applications in cooperative nonproliferation contexts. Since approximately 2010, US nonproliferation researchers, supported by the National Nuclear Security Administration (NNSA), have been studying a range of possible applications of relatively large (100 ton) to very large (hundreds of kiloton) water and scintillator neutrino detectors. In parallel, the fundamental physics community has been developing detectors at similar scales and with similar design features for a range of high-priority physics topics, primarily in fundamental neutrino physics. These topics include neutrino oscillation studies at beams and reactors, solar, and geological neutrino measurements, supernova studies, and others. Examples of ongoing synergistic work at U.S. national laboratories and universities include prototype gadolinium-doped water and water-based and opaque scintillator test-beds and demonstrators, extensive testing and industry partnerships related to large area fast position-sensitive photomultiplier tubes, and the development of concepts for a possible underground kiloton-scale water-based detector for reactor monitoring and technology demonstrations. Some opportunities for engagement between the two communities include bi-annual Applied Antineutrino Physics conferences, collaboration with U.S. National Laboratories engaging in this research, and occasional NNSA funding opportunities supporting a blend of nonproliferation and basic science R&D, directed at the U.S. academic community.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗

DOE OSTI2022

Satellite Enveloped with STITCHED Engineering Sensors for Detection of Approaching Objects

Today as well as tomorrows spaceborne assets impact almost all areas of national and nuclear security. Spaceborne assets can not only collect and disseminate valuable data, well beyond just the visual, but also track terrestrial-based mobile assets in real-time, and active spaceborne platforms potentially pose serious risk to vulnerable earth-based systems and infrastructures. The capability to defend national spaceborne assets from attack/interference is critical for security interests. This effort supports this mission through the cost-effective preeminent detection of approaching threats to our nation’s vital resources, in order to help secure and trust these high-value assets against the threats of tomorrow. This project develops novel fabrication techniques for conformal, low-profile and lightweight leakywave antenna (LWA) detection/imaging systems, which fuses technical embroidery (TE) and laser ablation (LA) processes with LWA design. Technical embroidery is an emerging field in additive textile manufacturing where flexible materials and functionalized fabrics are created for a wide variety of uses and purposes, while laser ablation is the process of removing material from a solid surface by irradiating it with a laser beam. Here, thin, conformal antenna designs are designed, modeled and fabricated using both TE and LA, to create lightweight, flexible and conformal object detection and imaging radars. This novel development ensures our nation’s ability to field advanced lightweight and conformal technologies to protect spaceborne assets.

42 ENGINEERING↗

DOE OSTI2022

Decision Science for Machine Learning (DeSciML)

The increasing use of machine learning (ML) models to support high-consequence decision making drives a need to increase the rigor of ML-based decision making. Critical problems ranging from climate change to nonproliferation monitoring rely on machine learning for aspects of their analyses. Likewise, future technologies, such as incorporation of data-driven methods into the stockpile surveillance and predictive failure analysis for weapons components, will all rely on decision-making that incorporates the output of machine learning models. In this project, our main focus was the development of decision scientific methods that combine uncertainty estimates for machine learning predictions, with a domain-specific model of error costs. Other focus areas include uncertainty measurement in ML predictions, designing decision rules using multiobjecive optimization, the value of uncertainty reduction, and decision-tailored uncertainty quantification for probability estimates. By laying foundations for rigorous decision making based on the predictions of machine learning models, these approaches are directly relevant to every national security mission that applies, or will apply, machine learning to data, most of which entail some decision context.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2025

Review on Preprocessing Strategies, Deactivation, Thermal Safety, and Future Perspectives in Lithium-Ion Battery Recycling

