Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Defense programs”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 1,063 records · Page 59

Sandia Academic Alliance Program Collaboration Report: 2020-2021 Accomplishments

University partnerships play an essential role in sustaining Sandia’s vitality as a national laboratory. The SAA is an element of Sandia’s broader University Partnerships program, which facilitates recruiting and research collaborations with dozens of universities annually. The SAA program has two three-year goals. SAA aims to realize a step increase in hiring results, by growing the total annual inexperienced hires from each out-of-state SAA university. SAA also strives to establish and sustain strategic research partnerships by establishing several federally sponsored collaborations and multi-institutional consortiums in science & technology (S&T) priorities such as autonomy, advanced computing, hypersonics, quantum information science, and data science. The SAA program facilitates access to talent, ideas, and Research & Development facilities through strong university partnerships. Earlier this year, the SAA program and campus executives hosted John Myers, Sandia’s former Senior Director of Human Resources (HR) and Communications, and senior-level staff at Georgia Tech, U of Illinois, Purdue, UNM, and UT Austin. These campus visits provided an opportunity to share the history of the partnerships from the university leadership, tours of research facilities, and discussions of ongoing technical work and potential recruiting opportunities. These visits also provided valuable feedback to HR management that will help Sandia realize a step increase in hiring from SAA schools. The 2020-2021 Collaboration Report is a compilation of accomplishments in 2020 and 2021 from SAA and Sandia’s valued SAA university partners.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗

The dynamic nature of risk in DOE facilities in the surveillance and maintenance program–with observations for risk communications

Here, we explore three case studies of facilities at two US Department of Energy (DOE) former nuclear weapons research and production sites—the Oak Ridge National Laboratory and the Hanford site—whose risk profiles have changed during their long-term management under the DOE's surveillance and maintenance (S&M) program. These case studies provide examples of the challenges faced in communicating to external stakeholders, such as federal and state regulators, local communities surrounding the site, as well as the general public, the circumstances surrounding unexpected events or the emergence/discovery of new risk-important information at historically high-risk sites. We identify common topics of importance from these case studies and suggest a taxonomy for risk communicators to use in informing the dialogues with individuals and organizations that may not be technically oriented or fully informed on the subject matter. The taxonomy is based on technical insights from the quintessential definition of risk known as the Kaplan–Garrick “risk triplet” as well as insights from regulatory guidance documents on risk communication with external stakeholders originally developed for the commercial nuclear power industry.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

Physical Sciences Vistas (Issue 3 2020)

In this issue, highlights of our outstanding R&D supporting the Laboratory’s nuclear security mission include the following. 1. The essential nuclear materials science contributions of MST’s Materials Properties Team to a range of Lab missions, operations, and initiatives. 2. Work in the Sigma Complex supporting NNSA’s Advanced Manufacturing Development milestones by members of Sigma Division and colleagues across the Laboratory and other NNSA sites. 3. Greg Dale’s role in the Lab’s molybdenum program and today as a technical lead on the Scorpius project. 4. Measurements that reveal the role thermal interfaces play in dynamic compression experiments. 5. The first-ever synthesis of an actinide framework, which offers opportunities for understanding these structures as potential radioactive waste forms and provides new models of actinide species transport in the environment. This issue also showcases, as part of our commitment to simultaneous excellence in mission operations and community relations, the successful high-hazard repair of the LANSCE accelerator, which resulted in a large team Laboratory Distinguished Performance Award, and a virtual Summer Physics Camp for Young Women that brought together participants from around the world, even as COVID kept them socially distant in their homes.

36 MATERIALS SCIENCE↗

Deep Mapping of Small Solar System Bodies with Galactic Cosmic Ray Secondary Particle Showers

