sFlow Monitoring for Security and Reliability
Explore the source record for details and available documents.
Computer Science↗
SEARCH · Engineering Papers
Results for “secure data”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Machine Learning Enhanced Beam Envelope Prediction Using Limited Diagnostic Data
Explore the source record for details and available documents.
linear induction accelerator↗
Authentication Protocol for ICS without Encryption
Industrial control systems (ICS) describes the different types of control systems and associated instrumentation, which includes the devices, systems, networks, and controls used to operate and/or automate industrial processes. Depending on the industry, each ICS functions differently and are built to electronically manage tasks efficiently. Historically, industrial plants have included networking, and changes have been made over time without consideration for security. Many ICS devices currently have inadequate security features. Adding encryption in ICS is undesirable because many of the new detection method involves deep packet inspection. Therefore, we propose to develop a method of providing authentication between devices without encrypting the data. This testbed design will allow rapid development and experimentation with Cyber Physical Systems. Modbus connects to a supervisory computer with a Remote Terminal Unit (RTU) in Supervisory Control and Data Acquisition (SCADA) systems. Our project seeks to enhance security in the ICS environment by adding device authentication to the lower levels of the plant floor. This approach was selected as it allows verification of the sender of data from level 1/level 0 devices up to supervisory systems. This addition is desirable as it adds enhanced verification to the integrity of system data without obscuring (via encryption) the data being transmitted across the network. This is important because many ICS systems are real time critical (decryption adds to latency) and many other good security options require deep packet inspection (which encryption completely defeats). To accomplish this, a proof of concept of adding an authentication scheme was designed and will be tested with a common ICS protocol. The setup includes a single serial cable connecting the serial ports on two devices, a Master and a Minion. Authentication will occur in the following methods: - Data layer involving Transport Layer Security/Secure Socket Layer (TLS/SSL); - TCP/IP route implementation; - Key exchange algorithm; - Raspberry Pi programming for authentication. A portion of the setup includes adding Raspberry Pi into the system as the device is handling the authentication for the network traffic. Modbus is the chosen ICS protocol. It is used to transmit signals from instrumentation and control devices back to a main controller or data gathering system. Typically, the device identity is assumed but not verified. For verifying device identity, we constructed a digital signature architecture with TLS. A novel adaptation of this is to use only the digital signature that is provided and not the encryption capability. This allows ICS traffic to flow unobscured while still providing verification for the integrity of the data. Verification of this process will involve adding additional I/O level network devices with spoofed IP addresses and detecting the authenticated versus unauthenticated traffic. Our TLS implementation will have encryption disabled but should still allow for digital signing of data. This will enable our system to distinguish between real end devices and spoofed end devices. This experiment is presently building the test setup. It is focusing on a small setting to identify authenticated and unauthenticated devices on the network. This should allow for scaling to a larger network size after the initial proof of concept. One concern with this scheme is a certificate deployment has a large scale key management. Network size will thus increase the key management task for security. In addition, we believe that further research should be done on exploring the use of this method to defeat man-in-the-middle attacks.
42 ENGINEERING↗
Assessing the Accuracy of a Borehole-Controlled Velocity Model of Yucca Flat, Nevada, Using Large-N Seismic Data
The Source Physics Experiment (SPE) aims to improve nuclear test monitoring capabilities through a series of chemical explosions in Yucca Flat within the Nevada National Security Site (NNSS) (Snelson et al., 2013). With geologic data from over 950 boreholes, Yucca Flat has excellent borehole control on stratigraphy. These data were used to create a Geologic Framework Model (GFM) of the basin to aid in the study of seismic wave propagation through the Earth. However, the seismic velocities of the geologic units in the GFM are less well-defined. With the acquisition of five new active source Large-N datasets, we can now quantitatively assess the accuracy of the seismic model previously controlled by borehole data alone.