The rapid growth in the use of lithium-ion batteries (LIBs) in electric vehicles, consumer electronics, and renewable energy storage has made effective end-of-life management essential. Recycling LIBs is critical not only for resource recovery and environmental protection but also for ensuring safety and economic viability. This review focuses on the preprocessing technologies that precede typical recovery processes, including disassembly, sorting, discharging, electrolyte removal, dismantling, thermal treatment, separation, and flotation. These steps play a foundational role in determining the efficiency, safety, and environmental impact of LIB recycling. LIBs pose substantial fire and explosion risks due to residual charge, flammable electrolytes, and reactive materials. The conditions and successive progression of the exothermic reactions which lead to thermal runaway has been discussed. It also explores secure deactivation techniques such as external circuit discharge, saline immersion, and thermomechanical methods, alongside fire prevention strategies including the use of flame retardants, elimination of oxidants, and reduction of heat generation and accumulation. Challenges and future directions are outlined, highlighting the need for standardized designs, automation, and safer, more sustainable recycling infrastructure. Furthermore, this review is distinguished by its focused analysis of preprocessing and deactivation steps, with particular attention to the thermal safety engineering aspects of LIB recycling.

Battery deactivation↗

DOE OSTI2021

A survey of software implementations used by application codes in the Exascale Computing Project

The US Department of Energy Office of Science and the National Nuclear Security Administration initiated the Exascale Computing Project (ECP) in 2016 to prepare mission-relevant applications and scientific software for the delivery of the exascale computers starting in 2023. The ECP currently supports 24 efforts directed at specific applications and six supporting co-design projects. These 24 application projects contain 62 application codes that are implemented in three high-level languages—C, C++, and Fortran—and use 22 combinations of graphical processing unit programming models. The most common implementation language is C++, which is used in 53 different application codes. The most common programming models across ECP applications are CUDA and Kokkos, which are employed in 15 and 14 applications, respectively. This article provides a survey of the programming languages and models used in the ECP applications codebase that will be used to achieve performance on the future exascale hardware platforms.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2022

Oak Ridge National Laboratory Pilot Demonstration of an Attestation and Anomaly Detection Framework using Distributed Ledger Technology for Power Grid Infrastructure

This report summarizes the design and pilot demonstration of a framework called Grid Guard that was created to provide increased data and device trustworthiness to electric grid devices by leveraging distributed ledger technology (DLT), specifically blockchain. Grid Guard contains a combination of core cryptographic methods such as the secure hash algorithm (SHA), and asymmetric cryptography, private permissioned blockchain, baselining configuration data, consensus algorithm (Raft) and the Hyperledger Fabric (HLF) framework. The system implements a low energy, fast, and robust enhancement to system trustworthiness within and across electric grid systems such as substations, control centers and metering infrastructures. Blockchain is a distributed database structured that provides a practically unalterable (immutable) timeline of stored transactions. By relying on hashing and the Raft consensus algorithm, if an entity tries to illegitimately alter a record at one instance of the database the other ledger nodes are not altered. They work to cross-reference each other and easily locate any incorrectly added data and remove it. The bulk raw data is stored in an off-chain storage (outside of the blockchain ledger) and a hash of this baseline data is stored in the Blockchain ledger via hashing windows of time-series and configuration data, after aggregation and filtering. The bulk off-chain data repository is then considered to be trust-anchored using the hashes stored in the blockchain. To secure the electric grid testbed devices and data, device configuration baselines were compared to those baselines that had been previously stored in the ledger. Statistical baselines for device configurations, network communication patterns, and high-speed sensor data are calculated and then stored off-chain and hashes stored in the ledger. Measurements such as three-phase voltage and current, frequency, breaker status, protection scheme settings, network configuration settings (and other device configuration artifacts) and network traffic features (packet interarrival times) are compared every minute or other selected time windows. During phase 1 of the Grid Guard DLT project different DLT technologies were studies, and an assessment was performed on DLT technology vulnerabilities, uses, and key characteristics. DLT consensus protocols were studies (e.g., RAFT, named after Reliable, Replicated, Redundant, And Fault-Tolerant). Also, cryptography, public, private and permissioned or permissionless systems were assessed. Grid Guard implements a permissioned private DLT. Consensus algorithm selection and choice of DLT implementation depended heavily on the use-case. For this use-case, parameters were selected to measure performance and existing tools for assessment. Benchmarking was performed theoretically and practically. During phase 2 hashed transactions/blocks were inserted into the ledger every second. During phase 2 of the Grid Guard DLT project, a prototype framework was developed and demonstrated for attestation of critical substation devices and data using precision timing systems that use PTP and IRIG-B protocols) on a testbed of operational devices that emulated a distribution substation, control center, and power metering infrastructure using real Operational Technology (OT). The testbed includes OT devices such as protective relays, human machine interfaces (HMI), and power meters. To determine when to collect and compare system and network baselines, an initial examination of an anomaly detection capability to identify malicious manipulation of data streams was conducted. The resulting anomaly detection was demonstrated in a set of experiments and leveraged to trigger device artifact attestation checks. Attestation checks occur against device configuration baselines when compared with the immutable blockchain-stored baselines, which provided a cryptographically supported means by which to store baselines. The electrical substation-grid testbed was created to test the Grid Guard framework. The testbed emulates the operations of a portion of a power grid and SCADA systems as closely as possible. The testbed integrates real protocols, mainly IEC 61850 standard protocols, such as the Sampled Value (SV) and the GOOSE protocols. The testbed also supports DNP3 and other layer 2 and layer 3 protocols such as Telnet, SSH, SFTP/FTP and other proprietary protocols needed to connect to industrial control system equipment. The testbed emulates real power conditions using the OpalRT hardware-in-the-loop (HIL) device which can create fault situations that cannot be easily tested on real systems. The electrical substation-grid testbed was created using real measurement, communication, and protection devices that electrical utilities commonly use.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2026

