Results for “THREAT” — Page 5

NASA NTRSDate not supplied

Identifying Emerging Safety Threats Through Topic Modeling in the Aviation Safety Reporting System: A Covid-19 Study

The NASA Aviation Safety Reporting System (ASRS) is a voluntary, confidential aviation safety reporting system. The ASRS receives reports from pilots, air traffic controllers, flight attendants, and others involved in aviation operations. The reports are de-identified and coded by ASRS expert safety analysts, and a short descriptive synopsis is written to describe the safety issue. The de-identified reports are then disseminated to the aviation community in many ways, including via an online database, Safety Alert Bulletins, For Your Information Notices, and the CALLBACK newsletter. In this work, we consider whether we can improve the grouping, linking, and understanding of safety concerns through topic modeling. Specifically, we use topic modeling as a building block to identify emerging safety threats over time. This unsupervised approach, we argue, offers the flexibility to identify new emerging themes in this large dataset by constructing different timelines based on the content similarity of ASRS report narratives. This method's unsupervised nature improves upon related research, which is limited to pre-defined labels and therefore can not fully capture emerging safety threats. We apply our method to all ASRS reports in 2020 to assess if the generated timelines can highlight COVID-19 as it is emerging as a safety threat in incoming ASRS reports. We perform both a quantitative and qualitative evaluation of the automatically constructed timelines. The qualitative evaluation is performed by describing the evolution of top terms in the timelines, generated by our method, which we found explicitly convey the themes of COVID-19. Separately, we use a set of 1,213 COVID-19 reports from 2020 that were manually identified by ASRS analysts to quantitatively evaluate the COVID-19 reports distribution across the timelines. Our results have shown that COVID-19 emergence can be identified using the top terms that were generated by topic modeling. The top terms in topic modeling therefore can serve as a summary alternative to manually inspecting reports. Moreover, leveraging the manually identified COVID-19 reports, we found the manually identified timelines accounted for over 70% of the COVID-19 reports curated by the ASRS analysts, which demonstrates the potential of this approach for facilitating the understanding of safety concerns as they emerge and evolve. This method shows great potential to understand aerospace safety threats and other narrative- driven incident report databases.

ASRS↗

NASA NTRSDate not supplied

Identifying Emerging Safety Threats Through Topic Modeling in the Aviation Safety Reporting System: A COVID-19 Study

The NASA Aviation Safety Reporting System (ASRS) is a voluntary, confidential aviation safety reporting system. The ASRS receives reports from pilots, air traffic controllers, flight attendants, and others involved in aviation operations. The reports are de-identified and coded by ASRS expert safety analysts, and a short descriptive synopsis is written to describe the safety issue. The de-identified reports are then disseminated to the aviation community in many ways, including via an online database, Safety Alert Bulletins, For Your Information Notices, and the CALLBACK newsletter. In this work, we consider whether we can improve the grouping, linking, and understanding of safety concerns through topic modeling. Specifically, we use topic modeling as a building block to identify emerging safety threats over time. This unsupervised approach, we argue, offers the flexibility to identify new emerging themes in this large dataset by constructing different timelines based on the content similarity of ASRS report narratives. This method's unsupervised nature improves upon related research, which is limited to pre-defined labels and therefore can not fully capture emerging safety threats. We apply our method to all ASRS reports in 2020 to assess if the generated timelines can highlight COVID-19 as it is emerging as a safety threat in incoming ASRS reports. We perform both a quantitative and qualitative evaluation of the automatically constructed timelines. The qualitative evaluation is performed by describing the evolution of top terms in the timelines, generated by our method, which we found explicitly convey the themes of COVID-19. Separately, we use a set of 1,213 COVID-19 reports from 2020 that were manually identified by ASRS analysts to quantitatively evaluate the COVID-19 reports distribution across the timelines. Our results have shown that COVID-19 emergence can be identified using the top terms that were generated by topic modeling. The top terms in topic modeling therefore can serve as a summary alternative to manually inspecting reports. Moreover, leveraging the manually identified COVID-19 reports, we found the manually identified timelines accounted for over 70% of the COVID-19 reports curated by the ASRS analysts, which demonstrates the potential of this approach for facilitating the understanding of safety concerns as they emerge and evolve. This method shows great potential to understand aerospace safety threats and other narrative- driven incident report databases.

