Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Cybersecurity”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 1,009 records · Page 56

TRIM: AI Guided Random Number Generation for Resource-Constrained IoT Systems

Random numbers often serve as the backbone for many security solutions in diverse domains such as cryptography, side channel leakage prevention, and moving target defense. However, generating true random numbers requires a physical source of entropy (e.g. hardware, quantum, environmental phenomenon) making it difficult to realize at a large scale and at a low cost. On the flip side, pseudorandom number generators (easy to implement) following a specific distribution (e.g. Gaussian) can be easily compromised given a sufficient amount of traces. In this work, we have developed a machine learning-guided generative approach that can be used to create portable, resource-efficient, and cost-effective random number generators with high throughput and true randomness characteristics. We implement the proposed approach as a highly parameterized framework and perform extensive evaluation for different settings. The framework was able to learn from true random sources such as irrational numbers and environmental audio noise and imitate those sources towards generating new good quality random numbers on demand. We have generated more than 1 billion bits and observed robust performance in terms of true randomness metrics obtained from NIST SP 800-22 and FIPS 140-1 randomness test suites achieving a throughput of up to 142.85 Mbps. Compared to the state-of-the-art (SOTA) technique, the iso-cost setup of our framework can achieve more than 500 Mbps in a distributed setting. We have evaluated the efficacy of running the true randomness imitation AI models on target edge devices such as Raspberry Pi 4 (Model B), Nvidia Jetson Nano, Nvidia Jetson Orin Nano and Nvidia Jetson Xavier. We have also looked at the security of the TRIM framework itself against different adversarial threat models.

Cybersecurity↗

Enhancing the Survivability of Power Systems With Grid-Edge DERs Against DoS Attacks

Power system survivability, defined as the ability of a system to maintain steady-state functionality under varying operational conditions, reflects its resilience against disturbances. While existing research primarily focuses on physical-layer disturbances, the increasing prevalence of grid-edge DERs, which are primarily used for integrating renewable energy, has significantly expanded the cyber attack surface. As a result, operational disruptions caused by cyber threats are posing significant challenges to system survivability and cannot be overlooked. To fill this gap, we redefine system survivability to incorporate the cyber layer’s status and propose a Distributionally Robust Optimization (DRO) approach to enhance power system survivability against potential cyber-physical threats. In this paper, we first analyze the operational guidelines of systems with a high penetration of DERs under various cyber network conditions and redefine survivability in this context. Next, we focus on the most common cyber threat, Denial-of-Service (DoS) attacks, and develop a corresponding attack model. This model allows for the creation of a kernel-based ambiguity set that captures attack uncertainties using historical data. Finally, we transform the proposed DRO model as a tractable optimization problem, with its solution providing an optimal cyber redundancy plan to enhance system survivability in DoS attack scenarios. Simulation results on the IEEE 13-node and 123-node test feeders demonstrate the effectiveness of our proposed model in improving system survivability. This model can also be expanded to include other types of common attacks and serve as a comprehensive planning tool to improve overall cyber physical survival of the system.

cybersecurity↗

Denial of Service Attack Detection via Differential Analysis of Generalized Entropy Progressions

Denial-of-Service (DoS) attacks are one the most common and consequential cyber attacks in computer networks. While existing research offers a plethora of detection methods, the issue of achieving scalability, a low false positive rate, and high detection accuracy remains open. In this work, we address this problem by developing a differential method based on generalized entropy progression. In this method, named as DoDGE, we continuously fit the line of best fit to the entropy progression of destination addresses and check if the derivative, that is, the slope of this line is less than the negative of the dynamically computed standard deviation of the derivatives. Furthermore, to distinguish from flash events, we leverage the symmetry that when a flash event occurs, the derivative of the entropy progression of source addresses is positive. With this design, we omit the usage of the thresholds and the results with five real-world network traffic datasets confirm that DoDGE outperforms threshold-based DoS attack detection by two orders of magnitude in terms of false positives on average. When compared to ten machine learning (ML) models, DoDGE achieves a balanced accuracy of 99%, while the average balanced accuracy for the ML models is 52%. Moreover, the results show that DoDGE successfully differentiates between a flash event and a DoS attack. Furthermore, since the main computation cost of DoDGE is the entropy computation, which is linear in the volume of the unit-time network flow, uses integer only operations, and works on a small fraction of the total flow, it is lightweight and scalable.