We will investigate the use of galactic cosmic ray (GCR) secondary particles to probe the deep interiors of small solar system bodies (SSBs), including comets, asteroids, and geologic structures on the surfaces of airless bodies. Applications include solar system science, planetary defense, and resource utilization. Our Phase I study demonstrated that muons, the long-range charged component of GCR showers, can penetrate SSBs up to a km in diameter, providing information on their interior structure. Muons produced in Earth’s atmosphere have been applied to image the interior of large objects for science and engineering. In Phase I, we found that the production of muons in the solid surfaces of airless bodies is much smaller than in Earth’s atmosphere. Nevertheless, the flux of transmitted muons is sufficient to detect inclusions within an asteroid or comet in a reasonable amount of time, ranging from hours to weeks, depending on the size of the SSB and the density contrast, position and size of the inclusion. For asteroids and comets, large density variations (e.g., porous soil or ice versus solid rock) are relatively easy to detect. The intrinsic spatial resolution of muon radiography (“muography”) is on the scale of a few meters. The spatial resolution that can be achieved in practice depends on signal intensity and integration time (counting statistics), the angular resolution of the muon tracker (hodoscope) and details of data reduction and analysis methodology. Our Phase II project will assess remaining unknowns for the application of muography to determining the interior structure of SSBs, assess risks for implementation, and provide a roadmap for development of SSB muography beyond the NIAC program. To achieve our objectives, we will focus on four interrelated tasks: Task1) Signal and background characterization: Characterize the production and transmission of muons and secondary particle backgrounds made by cosmic ray showers in SSBs; and near-surface features from radiographic and tomographic data; Task2) Imaging studies: Develop methods to determine the density structure of SSB interiors and near-surface features from radiographic and tomographic data; Task3) Instrument design: Using simulations and bench-top laboratory experiments, investigate specific concepts for the design of compact hodoscopes and components; Task4) Synthesis: Combine the results of the first three tasks to determine the range of applicability of the method, identify the steps needed for maturation of the concept, and explore concepts for a pilot muography mission.

Prettyman, Thomas H.↗

History of the Chemical Stockpile Emergency Preparedness Program – Volume 1: Program Summary (Final Report 2026)

The History Project of the Chemical Stockpile Emergency Preparedness Program (CSEPP or the CSEP Program) was initiated in 2010 to document CSEPP’s extraordinary efforts and achievements. CSEPP was implemented to enhance emergency preparedness at U.S. Army installations and their surrounding communities as the Army’s stockpile of chemical weapons was being destroyed.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

A Rapid Survey of the Compatibility of Selected Seal Materials with Conventional and Semi-Synthetic JP-8

Since the synthesis of a liquid hydrocarbon fuel from coal by Franz Fischer and Hans Tropsch in 1923, there has been cyclic interest in developing this fuel for military and commercial applications. In recent years the U.S. Department of Defense has taken interest in producing a unified battlespace fuel using the Fischer Tropsch (FT) process for a variety of reasons including cost, quality, and logistics. In the past year there has been a particular emphasis on moving quickly to demonstrate that an FT fuel can be used in the form of a blend with conventional petroleum-derived jet fuel. The initial objective is to employ this semi-synthetic fuel with blend ratios as high as 50 percent FT with longer range goals to use even high blend ratios and ultimately a fully synthetic jet fuel. A significant concern associated with the use of a semi-synthetic jet fuel with high FT blend ratios is the effect these low aromatic fuels will have on fuel-wetted polymeric materials, most notably seals and sealants. These materials typically swell and soften to some degree when exposed to jet fuel and the aromatic content of these fuels contribute to this effect. Semi-synthetic jet fuels with very low aromatic contents may cause seals and sealants to shrink and harden leading to acute or chronic failure. Unfortunately, most of the material qualification tests are more concerned with excessive swelling than shrinkage and there is little guidance offered as to an acceptable level of shrinkage or other changes in physical properties related to low aromatic content. Given the pressing need for guidance data, a program was developed to rapidly survey the volume swell of selected fuel-wetted materials in a range of conventional and semi-synthetic jet fuels and through a statistical analysis to make a determination as to whether there was a basis to be concerned about using fuels with FT blend ratios as high as 50 percent. Concurrent with this analysis data was obtained as to the composition of the fuel absorbed in fuel-wetted materials through the use of GC-MS analysis of swollen samples as well as other supporting data. In this presentation the authors will present a summary of the results of the volume swell and fuel absorbed by selected O-rings and sealants as well as a description of the measurement protocols developed for this program.

Graham, John L.↗

Standardization and Recommendations for EVSE Cybersecurity Standards

Currently, there is an absence of cybersecurity certification programs specifically for EVSE. Many existing standards focus primarily on safety, such as battery safety, while others provide cybersecu rity guidelines for different types of equipment, which could be adapted for EVSE. Among these, ISA/IEC 62443 has been identified as highly aligned with EVSE security needs. This report is a follow on to the previous research published (“Assessment and Coordination of EVSE Cybersecurity Standards,”). This report aims to find appropriate strategies for closing the gaps found in the aforementioned report and continue to work towards a comprehensive cybersecurity certification program for EVSE. Future testing will leverage this standard to assess EVSE security gaps and strengths, providing valuable insights to support certification development and harmonization of cybersecurity standards.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