58 GEOSCIENCES↗
AAM NC ATI TechTalk - Aerograph Architecture v1
Aerograph is NASA’s data management system for Advanced Air Mobility. Its mission is to support AAM research by providing a reliable and secure system that collects, stores, protects, and shares AAM data. Its vision is to provide a system that AAM research scientists, aerospace engineers, data scientists, and analysts trust for obtaining NC data and performing key analyses. The types of data Aerograph manages involves data related to flight test events, including: Aircraft Performance and Characterization (e.g., position reports) Airspace (e.g., operation intent, waypoints, and constraints) Environment (e.g., surface and wind weather) Infrastructure (e.g., surveillance coverage) Derivative Analytical Artifacts (e.g., glide path performance chart, 3D position chart, Integrated Data Product)
Aerograph↗
ModuleOT: A Hardware Security Module for Operational Technology: Preprint
With increasing penetration levels of distributed energy resources (DERs) on the distribution grid, as well as new technological advancements in the cyber space, new cyberattack vectors are being introduced, and the available attack surface is constantly increasing. Despite this increasing risk, the standard IEEE 1547-2018 does not yet recommend cybersecurity measures for DERs. To address this and to better protect data on the distribution grid - from the standpoints information security as well as operational security - ModuleOT has been developed. The module aims to significantly reduce cyberattack vectors by improving data privacy for user applications. This is accomplished by performing the core functions of encryption, authentication, authorization, certificate management, and user access control. The module integrates a custom security application with hardware cryptographic acceleration. The application secures all communications using Transmission Control Protocol over Internet Protocol (TCP/IP). These include the three most commonly used communications protocols for power systems information exchange: Modbus, Distributed Network Protocol 3 (DNP3), and Smart Energy Profile 2.0 (SEP2.0). These three protocols are also supported by IEEE 1547-2018 for all DER devices. This paper tests the data encryption/decryption feature on a physical networking test bed with emulated Modbus devices reporting grid data and presents the results.
24 POWER TRANSMISSION AND DISTRIBUTION↗
Tonlé Sap Food Security and Agriculture II: Evaluating Changes in Ecosystem Vitality and Freshwater Healthin the Tonlé Sap Basin using Remotely Sensed Data
The Tonlé Sap Lake and river basin in central Cambodia provide critical ecosystem services to the region, including fisheries, agricultural irrigation, hydropower, and biodiverse habitats. Deforestation, increased pumping for farming, and effects of climate change such as droughts and forest fires threaten the health of the lake and food security in the region. This project built upon the previous term through a partnership with Conservation International (CI), the Cambodian Ministry of Water Resources and Meteorology, and the Tonlé Sap Authority to assess ecosystem vitality and implement CI’s Freshwater Health Index (FHI) tool, in an effort to prioritize resource expenditure and highlight areas of concern. Due to the COVID-19 pandemic and related travel restrictions, partners had not been able to readily collect in situ data for the past year, which make up the majority of FHI inputs. To help fill this data gap, we developed a methodology for using Gravity Recovery and Climate Experiment (GRACE) satellite data to calculate groundwater storage depletion, and a Python Application Programming Interface for processing and formatting remotely-sensed data for the Soil and Water Assessment Tool (SWAT) model. We then used SWAT to model nutrient flows and of phosphorous, nitrogen and suspended sediments amounts in the basin from October 2000 to December 2020. These outputs served as inputs for the FHI and provided policy makers with robust monitoring information to aid decision-making in the area and safeguard the lake’s vital fisheries and biodiversity.