Cybersecurity, wireless communication↗

Digital Twin of an ANPC inverter with integrated Design-For-Trust

Reducing costs and increasing manufacturing output while creating reliable products are three essential components needed to keep a business competitive. In the past, having an asset that could address these three challenges at the same time would be challenging. However, recent advances in computer processing capabilities coupled with increases to network speeds allowed such a system to become possible; and this is known as a Digital Twin (DT), which represents a virtual copy of a production system or a product. Here, this work exhibits a DT application of an Active Neutral Point Clamped (ANPC) inverter using a controller. The controller emulates the ANPC responses of a new Digital Signal Processing (DSP) firmware and validates this new firmware by using Design-For-Trust (DFTr) characteristics. If the new firmware is malicious, then it should be rejected, thus adding preemptive protection measures for inverter based distributed energy resources.

cybersecurity↗

Device-Centric Firmware Malware Detection for Smart Inverters using Deep Transfer Learning

Since future power grids are inverter-dominant grids and inverters are getting smarter by incorporating remote access and seamless firmware update, it is anticipated that malware attackers will directly target smart inverters. However, malware threats targeting smart inverters have been less studied yet. This paper explores potential malware attacks targeting smart inverters and proposes a deep transfer-learning (DTL)-based malware detection framework for smart inverters. The proposed DTL method can significantly reduce development time and efforts for an artificial intelligence-based malware detection algorithm while improving detection accuracy. The experimental result shows that the proposed method achieves 98% of firmware malware detection accuracy. Furthermore, this approach will be transformative to other smart grid devices enabling seamless firmware update.

artificial intelligence↗

Ransomware Attack Modeling and Artificial Intelligence-Based Ransomware Detection for Digital Substations

Ransomware has become a serious threat to the current computing world, requiring immediate attention to prevent it. Ransomware attacks can also have disruptive impacts on operation of smart grids including digital substations. This paper provides a ransomware attack modeling method targeting disruptive operation of a digital substation and investigates an artificial intelligence (AI)-based ransomware detection approach. The proposed ransomware file detection model is designed by a convolutional neural network (CNN) using 2-D grayscale image files converted from binary files. Here, the experimental results show that the proposed method achieves 96.22% of ransomware detection accuracy.

artificial intelligence↗

Ransomware Security Threat Modeling for Photovoltaic Systems

Ransomware attacks are one of the most dangerous cyber-attacks which can disrupt the operation of photovoltaic (PV) systems and incur an enormous economic loss. This paper introduces a ransomware security threat modeling method that identifies potential vulnerabilities, threats, and impacts of ransomware attacks targeting a PV system. Here, the security threat modeling consists of three steps: 1) system identification, 2) threat modeling that finds existing vulnerabilities, 3) attack modeling that designs attack profiles to succeed ransomware attacks, and 4) penetration testing that performs authorized cyber-attacks and analyzes impacts of the ransomware attack profiles using a real-time hardware-in-the-loop (HIL) PV system security testbed.

attack modeling↗

Demystifying Cyberattacks: Potential for Securing Energy Systems With Explainable AI : Preprint

Modernization of energy systems has led to in- creased interactions among multiple critical infrastructures and diverse stakeholders making the challenge of operational decision making more complex and at times beyond cognitive capabilities of human operators. The state-of-the-art machine learning and deep learning approaches show promise of supporting users with complex decision-making challenges, such as those occurring in our rapidly transforming cyber-physical energy systems. However, successful adoption of data-driven decision support technology for critical infrastructure will be dependent on the ability of these technologies to be trustworthy and contextually interpretable. In this paper, we investigate the feasibility of implementing XAI for interpretable detection of cyberattacks in the energy system. Leveraging a proof-of-concept simulation use case of detection of a data falsification attack on a photovoltaic system using XGBoost algorithm, we demonstrate how Local Interpretable Model-Agnostic Explanations (LIME), a flavor XAI approach, can help provide contextual and actionable interpretation of cyberattack detection.

artificial intelligence↗

Disruption of Commercial Solar Inverter System by TLS Proxy Man-in-the-Middle Attack

