Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Analyst”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 1,009 records · Page 56
All sourcesNASA NTRSDOE OSTI
DOE OSTI2025

ComStock Measure Scenario Documentation: Standard Performance Heat Pump Rooftop Unit With New Windows

Building on a 3-year effort to calibrate and validate the U.S. Department of Energy's ResStock (TM) and ComStock (TM) models, this work produces national datasets that empower analysts working for federal, state, utility, city, and manufacturer stakeholders to answer a broad range of questions regarding their commercial building stock. ComStock is a highly granular, bottom-up model that uses multiple data sources, statistical sampling methods, and advanced building energy simulations to estimate the annual energy consumption (at subhourly resolution) of the commercial building stock across the United States. The baseline model intends to represent the U.S. commercial building stock as it existed in 2018. The methodology and results of the baseline model are discussed in the final technical report of the End-Use Load Profiles project. The goal of this work is to develop energy efficiency and demand flexibility end-use load shapes that cover high-impact, market-ready (or nearly market-ready) measures. "Measures" refers to various "what-if" scenarios that can be applied to buildings. An end-use savings shape is the difference in energy consumption between a baseline building (or collection of buildings) and a building with an energy efficiency or demand flexibility measure applied. It results in a time-series profile broken down by end use and fuel (electricity or on-site gas, propane, or fuel oil use) at each time step, as well as annual aggregations.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗
DOE OSTI2025

SIERRA Code Coupling Module: Arpeggio User Manual (V.5.26)

The SNL Sierra Mechanics code suite is designed to enable simulation of complex multiphysics scenarios. The code suite is composed of several specialized applications which can operate either in standalone mode or coupled with each other. Arpeggio is a supported utility that enables loose coupling of the various Sierra Mechanics applications by providing access to Framework services that facilitate the coupling. More importantly Arpeggio orchestrates the execution of applications that participate in the coupling. This document describes the various components of Arpeggio and their operability. The intent of the document is to provide a fast path for analysts interested in coupled applications via simple examples of its usage.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

Bayesian Attack Model (BAM) User Story

This document presents a user story for the Bayesian Attack Model (BAM) tool designed to aggregate and analyze cyber-attack observables for operational technology (OT) systems. BAM aims to empower cybersecurity analysts by providing a streamlined interface for collecting observable data from various sources, enabling real-time analysis of potential adversary activity. By enhancing the response capabilities of security teams, BAM facilitates risk-informed decision-making and improves organizational security posture. This user story outlines the key functionalities, user interactions, and requirements necessary to successfully integrate BAM with other security information and event management (SIEM) technology and cybersecurity operations centers (CSOCs).

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

PARET/ANL v7.7 Verification and Validation Report

This report documents the software testing which has been performed for the PARET/ANL version 7.7 software. The software testing is based on code capabilities identified by research reactor analysts as frequently used in their safety analyses. The verification and validation procedures have been performed and documented to address the steady-state capabilities of the software, as described in Chapter 2, and the transient capabilities, as described in Chapter 3. Testing based on the comparison between PARET/ANL calculations and analytical solutions, hand calculations, or other code calculations of the test cases confirms that all the identified capabilities of the software were implemented correctly. In addition, results from code comparisons against SPERT-I and SPERT-IV experiments for various flow rates are reported for the peak power, energy release and cladding surface temperature. The comparisons showed overall good agreement for the peak power and conservative predictions of the cladding surface temperature.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2025

Abbreviated Report for 25-FS-011: Switch and Stitch Similar Subgraph Synthesizer

Government institutions utilize software from a wide array of development sources, including those written by large software companies, government contractors, and open-source repositories. Avoiding installation of malicious software components is an important national security endeavor. Automated analysis of previously unseen software is an active research area, and there is much research in the design of systems that compare new software artifacts to a large set of previously seen software records organized by various behaviors they contain. One attractive approach is to turn each compiled software binary into a graph representation and apply a graph similarity model that scores pairs of binaries by their relative similarity. When a pair is deemed similar, it is useful to know why, in the sense of providing explanations to security analysts regarding which portions of the software they should look into further.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2025

ResDesign: Resilient by Design Platform for CPS Assessment and Validation

ResDesign project has developed integrated capabilities to help cyber physical system modelers and analysts to evaluate vulnerabilities and resilience of such systems using co-simulation-based attack testbed, graph-based visualization and monitoring tool, and Bayesian optimization-based co-design capability. The project demonstrates a collection of attack scenarios and use cases in an integrated software environment.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2020