Resilient Crop Production for the Bioeconomy: Frontier Science for the Bioeconomy Workshop Series

A bioeconomy based on energy, chemicals, and bioproducts derived from nonfood crops promotes U.S. prosperity, energy independence, and national security. Crop productivity (i.e., yield) affects profitability for farmers, whereas biomass and seed oil quality affects profitability for biorefineries through the conversion efficiency of feedstock crops into energy, chemicals, and bioproducts. Scientific breakthroughs in plant genetics and genomics, ecological processes, bioprocessing, microbial engineering and design, and conversion technologies have improved the potential market viability of products derived from nonfood crops specifically cultivated as biomass and seed oil feedstocks. Improving understanding of a plant’s complex responses to withstand or recover from stress is crucial to maintaining feedstock yield and quality, particularly in challenging production zones. Stress may be related to biotic or abiotic (i.e., nonliving) environmental conditions that negatively affect plant growth, development, and productivity. Research and development to enhance the environmental resilience of feedstock crops will enable improved production by minimizing losses during stress and improving production on currently economically nonviable marginal lands.

09 BIOMASS FUELS↗

DOE OSTI2023

An Analysis of the Effects of Renewable Energy Intermittency on the 2030 Korean Electricity Market

Republic of Korea has unique geographical characteristics similar to those of an island, resulting in an isolated power system. For this reason, securing sufficient operating reserves for the system’s stability and reliability in the face of the intermittency of increasing variable renewable energy (VRE) is paramount, and this will pave the way to achieving the nation’s decarbonization target and carbon neutrality. However, the current reserve-operation method in Republic of Korea does not take into account energy-system conditions, such as the intermittency of the VRE. Therefore, this paper presents an analysis of the impact of changes in reserve-operation methods on the electricity market in the future Republic of Korean power system, with the increased levels of VRE that are currently envisioned. Specifically, three reserve-operation methods, including Korea’s current reserve-power-operation standards, were applied to the two power-system plans announced by the Korean government to analyze the annual generator operation and costs. The analysis results show that securing reserves proportional to the VRE would exert negative effects, such as increased power-generation costs and the curtailment of nuclear and VRE generation. These results can contribute to the estimation of operational reserves needed for high levels of VRE and to the design of new the Korean reserve market, to be introduced in 2025.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2022

Is Genetic Engineering a Route to Enhance Microalgae-Mediated Bioremediation of Heavy Metal-Containing Effluents?