ASRS↗

DOE OSTI2015

Prevent, Counter, and Respond - A Strategic Plan to Reduce Global Nuclear Threats (FY 2016-FY2020)

NNSA’s second core mission is reducing global nuclear dangers by preventing the acquisition of nuclear weapons or weapons-usable materials, countering efforts to acquire such weapons or materials, and responding to nuclear or radiological incidents. In 2015, NNSA reorganized its nonproliferation activities based on core competencies and realigned its counterterrorism and counterproliferation functions to more efficiently address both current and emerging threats and challenges. The reorganization accompanied the March 2015 release of the first ever Prevent, Counter, and Respond – A Strategic Plan to Reduce Global Nuclear Threats. This report, which NNSA will update annually, highlights key nuclear threat trends and describes NNSA’s integrated threat reduction strategy.

Source record↗

DOE OSTI2018

System and method of detecting and analyzing a threat in a confined environment

A system and method of detecting and analyzing a threat in a confined environment is disclosed. An audio board detects and analyzes audio signals. A RF board transmits the signals for emergency response. A battery provides power to the audio board and the RF board. The audio board includes a microcontroller with at least one band-pass filter for distinguishing between a threat and a non-threat event and for measuring or counting pulses if the event is a threat.

47 OTHER INSTRUMENTATION↗

DOE OSTI2019

Trends and Patterns in the Evolving Threat to Radioactive and Nuclear Material Transportation

Roughly 20 million shipments of radioactive material are transported worldwide each year via commercial transportation vectors. Many of these can be considered a significant movement of risk-significant quantities of radioactive and nuclear material. A strong argument can be made to support the idea that transportation presents the greatest vulnerability in radioactive sealed source and nuclear material life-cycles. Historical and current information strongly suggests adversarial interest in obtaining radiological and nuclear materials with the intent of malicious use. In this context, it is necessary to understand the current trends and patterns in transportation threats as they apply to these materials in order to better understand security needs and current adversarial methods and mind-set.The authors propose to summarize current threats posed to radiological and nuclear materials during the transportation phase of the lifecycle. The paper and ensuing presentation will focus on a review of historical events where the adversarial intent was to disrupt the transportation phase of nuclear and radioactive material with malicious intent, as reported in open source literature. Its purpose is to better understand the nature of current and past transportation incidents involving these materials in order to clarify the evolving nature of the threats and vulnerabilities they reveal. Relevant incidents involving transportation of these materials will be discussed as well as the historical trends associated with these events. A regional perspective based on an analysis of transportation incidents involving these materials will be discussed. While not necessarily predictive of the types of malicious disruptions that might occur in the future, this study will provide a rich information source from which lessons can be gleaned pertinent to the potential security and public safety threats posed by the transportation of commercial radioactive and nuclear material.

Shannon, Michael↗

DOE OSTI2023

Mitigating Extremist Maritime Threats to Radiological Material Transport Vessels

The 21st century has experienced a rise in the threat of global radicalism and extremist organizations, and there has been oft-reported interest from these groups in obtaining or exploiting radiological materials. The threat of extremists acquiring radiological materials while in transit or sabotaging a transport vessel carrying materials at sea is one that requires increased attention. Transport is already one of the most vulnerable times for any cargo but including the difficulties in securing a large ship on the open ocean makes oceanic transport of radiological materials a space of elevated vulnerability for sabotage, theft, or other attacks. The risks of violent extremist attacks on trade ships and trading routes are serious, as shipping routes sustain the global economy, but an attack on a radiological transport vessel could be a magnitude worse, impacting national and international security. While radicalists have largely remained on land in the past due to minimal maritime expertise or inability to project power out of their immediate vicinity, the world has witnessed past attacks on ships such as the USS Cole and the MV Limburg and it is likely only a matter of time before groups extend further into the sea and engage in more maritime campaigns against material transport vessels. This paper suggests methods for increasing safety and security on oceanic transport voyages through behavioral science principles and insider threat recognition training, as well as a better understanding of adversarial and extremist psychology. By providing transport personnel with the knowledge and support to identify and respond to unique maritime threats by extremists, these principles and training suggestions should advance and increase security on the high seas.