Transport Layer Security (TLS) is a cryptographic protocol that encrypts communication data, providing end-to-end communication encryption and authentication. Currently, TLS is widely adopted for securing communication between servers and end devices, including solar inverter systems. Therefore, users/operators can securely access the solar inverters through a web user interface (WebUI) application programmable interface (API) on a PC or server over TLS-enabled Wi-Fi or Ethernet. However, the security of the TLS-based network becomes compromised if it is breached by a TLS proxy man-in-the-middle (MITM) exploit. This report explores potential vulnerabilities in a commercial solar inverter system that leverages a TLS proxy MITM and discusses the impacts through assume-breached penetration testing. Furthermore, the paper explores recommended mitigation methods against the TLS proxy MITM exploit in solar inverters.

97 MATHEMATICS AND COMPUTING↗

Real-Time Hardware-in-the-Loop Distributed Energy Resources System Testbed using IEEE 2030.5 Standard

IEEE 2030.5 standard is drawing special attention among communication protocols for smart inverters and distributed energy resources (DER). Moreover, California Rule 21 mandates new DER must be ready to communicate to a host utility using the IEEE 2030.5 standard. Therefore, development of an effective real-time simulation method for managing DER using IEEE 2030.5 network is crucial. This paper presents a real-time hardware-in-the-loop (HIL) DER system testbed using the IEEE 2030.5 standard. The proposed real-time co-simulation testbed consists of a DER physical system simulation using OP AL-RT real-time simulator and a cyber system simulation including DER gateways and a DER management system (DERMS) cloud server. Custom-built client and server programs are developed to meet the compliant with IEEE 2030.5-2018 standard and implemented in the DER gateways and a DERMS server, respectively. Furthermore, the feasibility of the proposed testbed for DER systems is validated by experiments.

42 ENGINEERING↗

On the Stability of Power Transmission Systems Under Persistent Inverter Attacks: A Bi-Linear Matrix Approach

We investigate the stability and robustness properties of a power transmission system under persistent deceiving attacks on inverter-interfaced energy resources. The attacks can corrupt the damping coefficients in the inverters' controllers and measurements of the frequency at the points of coupling. Leveraging tools from hybrid dynamical systems theory, we characterize a broad family of persistent (and not necessarily periodic) attacks acting on the inverters, under which the stability properties of the transmission system can be shown to not be compromised. To address potentially conservative conditions identified through conventional bounding techniques, sufficient conditions on the average activation time of the attacks are identified via Lyapunov theory, as well as the formulation and solution of a class of bilinear matrix inequalities (BMI). The results are obtained for constant and slowly time-varying loads via input-to-state stability (ISS) tools. Numerical simulations on the IEEE 39-bus test system are also presented.

24 POWER TRANSMISSION AND DISTRIBUTION↗

Agentic AI and the Cyber Arms Race

Here, in this article, we examine the implications for cyberwarfare and global politics as agentic artificial intelligence becomes more powerful and enables the broad proliferation of capabilities only available to the most well-resourced actors today.

Cybersecurity↗

Safeguarding the Grid: Diverse Resources for Resilience [In My View]

Reports on the vulnerability of the power grid. From wildfires, hurricanes, and floods to cyberattacks, the grid is vulnerable to natural and human-made disasters, which can cause widespread outages that last from hours to months and leave lasting economic impacts. Imagine a coastal region in the United States that has just been hit by a hurricane and lost all power. Besides the electricity infrastructure going out, communications networks, rail transportation, and gasoline pumps may also stop working after the emergency event, which often delays repair efforts to the grid. Unresponsive communications make it difficult to dispatch workers to repair the grid, and missing transportation links delay shipments of replacement equipment for the grid’s restoration.

cybersecurity↗

PURE Biomanufacturing: Secure, Pandemic-Adaptive Biomanufacturing

Biopharmaceutical production systems and processes are vulnerable to cyberattacks from sophisticated adversaries. Consequently, it is imperative to start building biopharmaceutical manufacturing systems that offer verifiable formalism and transform the current state of security across all production stages.