Technology and Tool Development to Support Safety and Mission Assurance

The Assurance Case approach is being adopted in a number of safety-mission-critical application domains in the U.S., e.g., medical devices, defense aviation, automotive systems, and, lately, civil aviation. This paradigm refocuses traditional, process-based approaches to assurance on demonstrating explicitly stated assurance goals, emphasizing the use of structured rationale, and concrete product-based evidence as the means for providing justified confidence that systems and software are fit for purpose in safely achieving mission objectives. NASA has also been embracing assurance cases through the concepts of Risk Informed Safety Cases (RISCs), as documented in the NASA System Safety Handbook, and Objective Hierarchies (OHs) as put forth by the Agency's Office of Safety and Mission Assurance (OSMA). This talk will give an overview of the work being performed by the SGT team located at NASA Ames Research Center, in developing technologies and tools to engineer and apply assurance cases in customer projects pertaining to aviation safety. We elaborate how our Assurance Case Automation Toolset (AdvoCATE) has not only extended the state-of-the-art in assurance case research, but also demonstrated its practical utility. We have successfully developed safety assurance cases for a number of Unmanned Aircraft Systems (UAS) operations, which underwent, and passed, scrutiny both by the aviation regulator, i.e., the FAA, as well as the applicable NASA boards for airworthiness and flight safety, flight readiness, and mission readiness. We discuss our efforts in expanding AdvoCATE capabilities to support RISCs and OHs under a project recently funded by OSMA under its Software Assurance Research Program. Finally, we speculate on the applicability of our innovations beyond aviation safety to such endeavors as robotic, and human spaceflight.

Mission Assuranc↗

Verification and Validation of High Explosive Reactive Burn Models Implemented in LANL's EAP and LAP Code Base (FY2020 L2 Milestone MRT 7129) [Slides]

Advanced reactive burn models enable phenomena to be modeled that aren’t possible with programmed burn. Programmed burn propagates a burn front at a prescribed speed from a prescribed initiation point. Reactive burn uses the hydro variables (pressure, temperature, etc.) to determine when, how rapidly, and to what extent a zone detonates. This enables a completely new set of problems to be simulated. Our goal in this milestone has been to improve the usability of reactive burn modes. Thus, the closure criteria are: 1. Perform code and solution verification of the reactive burn models using appropriate solutions and simplified HE setups. 2. Perform validation assessments using small-scale experiments. 3. Evaluate sensitivities and quantify uncertainties due to model form variations and mesh dependencies.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

Adaptive Cyber-Physical Resilience for Building Control Systems

The main goal of the project is to develop an AI-based process layer cybersecurity suite for detection, isolation and mitigation of cyber-attack effects on operation of building energy management systems (BEMS). The following constituent key technologies were developed under the program towards fulfilling the program objectives: (1) developed a high fidelity BEMS testbed for generation of training data and validation of developed technologies; (2) developed a physics informed ML based attack detection and localization module (ADL) capable of detecting high impact stealthy attacks (HISA - attacks causing 30% energy utilization but no immediate visible impact otherwise) with 98% accuracy; (3) developed a methodology to determine ’representative days’ to limit the data required for training; (4) developed a virtual sensing system that can reconstruct affected sensors with 10% error for the same HISA set; (5) developed a resilient model predictive control system that can continue operation of the BEMS without jeopardizing stability for the HISA set; and (6) integrated and deployed all the constituent modules and demonstrated the efficacy of the technology in real-time in a hardware in loop simulation.

42 ENGINEERING↗

Thermal, RGB, and Multispectral Unexploded Ordnance Data Collection

As of May 1, 2026 Landmine contamination affects 58 countries and many hundreds of thousands of km² of land. For example, the National Mine Action Program Demining Ukraine reporting that up to 144,000 km² of territory are potentially contaminated and require survey and clearance (National Mine Action Program “Demining Ukraine,” n.d.) alone. This contamination includes mines and other explosive remnants of war and continues to constrain civilian access, agricultural use, infrastructure recovery, and broader socioeconomic activity (International Campaign to Ban Landmines–Cluster Munition Coalition [ICBL-CMC], 2024; Mine Action Review, 2024). Current response activities rely on established mine-action approaches including non-technical survey, technical survey, clearance, and explosive ordnance disposal, consistent with international mine-action terminology and operational practice (United Nations Mine Action Service [UNMAS], 2024; Geneva International Centre for Humanitarian Demining [GICHD], 2023). In this context, UAV-based sensing, including UAV-mounted thermal imaging, may provide a useful supplementary capability by supporting faster, safer detection and mapping of suspect hazards prior to ground intervention (Smiljanic, 2022).