Justine Spore↗
Analytic image reconstruction from partial data for a single-scan cone-beam CT with scatter correction
Purpose: A beam-blocker composed of multiple strips is a useful gadget for scatter correction and/or for dose reduction in cone-beam CT (CBCT). However, the use of such a beam-blocker would yield cone-beam data that can be challenging for accurate image reconstruction from a single scan in the filtered-backprojection framework. The focus of the work was to develop an analytic image reconstruction method for CBCT that can be directly applied to partially blocked cone-beam data in conjunction with the scatter correction. Methods: The authors developed a rebinned backprojection-filteration (BPF) algorithm for reconstructing images from the partially blocked cone-beam data in a circular scan. The authors also proposed a beam-blocking geometry considering data redundancy such that an efficient scatter estimate can be acquired and sufficient data for BPF image reconstruction can be secured at the same time from a single scan without using any blocker motion. Additionally, scatter correction method and noise reduction scheme have been developed. The authors have performed both simulation and experimental studies to validate the rebinned BPF algorithm for image reconstruction from partially blocked cone-beam data. Quantitative evaluations of the reconstructed image quality were performed in the experimental studies. Results: The simulation study revealed that the developed reconstruction algorithm successfully reconstructs the images from the partial cone-beam data. In the experimental study, the proposed method effectively corrected for the scatter in each projection and reconstructed scatter-corrected images from a single scan. Reduction of cupping artifacts and an enhancement of the image contrast have been demonstrated. The image contrast has increased by a factor of about 2, and the image accuracy in terms of root-mean-square-error with respect to the fan-beam CT image has increased by more than 30%. Conclusions: The authors have successfully demonstrated that the proposed scanning method and image reconstruction algorithm can effectively estimate the scatter in cone-beam projections and produce tomographic images of nearly scatter-free quality. The authors believe that the proposed method would provide a fast and efficient CBCT scanning option to various applications particularly including head-and-neck scan.
60 APPLIED LIFE SCIENCES↗
Testing SOAR tools in use
Investigations within Security Operation Centers (SOCs) are tedious as they rely on manual efforts to query diverse data sources, overlay related logs, correlate the data into information, and then document results in a ticketing system. Security Orchestration, Automation, and Response (SOAR) tools are a relatively new technology that promise, with appropriate configuration, to collect, filter, and display needed diverse information; automate many of the common tasks that unnecessarily require SOC analysts’ time; facilitate SOC collaboration; and, in doing so, improve both efficiency and consistency of SOCs. There has been no prior research to test SOAR tools in practice; hence, understanding and evaluation of their effect is nascent and needed. Here, in this paper, we design and administer the first hands-on user study of SOAR tools, involving 24 participants and six commercial SOAR tools. Our contributions include the experimental design, itemizing six characteristics of SOAR tools, and a methodology for testing them. We describe configuration of a cyber range test environment, including network, user, and threat emulation; a full SOC tool suite; and creation of artifacts allowing multiple representative investigation scenarios to permit testing. We present the first research results on SOAR tools. Concisely, our findings are that: per-SOC SOAR configuration is extremely important; SOAR tools increase efficiency and reduce context switching, although with potentially decreased ticketing accuracy/completeness; user preference is slightly negatively correlated with their performance with the tool; internet dependence varies widely among SOAR tools; and balance of automation with assisting decision making is preferred by senior participants. We deliver a public user- and tool-anonymized and -obfuscated version of the data.
97 MATHEMATICS AND COMPUTING↗
A Deep End-to-End Model for Transient Stability Assessment With PMU Data
Accurate transient stability assessment (TSA) is a fundamental requirement for ensuring secure and stable operation of power systems. Tremendous efforts have been made to apply artificial intelligence approaches for TSA with phasor measurement unit data. However, many previous approaches may be failed to provide favorable accuracy due to the shallow architectures and error-prone hand-crafting features. This paper proposed a model for TSA, which is termed multi-branch stacked denoising autoencoder (MSDAE). This model is a unified framework integrating multiple stacked denoising autoencoders (SDAEs), one fusion layer, and one logistic regression (LR) layer. Initially, the SDAEs at the bottom of MSDAE extract features from multiple kinds of measurements respectively. Then, the extracted features are encoded into unified fusion features by the fusion layer. Finally, the LR layer performs TSA by using the fusion features. The depth of the architecture contributes to the remarkable ability for feature learning, while the width of the architecture (i.e., the multiple branches) enables MSDAE to deal with different kinds of measurements by a reasonable mechanism. In this way, MSDAE achieves feature extraction and classification intrinsically and simultaneously, namely, achieves TSA in an end-to-end manner. The results of experiments on IEEE 50-machine system demonstrate the superiority of the proposed model over the prior methods.