Beowulf v2.5.3 User Guide: Revision 5

This document is a user guide for the Beowulf (rebranding of Watchmen) tool. It describes how operators can access and utilize the application's functionality. Beowulf is a research software application developed by Pacific Northwest National Laboratory (PNNL) that incorporates the scientific and operational expertise for reviewing data from treaty monitoring radionuclide stations. These stations are part of a worldwide network to monitor for nuclear explosions, and the data they produce are critical to make the determination of whether a sample is from a nuclear explosion or some other source (i.e., nuclear reactor or medical isotope production facility). Stations deliver their measurements and system status to the International Monitoring System (IMS), which forwards it via email to all subscribers. Beowulf is capable of processing data from several radioxenon station types and development is in progress on a solution for particulate stations. Screening of data in Beowulf may be done by a number of different users such as radionuclide analysts, evaluators, and data quality experts. This guide is provided to assist those users in navigating the application. The term Beowulf is used generically throughout this document to refer to any of the various components in the software application. The user interface that is viewed with a web browser is the primary focus of this user guide. Other components include a database to store measurements and state of health (SOH) data; and the data loader that monitors incoming emails, parses the data, populates the database, does the initial analysis, and routes data for review.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

Practical Probabilistic Programming

Recent advances in probabilistic programming languages (PPLs) have provided the capability for exact inference: computing a closed-form probability distribution for a given probabilistic program. In particular, the new language Roulette uses a language oriented programming (LOP) approach, wherein analysts build new programming languages on top of a set of primitives provided by Roulette, which then translates these structures into a weighted model counting problem which can be solved by automated reasoning tools. However, because Roulette provides few convenience features, developing these new languages is challenging even for expert users. We developed a standard library of common probability functions for Roulette with the goal of improved usability. This included approximation of continuous probability density functions using discrete probability mass functions. We demonstrated this approach by modeling a cosmic ray striking a RAM controller. We found that Roulette provides a powerful interface for highly expressive probabilistic programs to be generated. In collaboration with the NNSA Advanced Simulation and Computing program, which resulted in development of a tool called Circulette, we were able to model complex circuits expressed in Verilog using probabilistic programs with an expressivity not previously possible. Our research question that motivated the development of a Roulette standard library was to determine whether non-experts could use a PPL to model relevant problems regarding radiation effects on microelectronics. This standard library improved the expressivity of Roulette by implementing common probability density functions, mathematical operators on distributions, and support for empirical distributions. While Roulette is a powerful modeling language, the untyped, LOP approach makes error messages difficult to understand and requires expert aid. We recommend further research on Roulette, especially with its error messages, to enable improved usability. At the same time, this project demonstrated that for users familiar with Roulette and the LOP approach, Roulette provides powerful new capabilities that can be integrated with other Sandia modeling capabilities.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

CCUS Plume Monitoring: Verifying Surface CSEM Measurements to Log Scale Available

Conference presentation at Society of Petrophysicists and Well Log Analysts (SPWLA) 64th Annual Symposium, Lake Conroe, Texas, June 10–14, 2023. In carbon capture, utilization, and storage (CCUS) monitoring, dynamic plume monitoring and reservoir seal are key issues. Plume monitoring is best addressed with electromagnetics (sensitive to the resistivity contrast) and reservoir leakage with microseismics. A case history from North Dakota illustrates how we can tie surface-controlled source electromagnetic (CSEM) measurements to the three-dimensional (3D) anisotropic models derived from the available logs. This allows us to certify baseline measurements within the context of the borehole information.

20 FOSSIL-FUELED POWER PLANTS↗
DOE OSTI2014

Operational Reactor Depletion Analysis Capability

The milestone for the operational reactor depletion demonstrates a cycle depletion simulation of Watt's Bar Unit 1 Cycle 1. The simulation was performed using the VERA-CS components MPACT and COBRA-TF. The simulation was performed on the Titan and Eos machines at the Oak Ridge Leadership Computing Facility. The simulation results include the critical boron concentration, the pin resolved power, temperature, and fluid density distributions, and detector responses as a function of time. These results are presented and the critical boron concentration is compared with measured data. The comparison is reasonable given the modeling approximation used at this point. Several suggestions, both near and longer term, are given for areas of future work which include improving the methods, data, models, and computational performance. For those solution results which are not compared to measurement, e.g. power and temperature distributions, their behavior coincides with analysts' expectations. An important next step in the validation of VERA-CS will be the comparison of the computational results to the measured flux data. To satisfy this L1 milestone, numerous capabilities were successfully added as a part of supporting L2 and L3 milestones. These include: full core depletion, generation of a new cross section library, coupling of neutronics and thermal hydraulic feedback, and detector response modeling. In addition to the operational reactor depletion, several 2-D core parametric studies were performed to assess the new simulation capability and to develop guidelines on model approximations and discretizations. Some of the conclusions from these studies are: • The simulation of B-10 depletion in the coolant is necessary to accurately predict critical boron concentrations, • If the end of cycle state is of primary interest in the simulation, then significant approximations may be made in the cycle history. The ability to make use of this approximation without a notable loss in accuracy will considerably accelerate multi-cycle analysis, • The new 47-group cross section library with a transport correction of the P 0 scattering can provide solutions very efficiently and which are nearly as accurate as solutions generated with explicit P 2 scattering, and • Simplified modeling of the equilibrium xenon concentration is well predicted by the existing depletion solver, and only in certain circumstances (e.g. large and "instantaneous" changes to rod position or T/H conditions) would an explicit physical model need to be included. Overall the milestone is considered a success as the objectives were met and several new and important results were produced from this work. The results and conclusions of this milestone will continue to guide future work and become the basis for addressing the CASL Challenge Problems.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
DOE OSTI2013