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

Micro Electric Propulsion Feasibility

Miniature, 50 kg class, strategic satellites intended for extended deployment in space require an on-board propulsion capability to perform needed attitude control adjustments and drag compensation maneuvers. Even on such very small spacecraft, these orbit maintenance functions can be significant and result in a substantial propellant mass requirement. Development of advanced propulsion technology could reduce this propellant mass significantly, and thereby maximize the payload capability of these spacecraft. In addition, spacecraft maneuverability could be enhanced and/or multi-year mission lifetimes realized. These benefits cut spacecraft replacement costs, and reduce services needed to maintain the launch vehicles. For SDIO brilliant pebble spacecraft, a miniaturized hydrazine propulsion system provides both boost and divert thrust control. This type of propulsion system is highly integrated and is capable of delivering large thrust levels for short time periods. However, orbit maintenance functions such as drag make-up require only very small velocity corrections. Using the boost and/or divert thrusters for these small corrections exposes this highly integrated propulsion system to continuous on/off cycling and thereby increases the risk of system failure. Furthermore, since drag compensation velocity corrections would be orders of magnitude less than these thrusters were designed to deliver, their effective specific impulse would be expected to be lower when operated at very short pulse lengths. The net result of these effects would be a significant depletion of the on-board hydrazine propellant supply throughout the mission, and a reduced propulsion system reliability, both of which would degrade the interceptors usefulness. In addition to SDIO brilliant pebble spacecraft, comparably small spacecraft can be anticipated for other future strategic defense applications such as surveillance and communication. For such spacecraft, high capability and reliability, minimal detectability and low cost are requirements. All these miniature spacecraft share a common characteristic: because of their on-board electronic equipment they have, by design, solar order 50-100 W. In a relative sense, such spacecraft are power rich when compared to other larger spacecraft. This power rich situation is offset by very tight mass budgets, which make reductions in propellant mass requirements a key issue in meeting overall spacecraft minimum mass goals. In principle, power rich and propellant poor brilliant pebbles class spacecraft can benefit from using high specific impulse electric propulsion to reduce chemical propellant mass requirements. However, at power levels of order 50 W, arcjets cannot be made to function, ion thrusters are too complex and heavy and resistojets have too low a specific impulse. Recognizing these capability limitations in existing electric propulsion technology, the SDIO/IST sponsored the Phase I SBIR Micro Electric Propulsion (MEP) thruster study described in this report. The objective of this study was to examine the feasibility of developing a very simple, low mass and small volume, electric thruster for operation on hydrazine at less than 100 W of input power. The feasibility of developing such a MEP thruster was successfully demonstrated by EPL by the discovery of a novel plasma acceleration process. The sections in this report summarize the approach, test results and major accomplishments of this proof-of-concept program.

Aston, Graeme↗

Data-driven cyber attack detection and mitigation for decentralized wide-area protection and control in smart grids