42 ENGINEERING↗
Blockchain for Fault-Tolerant Grid Operations Version 2.0
This report explores the potential of distributed ledger technology (DLT) as a transformative tool to enhance fault-tolerant operations in electrical distribution systems. Leveraging DLT's core attributes, including an immutable decentralized ledger, distributed consensus mechanisms, and state replication capabilities, this study focuses on three critical use cases. A central aspect of this research centers on the utilization of a consensus-driven ledger, providing actors within the system, such as distributed resources, with access to a reliable data repository. This empowers these actors to collaborate effectively and make informed decisions, all securely recorded on the blockchain. The first use case concentrates on data configuration, utilizing mathematical criteria---particularly, the chi-squared test for gross error detection---to identify trustworthy sensors for advanced decision-making. Building upon this foundation of trust, the second use case, topology identification, accurately determines circuit breaker states, unveiling the distribution network's topology. Ultimately, the third use case leverages this trust to execute switching actions, reconfiguring feeders and restoring power to disconnected customers after fault events. The concept of trust serves as a cornerstone in this approach, marking a departure from traditional fault location, isolation, and service restoration (FLISR) methods. Additionally, the blockchain-based architecture introduces decentralization, empowering disconnected areas to make autonomous decisions, even when communication with a central control center is disrupted. The primary contributions of this report are twofold: (1) a novel approach for evaluating distribution system voltage areas while preserving data ownership and (2) the implementation of interactions between distribution network areas using the actor model. Unlike the previous sequential approach for evaluating the area connection voltages, which required a radial network topology, this study's area model reduction enables a more versatile approach. The area model reduction addresses issues of prolonged data waiting times and multiple points of failure within the previous approach. Notably, the presented evaluation for the reduced network model area connection reveals a significant increase in the differences in voltage magnitudes. Simulation and evaluation of area agents across four distinct cases elucidate the area-level interaction behavior during a fault event. Simulations demonstrate that the proposed distributed FLISR (DFLISR) approach can successfully restore service to an affected area. Varying message delays and message loss probabilities in each simulation case underscore their impacts on restoration times, ranging from 3 min and 32 s to 6 min and 19 s. In contrast, power is not restored in an area in one of our simulation cases.
24 POWER TRANSMISSION AND DISTRIBUTION↗
Understanding long-term groundwater flow at Pahute Mesa and vicinity, Nevada National Security Site, USA, from naturally occurring geochemical and isotopic tracers
Abstract Recently collected naturally occurring geochemical and isotopic groundwater tracers were combined with historic data from the Pahute Mesa area of the Nevada National Security Site (NNSS), Nevada, USA, to provide insights into long-term regional groundwater flow patterns, mixing and recharge. Pahute Mesa was the site of 85 nuclear detonations between 1965 and 1992, many of them deeply buried devices that introduced radionuclides directly into groundwater. The dataset examined included major ions and field measurements, stable isotopes of hydrogen (δ 2 H), oxygen (δ 18 O), carbon (δ 13 C) and sulfur (δ 34 S), and radioisotopes of carbon ( 14 C) and chloride ( 36 Cl). Analysis of the patterns of groundwater 14 C data and the δ 2 H and δ 18 O signatures indicates that groundwater recharge is predominantly of Pleistocene age, except for a few localized areas near major ephemeral drainages. Steep gradients in sulfate (SO 4 ) and chloride (Cl) define a region near the western edge of the NNSS where high-concentration groundwater flowing south from north of the NNSS merges with dilute groundwater flowing west from eastern Pahute Mesa in a mixing zone that coincides with a groundwater trough associated with major faults. The 36 Cl/Cl and δ 34 S data suggest that the source of the high Cl and SO 4 in the groundwater was a now-dry, pluvial-age playa lake north of the NNSS. Patterns of groundwater flow indicated by the combined data sets show that groundwater is flowing around the northwest margin of the now extinct Timber Mountain Caldera Complex toward regional discharge areas in Oasis Valley.