VERA Core Physics Benchmark Progression Problem Specifications

Provided are the detailed specifications for the AMA Core Physics Benchmark Progression Problems 1 through 5. These problems were selected to assist software and methods developers and analysts in progressing through capabilities needed to model U.S. nuclear power reactors and their operations. The problems provide a prioritization of the VERA requirements for the virtual reactor, beginning at the fuel pin level and progressing to full core, multi-physics problems. They also enable clear and concise communication about what capabilities have been achieved. In addition to the specifications, reference solutions are provided, if available, from a continuous energy Monte Carlo transport solution.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2026

Blueprint: Stakeholder-Specific Vulnerability Categorization Guidance

Vulnerability management is a process of discovering, analyzing, and handling new or reported security vulnerabilities in systems to prevent the systems from being exploited, to reduce risk, and to protect assets. For vulnerability analysis, handling, and response, the prioritization of organizational and analyst resources must precede. The Common Vulnerability Scoring System (CVSS) is a standard prioritization method that is used to rate the severity of security vulnerabilities in systems by assigning numerical severity scores, but it does not provide clear guidelines of how the numerical severity scores might inform decisions. The Stakeholder-Specific Vulnerability Categorization (SSVC) provides a method for prioritizing vulnerabilities based on the needs of the stakeholders involved in the vulnerability management process. Instead of the numerical scoring used in the CVSS, the SSVC focuses on contextual decision-making to determine how quickly and effectively an organization should respond to vulnerabilities. The main functionality of the SSVC accommodates the diversity of the stakeholders in the vulnerability management process, including finders, vendors, coordinators, deployers, and others. So, the SSVC should be designed to be used by any of these stakeholders, and it should be customizable to enable specific stakeholder decision models and risk appetites.

33 ADVANCED PROPULSION SYSTEMS↗
DOE OSTI2026

SIERRA Code Coupling Module: Arpeggio User Manual - Version 5.28

The SNL Sierra Mechanics code suite is designed to enable simulation of complex multiphysics scenarios. The code suite is composed of several specialized applications which can operate either in standalone mode or coupled with each other. Arpeggio is a supported utility that enables loose coupling of the various Sierra Mechanics applications by providing access to Framework services that facilitate the coupling. More importantly Arpeggio orchestrates the execution of applications that participate in the coupling. This document describes the various components of Arpeggio and their operability. The intent of the document is to provide a fast path for analysts interested in coupled applications via simple examples of its usage.

71 CLASSICAL AND QUANTUM MECHANICS, GENERAL PHYSIC↗
DOE OSTI2026

Dynamic Networks Experiment 2: Measuring Associator Sensitivity to Signal Detection Errors

Using the Dynamic Networks Experiment 2 (DNE2) human-analyst event bulletin picks as a baseline signal detection dataset, we generate 47 additional datasets by gradually reducing their accuracy and completeness by randomly removing DNE2 picks, changing the initial phase labels from P to S and vice-versa, and injecting noise detections to simulate real-world signal detection algorithms.