Contamination of the biosphere by heavy metals has been rising, due to accelerated anthropogenic activities, and is nowadays, a matter of serious global concern. Removal of such inorganic pollutants from aquatic environments via biological processes has earned great popularity, for its cost-effectiveness and high efficiency, compared to conventional physicochemical methods. Among candidate organisms, microalgae offer several competitive advantages; phycoremediation has even been claimed as the next generation of wastewater treatment technologies. Furthermore, integration of microalgae-mediated wastewater treatment and bioenergy production adds favorably to the economic feasibility of the former process—with energy security coming along with environmental sustainability. However, poor biomass productivity under abiotic stress conditions has hindered the large-scale deployment of microalgae. Recent advances encompassing molecular tools for genome editing, together with the advent of multiomics technologies and computational approaches, have permitted the design of tailor-made microalgal cell factories, which encompass multiple beneficial traits, while circumventing those associated with the bioaccumulation of unfavorable chemicals. Previous studies unfolded several routes through which genetic engineering-mediated improvements appear feasible (encompassing sequestration/uptake capacity and specificity for heavy metals); they can be categorized as metal transportation, chelation, or biotransformation, with regulation of metal- and oxidative stress response, as well as cell surface engineering playing a crucial role therein. This review covers the state-of-the-art metal stress mitigation mechanisms prevalent in microalgae, and discusses putative and tested metabolic engineering approaches, aimed at further improvement of those biological processes. Finally, current research gaps and future prospects arising from use of transgenic microalgae for heavy metal phycoremediation are reviewed.

Ranjbar, Saeed (ORCID:0000000256518605)↗

DOE OSTI2024

LivChat.....So Far

This presentation provides an overview of LivChat, a managed ChatGPT service developed by Lawrence Livermore National Laboratory (LLNL) under the auspices of the U.S. Department of Energy. The initiative was driven by a high demand for generative AI services, the need for enhanced security, and the goal of increasing productivity across various use cases. The development journey involved exploring open-source models and iterating with OpenAI/Azure solutions. The presentation delves into the architecture of LivChat, highlighting its user interface (UI) and backend components. The backend is designed to be separate, RESTful, integrative, and scalable, ensuring robust performance and adaptability. Despite the advanced technology, the presentation emphasizes that LivChat is not a magical solution but a sophisticated tool that requires realistic expectations. Looking ahead, the presentation outlines future directions for LivChat, including training, retrieval-augmented generation (RAG), and innovative ingestion methods. These advancements aim to further enhance the capabilities and applications of LivChat, ensuring it remains at the forefront of generative AI services.

Computer science↗

DOE OSTI2023

Chemical Asset Prioritizer (CAP) v.1.0

SAND2024-08627O The Chemical Asset Prioritizer is a web application designed for facility management on how to safely store chemicals. App users fill out a survey about the facility and the chemicals on the site. The Chemical Asset Prioritizer then determines which chemicals are at the highest priority and provide recommendations on how to secure them. The web application will likely be licensed to a company that will host it for use by numerous federal entities, universities, and other government agencies. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.

Johnson II, Alfred↗

DOE OSTI2020

Design Optimization of A generic Fissile Solution for Mo99 production using Electron Beam-based Neutron Generator using MCNP+CFD