Modern power systems have already evolved into complicated cyber physical systems (CPS), often referred to as smart grids, due to the continuous expansion of the electrical infrastructure, the augmentation of the number of heterogeneous system components and players, and the consequential application of a diversity of information and telecommunication technologies to facilitate the Wide Area Monitoring, Protection and Control (WAMPAC) of the day-to-day power system operation. Because of the reliance on cyber technologies, WAMPAC, among other critical functions, is prone to various malicious cyber attacks. Successful cyber attacks, especially those sabotage the operation of Bulk Electric System (BES), can cause great financial losses and social panics. Application of conventional IT security solutions is indispensable, but it often turns out to be insufficient to mitigate sophisticated attacks that deploy zero-day vulnerabilities or social engineering tactics. To further improve the resilience of the operation of smart grids when facing cyber attacks, it is desirable to make the WAMPAC functions per se capable of detecting various anomalies automatically, carrying out adaptive activity adjustments in time and thus staying unimpaired even under attack. Most of the existing research efforts attempt to achieve this by adding novel functional modules, such as model-based anomaly detectors, to the legacy centralized WAMPAC functions. In contrast, this dissertation investigates the application of data-driven algorithms in cyber attack detection and mitigation within a decentralized architecture aiming at improving the situational awareness and self-adaptiveness of WAMPAC. First part of the research focuses on the decentralization of System Integrity Protection Scheme (SIPS) with Multi-Agent System (MAS), within which the data-driven anomaly detection and optimal adaptive load shedding are further explored. An algorithm named as Support Vector Machine embedded Layered Decision Tree (SVMLDT) is proposed for the anomaly detection, which provides satisfactory detection accuracy as well as decision-making interpretability. The adaptive load shedding is carried out by every agent individually with dynamic programming. The load shedding relies on the load profile propagation among peer agents and the attack adaptiveness is accomplished by maintaining the historical mean of load shedding proportion. Load shedding only takes place after the consensus pertaining to the anomaly detection is achieved among all interconnected agents and it serves the purpose of mitigating certain cyber attacks. The attack resilience of the decentralized SIPS is evaluated using IEEE 39 bus model. It is shown that, unlike the traditional centralized SIPS, the proposed solution is able to carry out the remedial actions under most Denial of Service (DoS) attacks. The second part investigates the clustering based anomalous behavior detection and peer-assisted mitigation for power system generation control. To reduce the dimensionality of the data, three metrics are designed to interpret the behavior conformity of generator within the same balancing area. Semi-supervised K-means clustering and a density sensitive clustering algorithm based on Hierarchical DBSCAN (HDBSCAN) are both applied in clustering in the 3D feature space. Aiming to mitigate the cyber attacks targeting the generation control commands, a peer-assisted strategy is proposed. When the control commands from control center is detected as anomalous, i.e. either missing or the payload of which have been manipulated, the generating unit utilizes the peer data to infer and estimate a new generation adjustment value as replacement. Linear regression is utilized to obtain the relation of control values received by different generating units, Moving Target Defense (MTD) is adopted during the peer selection and 1-dimensional clustering is performed with the inferred control values, which are followed by the final control value estimation. The mitigation strategy proposed requires that generating units can communicate with each other in a peer-to-peer manner. Evaluation results suggest the efficacy of the proposed solution in counteracting data availability and data integrity attacks targeting the generation controls. However, the strategy stays effective only if less than half of the generating units are compromised and it is not able to mitigate cyber attacks targeting the measurements involved in the generation control.

24 POWER TRANSMISSION AND DISTRIBUTION↗

The Scaling and Units of the Elastic Response Term for Rayleigh Waves that is Output by Computer Programs in Seismology (CPS)

We report on the scaling and units of the Rayleigh wave elastic response function A R (ω) that is output from the widely used Computer Programs in Seismology (CPS) to aid in the modeling of ground motion sourced by atmospheric explosions. The program uses mixed units (km, second, km/s, gm/cc) to keep A R (ω) near 10 0 and prevent any numerical underflow or overflow. We compare two models for the response of an elastic half space to the output from CPS. Our application inputs the recommended, mixed unit geological models to determine how researchers must scale this output to obtain physical units for A R (ω) that represents the amplitude scaling for the minimum group velocity (Airy phase) contribution to Rayleigh waves. We determine that a CPS user must scale the output for A R (ω) by 10 -12 (m/km) 2 (g/cc/m 3 /kg) to obtain MKS (meter, kg, second) units and then must multiply this result by the vertical component eigenfunction squared, that is evaluated at the free surface.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

Assessment of Physical Security Modeling and Simulation in the Vulnerability Assessment Process

This report provides a comprehensive assessment of physical security modeling and simulation tools available for use in the vulnerability assessment (VA) process for nuclear facilities. It outlines the historical evolution of VA methodologies, emphasizing the transition from traditional layer-based approaches to a more holistic framework that integrates detection probabilities directly into combat simulations. The document details the critical components of the VA process, including the characterization of targets, threats, and protective measures, as well as the development of adversary scenarios that reflect both insider and outsider threats. It highlights the importance of performance assurance programs, emphasizing the need for continuous evaluation and testing of security systems to ensure their effectiveness against evolving threats. Additionally, the report discusses the significance of utilizing accredited modeling and simulation tools in accredited areas to accurately represent adversary actions and the corresponding responses of protective forces. By establishing a systematic approach to VA, this document aims to enhance the overall security posture of nuclear facilities, ensuring compliance with regulatory standards while effectively mitigating risks associated with potential adversarial actions.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