58 GEOSCIENCES↗
Data Release Report Source Physics Experiments 5 and 6 (SPE-5 and SPE-6), Nevada National Security Site
The fifth Source Physics Experiment test (SPE-5) was conducted in Nevada on April 26, 2016, at 20:49:00 Coordinated Universal Time (UTC). The explosive source was 4,288.7 kilograms (kg) of polymer-bonded explosive (PBXN) –110, equivalent to 5,035 kg of trinitrotoluene (TNT) detonated at a depth of 76.5 meters (m). The sixth Source Physics Experiment test (SPE-6) was conducted in Nevada on October 12, 2016 at 18:36:00 UTC. The explosive source was 1,982.2 kg of PBXC-141, equivalent to 2,240.2 kg of TNT detonated at the depth of 31.4 m. Both tests were recorded by an extensive set of instrumentation that includes sensors both at near-field (less than 100 m) and far-field (100 m or greater) distances. The near-field instruments consisted of three-component accelerometers installed at various depths ranging from 4 to 99 m below ground surface in boreholes positioned around the shot, and a set of single-component vertical accelerometers on the surface. The far-field network was composed of a variety of seismic and acoustic sensors, including short-period geophones, broadband seismometers, and three-component accelerometers at distances of 100 m to 400 kilometers. In addition, both explosions were recorded in a temporary array of 996 geophones arranged in a densely spaced grid pattern (“large N”). This report coincides with the release of these data for analysts and organizations that are not participants in this program. This report describes the fifth and sixth Source Physics Experiment tests and the various types of near-field and far-field data that are available.
58 GEOSCIENCES↗
Real-Time SCADA Cyber Protection Using Compression Techniques
The Department of Energy’s Office of Electricity Delivery and Energy Reliability (DOE-OE) has a critical mission to secure the energy infrastructure from cyber attack. Through DOE-OE’s Cybersecurity for Energy Delivery Systems (CEDS) program, the Idaho National Laboratory (INL) has developed a method to detect malicious traffic on Supervisory, Control, and Data Acquisition (SCADA) network using a data compression technique. SCADA network traffic is often repetitive with only minor differences between packets. Research performed at the INL showed that SCADA network traffic has traits desirable for using compression analysis to identify abnormal network traffic. An open source implementation of a Lempel-Ziv-Welch (LZW) lossless data compression algorithm was used to compress and analyze surrogate SCADA traffic. Infected SCADA traffic was found to have statistically significant differences in compression when compared against normal SCADA traffic at the packet level. The initial analyses and results are clearly able to identify malicious network traffic from normal traffic at the packet level with a very high confidence level across multiple ports and traffic streams. Statistical differentiation between infected and normal traffic level was possible using a modified data compression technique at the 99% probability level for all data analyzed. However, the conditions tested were rather limited in scope and need to be expanded into more realistic simulations of hacking events using techniques and approaches that are better representative of a real-world attack on a SCADA system. Nonetheless, the use of compression techniques to identify malicious traffic on SCADA networks in real time appears to have significant merit for infrastructure protection.
97 MATHEMATICS AND COMPUTING↗
Assessment on security system of radioactive sources used in hospitals of Thailand
Unsecured radioactive sources have caused deaths and serious injuries in many parts of the world. In Thailand, there are 17 hospitals that use teletherapy with cobalt-60 radioactive sources. They need to be secured in order to prevent unauthorized removal, sabotage and terrorists from using such materials in a radiological weapon. The security system of radioactive sources in Thailand is regulated by the Office of Atoms for Peace in compliance with Global Threat Reduction Initiative (GTRI), U.S. DOE, which has started to be implemented since 2010. This study aims to perform an assessment on the security system of radioactive sources used in hospitals in Thailand and the results can be used as a recommended baseline data for development or improvement of hospitals on the security system of a radioactive source at a national regulatory level and policy level. Results from questionnaires reveal that in 11 out of 17 hospitals (64.70%), there were a few differences in conditions of hospitals using radioactive sources with installation of the security system and those without installation of the security system. Also, personals working with radioactive sources did not clearly understand the nuclear security law. Thus, government organizations should be encouraged to arrange trainings on nuclear security to increase the level of understanding. In the future, it is recommended that the responsible government organization issues a minimum requirement of nuclear security for every medical facility using radioactive sources.