Molybdenum-99 ( 99 Mo) is a medical isotope used in 80% of all medical imaging procedures today. However, 99 Mo is not directly administered to patients for imaging; its decay product, technetium-99m ( 99 mTc), is a metastable isotope with a half-life of ~6 hours. Such a short half-life does not allow for production, separation, and application to a patient before decaying further. Therefore, the solution is to produce the precursor to 99 mTc, 99 Mo. 99 Mo has a half-life of 66 hours, long enough to produce the material and send it to the desired location before it fully decays. Under National Nuclear Security Administration’s (NNSA) highly enriched uranium (HEU) minimization mission, the Material Management and Minimization (M3) office leads the Molybdenum-99 (Mo-99) program. A major goal of the Mo-99 program is to develop methods of producing 99 Mo using low enriched uranium (LEU) opposed to the traditionally used HEU domestically in the U.S. Internationally, LEU is the new standard for use in research reactors and isotope production facility. In this study, we introduce a generic fissile solution system for 99 Mo production facility meeting the design requirement of 1) LEU usage as fissile material and 2) subcritical fissile system coupled with a horizontal electron beam (E-beam) accelerator. The focus of this research is to optimize a fissile solution configuration for maximum 99 Mo production yield using MCNP model, and ultimately implement the optimized design with computational fluid dynamics (CFD) model to understand thermal hydraulic behavior and solution convection characteristic. The report consists of two parts: 1) isotope yield calculation and criticality analysis with a wide range of parametric test matrix, and 2) thermal hydraulic analysis for solution mixing and cooling assessment.

60 APPLIED LIFE SCIENCES↗

DOE OSTI2025

Machine Learning for Anomaly Detection in Neural Network Security and SRF Cavities

This dissertation explores the development and deployment of machine learning approaches to address critical challenges in anomaly detection across two distinct domains: neural network security in federated learning settings and cavity behavior analysis in particle accelerator operations at Jefferson Lab in Newport News, Virginia. Anomaly detection identifies deviations from expected patterns, safeguarding systems in cybersecurity, industry, and research against malicious activities and failures. This dissertation demonstrates how our machine learning approaches enhance detection accuracy and efficiency in both neural network security and industrial applications. First, we investigate vulnerabilities in deep neural networks deployed in federated learning. Although federated learning preserves user privacy by training models locally, it remains vulnerable to backdoor attacks, in which malicious participants embed hidden triggers that induce targeted misbehavior. We propose a self-supervised contrastive learning framework to detect and mitigate such backdoor attacks. In our experiments, this method achieves higher detection accuracy and lower false positive rates than existing defenses, while operating without access to local model updates or original training data and thus preserving the privacy guarantees of the federated setting. Second, we address the operational reliability of superconducting radio-frequency (SRF) cavities at the Continuous Electron Beam Accelerator Facility (CEBAF). Our research leverages an unsupervised learning approach, combined with Principal Component Analysis (PCA) and k-means clustering, to identify anomalous behaviors in SRF cavities. Our method detects subtle anomalous behavior by analyzing SRF signal data. This knowledge allows for the early detection and resolution of potential faults, significantly improving the efficiency and reliability of operations. Third, we extend these insights to time-series anomaly detection more broadly. We design a contrastive-learning based model tailored to increasingly dynamic environments and academic research. This model improves detection accuracy in settings that require real-time monitoring and predictive maintenance. Our research underscores the broader applicability and impact of advanced machine learning techniques in anomaly detection. By extracting meaningful patterns from complex data, machine learning can significantly enhance security in distributed neural networks and improve the efficiency of particle accelerator operations. This dissertation serves as a stepping stone for future investigations into the vast possibilities of anomaly detection, inspiring further exploration and development of machine learning techniques in this field.

Ferguson, Hal [Old Dominion University]↗

DOE OSTI2024

Radiation Dose Modeling for Niowave’s Accelerator Driven Uranium Target Assembly 3