Kinney, Justin↗

DOE OSTI2010

Cyber Threats to Nuclear Infrastructures

Nuclear facility personnel expend considerable efforts to ensure that their facilities can maintain continuity of operations against both natural and man-made threats. Historically, most attention has been placed on physical security. Recently however, the threat of cyber-related attacks has become a recognized and growing world-wide concern. Much attention has focused on the vulnerability of the electric grid and chemical industries to cyber attacks, in part, because of their use of Supervisory Control and Data Acquisition (SCADA) systems. Lessons learned from work in these sectors indicate that the cyber threat may extend to other critical infrastructures including sites where nuclear and radiological materials are now stored. In this context, this white paper presents a hypothetical scenario by which a determined adversary launches a cyber attack that compromises the physical protection system and results in a reduced security posture at such a site. The compromised security posture might then be malevolently exploited in a variety of ways. The authors conclude that the cyber threat should be carefully considered for all nuclear infrastructures.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗

DOE OSTI2024

Linking Threat Agents to Targeted Organizations: A Pipeline for Enhanced Cybersecurity Risk Metrics

In this study, we present a methodology leveraging Large Language Models (LLMs) to transform Cybersecurity Threat Intelligence (CTI) narratives into actionable insights for individual organizations. Our approach automates the extraction of machine-readable adversary SKRAM (Skills, Knowledge, Resources, Authorities, and Motivation) attributes from open-source reports, extending LLM utility beyond typical interactions. This innovation enables precise, automated assessments of cybersecurity risks posed by various adversaries. Using a chain-of-thought and multi-shot prompting strategy, our methodology advances the automation of cybersecurity feature extraction for new machine-learning models that predict the risk of adversary targeting. This approach is refined using a substantial dataset of over 150 analyst-validated threat reports and synthetic organizational data from 900 companies. Here, by bootstrapping the training data with a rule-based heuristic over synthetic data, we have developed a high-accuracy machine-learning model that allows entities to dynamically prioritize threats and defensive actions.

Cyber Threat Intelligence↗

DOE OSTI2024

A Privacy-Preserving Cyber Threat Intelligence Sharing System

Cyber Threat Intelligence (CTI) is a key resource for developing defensive strategies against potential cyber adversaries. Entities typically access CTI through open-source platforms, national agencies, or specialized commercial services. However, the bi-directional exchange of CTI is hindered by organizational trust boundaries, which complicate the sharing processes between entities and CTI providers. Centralized CTI services benefit from receiving suspicious cyber observables such as IP addresses, domain names, and email addresses from various entities. The aggregation allows for the correlation of widespread adversarial activities to enhance the alert and response mechanisms across the network of involved parties. Despite these benefits, openly sharing such observables incurs potential legal, regulatory, and reputational risks for the disclosing entities.This paper introduces a system designed to facilitate the secure exchange of cyber observables across trust boundaries without compromising the anonymity of the sharing entities. Here, we propose an architecture that leverages common web protocols alongside zero-knowledge proofs to authenticate members while maintaining anonymity. Additionally, we outline a privacy model tailored for STIX (Structured Threat Information eXpression) cyber observables to minimize the risk of inadvertently disclosing private information. Through our threat models, we assess the privacy implications of our proposed system and demonstrate its potential to enhance collaborative cyber defense efforts without exposing entities to undue risk.

BBS+ Signatures↗

DOE OSTI2019

Understanding Power System Threats and Impacts

Understanding potential threats to a power system is an essential first step in supporting power sector resilience. It is important to assess both current and future threats, as well as the likelihood of these threats over time.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗

DOE OSTI2019

Achieving Health Security and Threat Reduction through Sharing Sequence Data

With the rapid development and broad applications of next-generation sequencing platforms and bioinformatic analytical tools, genomics has become a popular area for biosurveillance and international scientific collaboration. Governments from countries including the United States (US), Canada, Germany, and the United Kingdom have leveraged these advancements to support international cooperative programs that aim to reduce biological threats and build scientific capacity worldwide. A recent conference panel addressed the impacts of the enhancement of genomic sequencing capabilities through three major US bioengagement programs on international scientific engagement and biosecurity risk reduction. Here, the panel contrasted the risks and benefits of supporting the enhancement of genomic sequencing capabilities through international scientific engagement to achieve biological threat reduction and global health security. The lower costs and new bioinformatic tools available have led to the greater application of sequencing to biosurveillance. Strengthening sequencing capabilities globally for the diagnosis and detection of infectious diseases through mutual collaborations has a high return on investment for increasing global health security. International collaborations based on genomics and shared sequence data can build and leverage scientific networks and improve the timeliness and accuracy of disease surveillance reporting needed to identify and mitigate infectious disease outbreaks and comply with international norms. Further efforts to promote scientific transparency within international collaboration will improve trust, reduce threats, and promote global health security.