07 ISOTOPE AND RADIATION SOURCES↗
Report on Next-Gen AI for Proliferation Detection Workshop: Domain-Aware Methods
The emergence of artificial intelligence (AI) and machine learning (ML) in the modern world has impacted nearly every application imaginable. This includes nuclear proliferation detection, which offers the potential to improve existing capabilities as well as create new ones. Proliferation detection seeks to detect and characterize attempts by state and non-state actors to acquire nuclear weapons or associated technology, materials, or knowledge. Such a mission is vitally important for global stability and security but is notoriously difficult. By leveraging advances in AI, exciting opportunities exist to enhance the proliferation detection regime. The Data Science and AI portfolio within the National Nuclear Security Administration’s Office of Defense Nuclear Nonproliferation Research and Development (DNN R&D) seeks to leverage the capabilities of the Department of Energy’s (DOE’s) national laboratories and other partners to develop AI systems that can accomplish otherwise impossible tasks in support of proliferation detection. As part of its efforts, the portfolio has created a series of workshops on Next-Gen AI for Proliferation Detection to help define the requirements for suitable AI systems, share successful research and best practices, and foster connection and understanding between the relevant parties including researchers and end-users. Each workshop in the series focuses on a specific and critical aspect of AI to enable it to accomplish proliferation detection objectives. The first workshop focused on explainability techniques; the second workshop and the topic of this report, covers methods for incorporating domain awareness into AI. The Next-Gen AI for Proliferation Detection Workshop: Domain-Aware Methods took place virtually over two days in February 2021 and included four keynote presentations, 22 technical presentations, and a concluding panel. The presentations, discussions, and workshop findings are summarized in this report.
97 MATHEMATICS AND COMPUTING↗
An Overview of the Usefulness of Machine Learning Techniques on Network Packet Data
Understanding the health and behavior of a computer network allows for better network efficiency and security. We present an overview of various machine learning techniques for classifying network packet data via packet metadata. While some classical machine learning approaches achieve reasonable results, the most accurate classification can be achieved with deep learning. On the four data sets studied herein, a basic deep learning model achieved at or near 100\% classification accuracy. We also propose a method for determining variable importance as a means for potential transfer learning applications to classifying yet unseen network packet data.
97 MATHEMATICS AND COMPUTING↗
Tonlé Sap Food Security and Agriculture: Evaluating the Effects of Land Use and Hydrological Change on Ecosystem Vitality using Remotely-Sensed Data in the Tonlé Sap Lake Basin
Tonlé Sap Lake, the largest lake in Southeast Asia, is a critical source of fish and freshwater resources for the region. The health of this freshwater system is under pressure from accelerating dam construction, intensifying agriculture, deforestation, and changing climate patterns, forcing tradeoffs between immediate food security and the long-term vitality and productivity of the ecosystem. Efficient freshwater system monitoring is crucial to navigating these challenges. In collaboration with Conservation International, the Cambodian Ministry of Water Resources and Meteorology, and the Tonlé Sap Authority, we developed and tested remotely-sensed proxies for sub-indicators of the Freshwater Health Index (FHI), which is typically calculated using in situ datasets. We used landcover datasets derived from Landsat 5 Thematic Mapper (TM), Landsat 7 Enhanced Thematic Mapper Plus (ETM+), Landsat 8 Operational Land Imager (OLI), PROBA-V Vegetation sensor (VGT), Sentinel-2 Multispectral Imager (MSI), Advanced Very High Resolution Radiometer (AVHRR), and Envisat Medium Resolution Imaging Spectrometer (MERIS) as inputs to calculate land cover naturalness and bank modification. Additionally, we created a lake-level time series using a collection of altimetry data sources to estimate deviation from natural flow. We observed a decrease in landcover naturalness and a breakdown in the volume and regularity of annual lake levels from 2000-2020, reflecting increased pressure on water supply and agricultural productivity. At least 8% of forested areas in the basin were lost and rice harvest intensity increased over the course of the study period. These results will help our partners make informed decisions regarding freshwater management. Furthermore, our remotely-sensed FHI analysis can be replicated in other regions, providing decision makers with a snapshot of freshwater health in data-scarce environments.
Marco Vallejos↗