Molybdenum-99 is a high-value radionuclide commonly used for medical purposes within the United States. The National Nuclear Security Administration (NNSA) seeks to reliably produce the radioisotope 99 Mo without the use of highly enriched uranium. NNSA’s Office of Material Management and Minimization (M3) provides funding and government laboratory expertise to private companies to expedite the production process domestically and currently funds designs that use low-enriched uranium or other 99 Mo production pathways. Several production designs are being explored across the industry, including uranium fission and photonuclear conversion of 100 Mo targets. Niowave Inc. seeks to produce 99 Mo via a high-energy electron accelerator that strikes a lead-bismuth eutectic target that ultimately produces a consistent neutron flux. The neutron flux then interacts in a subcritical reactor core configuration to produce fission in low-enriched or natural uranium targets. These fissionable targets are then processed to extract 99 Mo. The purpose of this work is to estimate the neutron and photon dose response across Niowave’s proposed facility for worker safety during operation. Owing to the size of the proposed Niowave facility and necessary shielding, unbiased Monte Carlo radiation transport is impractical, and variance reduction methods are required. This work focuses on the weight window variance reduction method to produce high confidence dose response results within a Monte Carlo radiation transport code. Specifically, an adjoint-informed weight window methodology was created to improve the dose response estimates for accelerator-driven subcritical reactor designs. This adjoint-informed methodology was implemented for Niowave’s proposed design and improved dose results at far-field locations across the facility. Acceptable dose rate contours for the proposed facility were generated across the facility and are presented in this work.

07 ISOTOPE AND RADIATION SOURCES↗

DOE OSTI2025

Passive Temperature Sensors for Nuclear Applications

In April 2007, the Department of Energy (DOE) designated the Advanced Test Reactor (ATR) a National Scientific User Facility (NSUF) to advance US leadership in nuclear science and technology. By attracting new users from universities, laboratories, and industry, this program supports basic and applied nuclear research to help address the nation's energy security needs. In support of this program, the Idaho National Laboratory (INL) established in-house capabilities to develop, fabricate, test, and qualify new and enhanced temperature sensors for irradiation testing. This effort is continuing today through the DOE?s Advanced Sensors and Instrumentation (ASI) program. Although most efforts emphasize sensors capable of providing real-time data, selected tasks have been completed to enhance passive sensors for irradiations where instrumentation leads cannot be included. These sensors include silicon carbide (SiC) monitors, melt wires and the sublime temperature monitor. SiC monitors are available to detect peak irradiation temperatures between 200°C and 800°C in reactor locations where instrumentation leads cannot be used. SiC monitors may be evaluated using specialized equipment installed at INL?s Measurement Sciences Laboratory (MSL). A melt wire inventory is also maintained at MSL. This inventory contains wires for specific use in irradiation experiments ranging in temperatures from 30°C to 1500°C. Melt wires and SiC monitors have had decades of research and application. Recent research has produced a passive monitor known as the sublime temperature monitor. This passive sensor has the capability of recording temperature gradients. This paper will discuss passive temperature sensors currently being researched and implemented under the ASI program.

11 - NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗

DOE OSTI2022

ECAR-6415 Rev 0 CFD Analysis of the Primary Coolant Apparatus Test Core with Wire Spacers for Heterogeneous Power Distributions

Primary Coolant Apparatus Test (PCAT) is a thermal-hydraulic test loop for Microreactor Applications Research Validation and Evaluation (MARVEL) reactor. The heater elements were manufactured within a straightness tolerance for the designated gap thickness of 1.0 mm, but several elements have been distorted out of tolerance during the welding process. The distortion of heater rods can lead to flow maldistribution and excessive hotspot where the gap between two heater rods is too tight. In order to secure the heater-to-heater gap in an acceptable range, wire spacers are adopted for the PCAT. The wire spacers affect the thermal-hydraulic performance of the PCAT because they enhance the flow mixing among the flow subchannels in the core region. The objectives of this ECAR is to evaluate the effects of the wire spacers on the thermal-hydraulic performance of the PCAT core region by assuming several heterogeneous power distributions.