60 APPLIED LIFE SCIENCES↗

NASA NTRS2017

Near Earth Asteroid Characterization for Threat Assessment

Physical characteristics of NEAs are an essential input to modeling behavior during atmospheric entry and to assess the risk of impact but determining these properties requires a non-trivial investment of time and resources. The characteristics relevant to these models include size, density, strength and ablation coefficient. Some of these characteristics cannot be directly measured, but rather must be inferred from related measurements of asteroids and/or meteorites. Furthermore, for the majority of NEAs, only the basic measurements exist so often properties must be inferred from statistics of the population of more completely characterized objects. The Asteroid Threat Assessment Project at NASA Ames Research Center has developed a probabilistic asteroid impact risk (PAIR) model in order to assess the risk of asteroid impact. Our PAIR model and its use to develop probability distributions of impact risk are discussed in other contributions to PDC 2017 (e.g., Mathias et al.). Here we utilize PAIR to investigate which NEA characteristics are important for assessing the impact threat by investigating how changes in these characteristics alter the damage predicted by PAIR. We will also provide an assessment of the current state of knowledge of the NEA characteristics of importance for asteroid threat assessment. The relative importance of different properties as identified using PAIR will be combined with our assessment of the current state of knowledge to identify potential high impact investigations. In addition, we will discuss an ongoing effort to collate the existing measurements of NEA properties of interest to the planetary defense community into a readily accessible database.

Asteroid characterization↗

NASA NTRSDate not supplied

A Survey of Cyber Threats and Security Controls Analysis for Urban Air Mobility Environments

Since the cyber threat landscape changes daily, cybersecurity needs to be an ongoing activity for every organization within the UAM environments. This paper will provide information on identified cyber threats and controls associated with an instance of the Urban Air Mobility (UAM) environment. The MITRE ATT&CK model and framework and the selection of cyber threats and the National Institute of Standards and Technology publications for security control identification and cybersecurity risk identification will be leveraged for analysis.

Cyber Threats↗

NASA NTRSDate not supplied

Cyber Threats & Security Controls Analysis for Urban Air Mobility Environments

Since the cyber threat landscape changes daily, cybersecurity needs to be an ongoing activity for every organization within the UAM environments. This paper will provide information on identified cyber threats and controls associated with an instance of the Urban Air Mobility (UAM) environment. The MITRE ATT&CK model and framework and the selection of cyber threats and the National Institute of Standards and Technology publications for security control identification and cybersecurity risk identification will be leveraged for analysis.

Cyber Threats↗

DOE OSTI2012

The Global Threat Reduction Initiative's Orphan Source Recovery Project in the Russian Federation

After 9/11, officials at the United States Department of Energy (DOE), National Nuclear Security Administration (NNSA) grew more concerned about radiological materials that were vulnerable to theft and illicit use around the world. The concern was that terrorists could combine stolen radiological materials with explosives to build and detonate a radiological dispersal device (RDD), more commonly known as a “dirty bomb.” In response to this and other terrorist threats, the DOE/NNSA formed what is now known as the Global Threat Reduction Initiative (GTRI) to consolidate and accelerate efforts to reduce and protect vulnerable nuclear and radiological materials located at civilian sites worldwide. Although a cooperative program was already underway in the Russian Federation to secure nuclear materials at a range of different facilities, thousands of sealed radioactive sources remained vulnerable at medical, research, and industrial sites. In response, GTRI began to focus efforts on addressing these materials. GTRI’s Russia Orphan Source Recovery Project, managed at the Nevada National Security Site’s North Las Vegas facility, was initiated in 2002. Throughout the life of the project, Joint Stock Company “Isotope” has served as the primary Russian subcontractor, and the organization has proven to be a successful partner. Since the first orphan source recovery of an industrial cobalt-60 irradiator with 647 curies (Ci) at an abandoned facility in Moscow in 2003, the GTRI Orphan Source Recovery Project in the Russian Federation has accomplished substantial levels of threat reduction. To date, GTRI has recovered and securely disposed of more than 5,100 sources totaling more that 628,000 Ci. This project serves as an extraordinary example of how international cooperation can be implemented by partners with mutual interests to achieve significant goals.