58 GEOSCIENCES↗
DOE OSTI2018

Situ/FASGuard: Combining Anomaly Detection with Signature Generation

Despite the best efforts of cyber security analysts, networked computing assets are regularly compromised, resulting in the loss of intellectual property, the disclosure of state secrets, and financial damages in the billions. A 2014 report from the Center for Strategic and International Studies estimated the global cost of cyber crime at $\$$400 billion annually. There has also been a rise of sophisticated attack groups that continually develop novel methods of penetrating networks that current technologies are typically unable to detect.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Precursor Analysis Report: Ryuk Ransomware Attack on Universal Health Services 2020

The Ryuk Ransomware Attack on Universal Health Services (UHS) 2020 Precursor Analysis Report leverages publicly available information about the 2020 UHS cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. UHS manages over 400 hospitals and is one of the largest healthcare providers in the United States with 3.5 million patients each year. On 27 September 2020, UHS suffered a widespread ransomware attack that resulted in a denial of service to critical internet-dependent healthcare systems including workstations, phones, and data centers. Employees resorted to filing patient details with pen and paper, while other facilities had to redirect ambulances and urgent patients to other facilities for adequate care. Adversaries carried out the attack with Ryuk, a ransomware that encrypts data and generates a RyukReadMe.txt ransom note with the ransom fee to decrypt the data, varying from 15 Bitcoin (BTC) to 50 BTC, equivalent to roughly $\$$353,892 to $\$$964,617. UHS did not pay the ransom and was able to recover data through backups, but still reported an impact of $\$$67 million dollars in recovery costs. On 29 October, one month after the attack, UHS made an official statement that their systems had been restored and they were resuming normal operations. Researchers and analysts identified 18 unique techniques (used in a sequence of 19 steps) utilized during the attack with a total of 185 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Fourteen of the identified techniques used during the UHS cyber attack were precursors to the triggering event. Analysis identified 106 observables associated with these precursor techniques, 82 of which were assessed to have an increased likelihood of being perceived in the 30 days to two hours preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: JBS Foods Ransomware Attack 2021

The JBS Foods 2021 Ransomware Attack Precursor Analysis Report leverages publicly available information about the JBS ransomware cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. In late May 2021, one of the world’s largest meat producers, JBS Foods, announced they had fallen victim to a worldwide ransomware attack, later found to be REvil ransomware. In the United States alone, JBS Foods accounts for nearly 25% of beef and roughly 20% of pork production. Adversaries initially launched a Distributed Denial of Service (DDoS) attack on the company’s Information Technology (IT) networks in Australia, but the attack impacted operations in Brazil, Canada, and the United States, as well. The attack caused plant operations in all four countries to shut down for at least one day. All nine of the U.S. meatpacking plants temporarily shut down because of the attack. The adversaries initially demanded a $\$$22 million ransom for the company’s data, but later negotiated the ransom down to $\$$11 million even after JBS Foods restored most of their systems. JBS Foods eventually paid the $\$$11 Million for reassurance from the adversaries that none of their customers’ data would be compromised in the future. Despite its short duration, the attack still caused large stocks of meat to spoil. The incident also underscored how adversaries can simultaneously compromise and move laterally through global subsidiaries of an organization. Researchers and analysts identified 22 unique techniques (in a sequence of 21 steps) utilized during the attack with a total of 361 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Sixteen of the identified techniques used during the JBS Foods cyber attack were precursors to the triggering event. Analysis identified 308 observables associated with these precursor techniques, 163 of which were assessed to have an increased likelihood of being perceived in the 75 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003

The SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003 Precursor Analysis Report leverages publicly available information about Davis-Besse’s 2003 cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. On 25 January 2003, the SQL Slammer worm infected more than 90% of vulnerable hosts and crashed the internet in 10 to 15 minutes, making it one of the fastest spreading worms in history. SQL Slammer is a fileless, memory-resident worm that remotely exploits a stack-based buffer overflow vulnerability on local hosts to intensively scan and rapidly self-propagate across the internet. The worm infected approximately 300,000 unpatched hosts running Microsoft Structured Query Language (SQL) Server 2000 or Microsoft Desktop Engine (MSDE) 2000 with SQL Server Resolution Service. The SQL Slammer worm indirectly infected FirstEnergy’s Davis-Besse nuclear power plant by first infecting a consultant’s company network server and then propagating through an external misconfigured connection into Davis-Besse’s site network. The infection caused major network congestion, slow performance, data overloads, and the inability of local hosts to communicate with each other, which eventually caused a loss of availability and a loss of view when the Safety Parameter Display System (SPDS) and Plant Process Computer (PPC) crashed. At the time of the infection, the plant was already offline, the digital monitoring systems had redundant analog backups, and the plant control and safety functions were not affected, so there were no concerns of a safety breach. However, this incident resulted in many lessons learned and spawned important discussions about cybersecurity’s role in nuclear safety and electric power reliability regulation, policy, and guidance. Researchers and analysts identified 10 unique techniques utilized during the attack with a total of 640 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Eight of the identified techniques used during Davis-Besse cyber attack were precursors to the triggering event. Analysis identified 596 observables associated with these precursor techniques, 428 of which were assessed to have an increased likelihood of being perceived in the 331 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