21 - SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLAN↗

DOE OSTI2022

WISP: Watching grid Infrastructure Stealthily through Proxies (Final Technical Report)

The complex interdependencies of cyber systems (sensors and communications), physical grids and associated electricity market operations make protecting electric power grids a significant challenge. The energy sector is constantly under new, targeted, advanced and dangerous cyber-attacks that have the potential to result in the loss of human life. These threats are further exacerbated by our need to modernize the grid. One focus of cyber security research in smart grids is the securing of the SCADA system through advanced intrusion detection systems (IDS) and bad data detection algorithms in state estimation. These methods either require full knowledge of the system topology and parameters or fail to understand the physical behaviors under attack. WISP (Watching grid Infrastructure Stealthily through Proxies) is designed to provide additional protection to the power grid using only publicly available data. In particular, WISP exploits the spatio-temporal nature of the real time locational marginal prices (LMPs), in conjunction with other information such as bids, weather, outages and load data to analyze anomalous power pricing behaviors and then correlate those observations to localize regions of interest and identify potential cyber events. WISP is non-intrusive as the tool is deployed as a service in the Cloud or on premise and provides reliable information to system operators for enhanced situational awareness, without impeding energy delivery functions. The WISP technology comprises three modules: the data-driven anomaly detection core, the vulnerability and risk analysis and the root cause analysis. The data-driven anomaly detection core performs the tasks of feature selection, anomaly detection and attack region localization. The vulnerability and risk analysis module provides system level information of the vulnerable variables and times, assisting the operators in selecting monitoring and protection nodes. The root cause analysis module takes the detection results and identifies potential operational conditions that contribute to the detected anomalies. In Phase I, we have demonstrated the feasibility and effectiveness of WISP. We developed a realistic electricity market simulator capable of generating normal and attack market data under various operational conditions. We developed a series of cyber-attack detection and analysis algorithms and evaluated them under multiple data sources. Finally, we integrated all modules into an end-to-end software, providing functions for data management, data analytics and visualization. Specifically, we have achieved: (i) real-time data acceptance from external utility interfaces with >99% acceptance rate; (ii) high performance anomaly detection algorithms with >98% detection accuracy and <0.1% false alarm rate; and (iii) ultra-low computing delay <50 milliseconds. Additionally, our team developed algorithms to identify the vulnerable variables in electricity market operations and root cause analysis functions to identify major contributors to the price spikes. These ancillary modules are necessary when deploying WISP in real world industry environment. In Phase II, we have demonstrated the effectiveness of WISP software on realistic largescale power systems. We performed red team testing for the Phase I WISP software and identified software vulnerabilities and implemented corresponding mitigation solutions. We adapted the electricity market simulator for the Texas synthetic 2000-bus system and generated datasets for the false data injection attacks. We created database and visualization interfaces for the Texas system and the ISO New England system. We performed software optimization in terms of operation efficiency, computing speed and detection accuracy. Finally, we tested the software on the Texas system and the ISO New England system and evaluated the detection performance. Overall, we achieved above 89% detection rate, below 3% false alarm rate and below 37 seconds of end-to-end detection delay.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2020

An Assessment of the Usability of Machine Learning Based Tools for the Security Operations Center

Gartner, a large research and advisory company, anticipates that by 2024 80% of security operation centers (SOCs) will use machine learning (ML) based solutions to enhance their operations. 1 1 https://www.ciodive.com/news/how-data-science-tools-can-lighten-the-load-for-cybersecurity-teams/572209/ In light of such widespread adoption, it is vital for the research community to identify and address usability concerns. This work presents the results of the first in situ usability assessment of ML-based tools. With the support of the US Navy, we leveraged the national cyber range-a large, air-gapped cyber testbed equipped with state-of-the-art network and user emulation capabilities-to study six US Naval SOC analysts' usage of two tools. Our analysis identified several serious usability issues, including multiple violations of established usability heuristics for user interface design. We also discovered that analysts lacked a clear mental model of how these tools generate scores, resulting in mistrust a and/or misuse of the tools themselves. Surprisingly, we found no correlation between analysts' level of education or years of experience and their performance with either tool, suggesting that other factors such as prior background knowledge or personality play a significant role in ML-based tool usage. Our findings demonstrate that ML-based security tool vendors must put a renewed focus on working with analysts, both experienced and inexperienced, to ensure that their systems are usable and useful in real-world security operations settings.

Oesch, T↗