99 GENERAL AND MISCELLANEOUS↗

On the Limits of EM Based Detection of Control Logic Injection Attacks In Noisy Environments

The difficulty in applying traditional security mechanisms in Industrial Control System (ICS) environments makes a large portion of these mission-critical assets vulnerable to cyber attacks. Therefore, there is a dire need for the development of novel security mechanisms specifically designed to protect such critical systems. Recently a lot of attention has been given to mechanisms that exploit the EM emanations of devices for defense purposes. Such practices may lead to the development of robust external and non-intrusive anomaly detection systems. Nevertheless, the majority of current work in the area neglects to consider the implications of real-life environments, particularly environmental noise. In this work, we explore the limits of EM-based anomaly detection towards identifying injection attacks in control logic software in noisy environments. Our study conducted upon both synthetically generated and real signals identified that indeed environmental noise might significantly degrade the accuracy of the anomaly detection process. Experiments done upon synthetic data indicated that assuming that signals are captured with high sampling rates, even minor code injections can be detected with above-90% accuracy in noisy environments where SNR is up to -2dB. This is true even if naive detection methods are considered. Moreover, experiments done using a real-life testbed attest that even single-instruction injections can be detected with near-perfect accuracy in relatively clean environments. Finally, noise-elimination techniques can drastically improve the reliability of the detection mechanism even in noisy environments.

97 MATHEMATICS AND COMPUTING↗

Forced Power Systems Oscillations Due to Cyberattacks: Threats, Detection and Partial Mitigation

Forced oscillations in power systems can be caused by misconfigured controllers at generator stations. They can also be caused by cyberattacks against the exciters or governors. This paper explores the effects of forced oscillations from cyberattacks on generator excitation and governor systems and the effectiveness of a novel control system for a static var compensator in mitigating those oscillations to enhance transmission system resilience. A brief overview of oscillations, especially forced oscillations, within power systems is presented, along with an overview of cyberattacks on power systems. This paper also examines and implements FACTS devices to partially mitigate the forced oscillations created by cyberattacks by reducing the magnitude of the oscillations caused by the attack. The proposed approach is more effective against attacks targeting exciters.

24 POWER TRANSMISSION AND DISTRIBUTION↗

What Role Do Aggregators Play in Power System Security and Resilience?

Barriers to the participation of distributed energy resources (DERs) in wholesale electricity markets have limited the use of DERs for power system security and resilience. In September 2020, the Federal Energy Regulatory Commission (FERC) approved an order to reduce these barriers. FERC Order No. 2222 enables the participation of DER aggregators in wholesale electricity markets. DERs include renewable generation and technologies that support the integration of renewable generation by increasing grid flexibility and resilience. Requiring wholesale energy markets to allow DER aggregator participation provides a path for DERs to become competitive in these markets. As the contribution from aggregated DERs continues to increase, the aggregator's role in supporting grid security and resilience will become more critical. This paper reviews work that demonstrates how DER aggregators can provide resilience support through technical capabilities, operational strategies, and secure communication architectures. Socioeconomic influences and impacts of aggregators, including implications for social resilience, are presented. In surveying the current state-of-the-art across different but interconnected topics, we illustrate how aggregators can be power system participants that enhance grid security. There is no one-size-fits-all approach to enhancing resilience in a power grid that includes a growing cohort of DER aggregators, but there are many options for aggregators to contribute to a more resilient and secure power grid.

aggregator↗

A Randomization-Based, Zero-Trust Cyberattack Detection Method for Hierarchical Systems

This paper demonstrates a novel randomization-based approach for verifying power system control signals with application to detecting cyberattacks. We consider fully connected hierarchical systems containing multiple local agents and a global "trust" agent. The global agent uses a time-varying randomized assignment scheme to identify corrupt network links based on principles of zero trust and majority rule. To evaluate the performance of this detection approach, we implement our algorithm in MATLAB and run it against nearly 43 million unique attack scenarios spanning a range of system sizes. For each scenario, the algorithm determines whether the identified corruptions satisfy a set of validity constraints reflecting network topology and uses that result to say whether the recovered state value for one or more local agents is malicious. We compare the algorithm's determination to the true state of the system to assess performance and find that classification accuracy converges to 100% as system size increases, suggesting that the validity constraints become more difficult to satisfy for larger systems. We further explore the scenarios that evade detection to understand practical implications for employing this detection approach.

cybersecurity↗