GTRI, Global Threat Reduction Initiative, Russian ↗

DOE OSTI2023

Comparison of Socio-Technical Threat Models

Given the adoption of emerging technologies and the increasing complexity of managing such systems with a lifecycle much shorter than that of critical infrastructure systems, there is a practical need to be able to analyze sociotechnical dependencies and their associated evolving risks. Threat models based on social influence techniques can be used to implement adversarial tactics analogous to the cyber kill chain and attested to within the MITRE ATT&CK for ICS framework including Initial Access, Persistence, Collection, and Impact. Furthermore, as with cyber disruptions, the impact of social influence threat models can have an asymmetric impact that is not spatially-localized. Finally, unlike cyber attacks with a reasonably short duration (ransomware takes days to months), social influence based attacks have the potential to persist for much longer as they are based on long-term strategic infrastructure investments within the private sector. Given the increased importance of electric vehicle charging stations as a long-term, strategic infrastructure investment within the Energy and Transportation Sectors, we provide initial results that compare the impact of a Loss of Availability (T0826) realized through cyber and social influence based threat models. The analysis employs techniques from automated reasoning and measures of network complexity to understand evolving dominance of EV payment and charging networks within geographic region of interest. Within this context, we compare the impact of a loss of availability due to ransomware versus that of loss of support due to a merger and acquisition. Results across several different metro areas will be provided.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗

DOE OSTI2025

Threat Landscape for BESS and IBR

The cyber risk landscape for BESS and IBR can be broken up by threats, vulnerabilities, and consequences for these systems. This presentation walks through the cyber risk landscape for BESS through the lens of consequence-informed awareness and mitigation for each risk factor. Threats with varying capabilities have been demonstrated in real-world events. Though threat actors can rarely be directly influenced by organizations, exposure of systems to adversaries can be limited (a known issue with IBR systems) to reduce likelihood of adversaries accessing systems with disruptive consequences. Common trends in disclosed IBR vulnerabilities include weak password generation or managements for various devices or services and web portal vulnerabilities that provide unauthorized access to data or capabilities or elevated user privileges. Understanding these common vulnerabilities and considering the consequences if these types of vulnerabilities were to occur can help mitigate risk. Consequences range from loss-of-view events that have no reliability impact to asset damage or grid stability impacts. Five case studies are briefly shared to highlight trends in real-world events affecting IBR.

14 - SOLAR ENERGY↗

DOE OSTI2025

Cybersecurity Enhancement in Digital Substations: Hidden Markov Model-Based Smart Cyber Switching and Threat Response

The rising incidence of cyber-attacks on critical infrastructure and power grids poses significant threats to the stability and reliability of electrical substations, with potentially devastating consequences such as extended blackouts. This paper introduces an advanced cybersecurity framework aimed at safeguarding IEC 61850-based substations through the integration of software-defined networking (SDN) and digital twin (DT) technologies. The proposed DT-based framework employs smart cyber switching (SCS) for proactive threat mitigation and concurrent intelligent electronic device (CIED) for swift system restoration, thereby maintaining continuous operational integrity and robust cybersecurity defenses. Central to this framework is the adaptive port controller (APC), which enables dynamic port management to adapt to evolving threats, and an intrusion detection system (IDS) designed to detect and neutralize malicious attacks on IEC 61850-based sampled value (SV) and generic object-oriented substation event (GOOSE) messages within the substation’s communication network. Further, novel predictive intrusion detection and response (PIDR) algorithm is implemented on a digital substation (DS) to predict the best route to be taken by the attacker. The efficacy of these comprehensive cybersecurity frameworks is validated through rigorous simulations and a hardware-in-the-loop (HIL) testbed, showcasing the system’s ability to sustain substation operations amidst cyber-attacks.

Digital substation↗