Precursor Analysis Report: JBS Foods Ransomware Attack 2021

The JBS Foods 2021 Ransomware Attack Precursor Analysis Report leverages publicly available information about the JBS ransomware cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. In late May 2021, one of the world’s largest meat producers, JBS Foods, announced they had fallen victim to a worldwide ransomware attack, later found to be REvil ransomware. In the United States alone, JBS Foods accounts for nearly 25% of beef and roughly 20% of pork production. Adversaries initially launched a Distributed Denial of Service (DDoS) attack on the company’s Information Technology (IT) networks in Australia, but the attack impacted operations in Brazil, Canada, and the United States, as well. The attack caused plant operations in all four countries to shut down for at least one day. All nine of the U.S. meatpacking plants temporarily shut down because of the attack. The adversaries initially demanded a $\$$22 million ransom for the company’s data, but later negotiated the ransom down to $\$$11 million even after JBS Foods restored most of their systems. JBS Foods eventually paid the $\$$11 Million for reassurance from the adversaries that none of their customers’ data would be compromised in the future. Despite its short duration, the attack still caused large stocks of meat to spoil. The incident also underscored how adversaries can simultaneously compromise and move laterally through global subsidiaries of an organization. Researchers and analysts identified 22 unique techniques (in a sequence of 21 steps) utilized during the attack with a total of 361 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Sixteen of the identified techniques used during the JBS Foods cyber attack were precursors to the triggering event. Analysis identified 308 observables associated with these precursor techniques, 163 of which were assessed to have an increased likelihood of being perceived in the 75 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

Precursor Analysis Report: SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003

The SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003 Precursor Analysis Report leverages publicly available information about Davis-Besse’s 2003 cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. On 25 January 2003, the SQL Slammer worm infected more than 90% of vulnerable hosts and crashed the internet in 10 to 15 minutes, making it one of the fastest spreading worms in history. SQL Slammer is a fileless, memory-resident worm that remotely exploits a stack-based buffer overflow vulnerability on local hosts to intensively scan and rapidly self-propagate across the internet. The worm infected approximately 300,000 unpatched hosts running Microsoft Structured Query Language (SQL) Server 2000 or Microsoft Desktop Engine (MSDE) 2000 with SQL Server Resolution Service. The SQL Slammer worm indirectly infected FirstEnergy’s Davis-Besse nuclear power plant by first infecting a consultant’s company network server and then propagating through an external misconfigured connection into Davis-Besse’s site network. The infection caused major network congestion, slow performance, data overloads, and the inability of local hosts to communicate with each other, which eventually caused a loss of availability and a loss of view when the Safety Parameter Display System (SPDS) and Plant Process Computer (PPC) crashed. At the time of the infection, the plant was already offline, the digital monitoring systems had redundant analog backups, and the plant control and safety functions were not affected, so there were no concerns of a safety breach. However, this incident resulted in many lessons learned and spawned important discussions about cybersecurity’s role in nuclear safety and electric power reliability regulation, policy, and guidance. Researchers and analysts identified 10 unique techniques utilized during the attack with a total of 640 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Eight of the identified techniques used during Davis-Besse cyber attack were precursors to the triggering event. Analysis identified 596 observables associated with these precursor techniques, 428 of which were assessed to have an increased likelihood of being perceived in the 331 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

Precursor Analysis Report: Industroyer2 and Wiper Malware Targeting Ukrainian Energy Provider 2022

The Industroyer2 and Wiper Malware Targeting Ukrainian Energy Provider 2022 Precursor Analysis Report leverages publicly available information about the Industroyer2 cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. An adversary attempted to cause a blackout in Ukraine in April 2022 by using the Industroyer2 malware against a regional Ukrainian energy provider. The adversary targeted eight high-voltage electrical substations and utilized the malware in tandem with disk wipers for Windows, Linux, and Solaris operating systems in an attempt to make response and recovery efforts more difficult. The adversary reused a piece of the original Industroyer malware designed to open circuit breakers and de-energize target substations. The adversary gained initial access to the victim’s enterprise network through unknown means in February 2022 and was able to perform reconnaissance, pivot to the operations network, and reside in the system for at least 51 days. This gave the adversary a detailed understanding of the environment and allowed them to customize the Industroyer2 malware to the victim’s operations network. However, defenders detected and stopped the attack before the adversary could achieve their intended impact. Had the Industroyer2 attack been successful, it could have caused a blackout for more than two million people during the early stages of Russia’s invasion of Ukraine. Researchers and analysts identified 22 unique techniques (used in a sequence of 31 steps) utilized during the attack with a total of 297 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Twenty-three of the identified techniques used during the Industroyer2 cyber attack were precursors to the triggering event. Analysis identified 224 observables associated with these precursor techniques, 122 of which were assessed to have an increased likelihood of being perceived in the 51 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