Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “distributed machine learning”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 1,063 records · Page 59

Interpreting machine learning prediction of fire emissions and comparison with FireMIP process-based models

Annual burned areas in the United States have increased 2-fold during the past decades. With more large fires resulting in more emissions of fine particulate matter, an accurate prediction of fire emissions is critical for quantifying the impacts of fires on air quality, human health, and climate. This study aims to construct a machine learning (ML) model with game-theory interpretation to predict monthly fire emissions over the contiguous US (CONUS) and to understand the controlling factors of fire emissions. The optimized ML model is used to diagnose the process-based models in the Fire Modeling Intercomparison Project (FireMIP) to inform future development. Results show promising performance for the ML model, Community Land Model (CLM), and Joint UK Land Environment Simulator-Interactive Fire And Emission Algorithm For Natural Environments (JULES-INFERNO) in reproducing the spatial distributions, seasonality, and interannual variability of fire emissions over the CONUS. Regional analysis shows that only the ML model and CLM simulate the realistic interannual variability of fire emissions for most of the subregions (r >0.95 for ML and r =0.14~0.70 for CLM), except for Mediterranean California, where all the models perform poorly (r =0.74 for ML and r <0.30 for the FireMIP models). Regarding seasonality, most models capture the peak emission in July over the western US. However, all models except for the ML model fail to reproduce the bimodal peaks in July and October over Mediterranean California, which may be explained by the smaller wind speeds of the atmospheric forcing data during Santa Ana wind events and limitations in model parameterizations for capturing the effects of Santa Ana winds on fire activity. Furthermore, most models struggle to capture the spring peak in emissions in the southeastern US, probably due to underrepresentation of human effects and the influences of winter dryness on fires in the models. As for extreme events, both the ML model and CLM successfully reproduce the frequency map of extreme emission occurrence but overestimate the number of months with extremely large fire emissions. Comparing the fire PM 2.5 emissions from the ML model with process-based fire models highlights their strengths and uncertainties for regional analysis and prediction and provides useful insights into future directions for model improvements.

54 ENVIRONMENTAL SCIENCES↗

LTAU-FF: Loss Trajectory Analysis for Uncertainty in atomistic Force Fields

Model ensembles are effective tools for estimating prediction uncertainty in deep learning atomistic force fields. However, their widespread adoption is hindered by high computational costs and overconfident error estimates. In this work, we address these challenges by leveraging distributions of per-sample errors obtained during training and employing a distance-based similarity search in the model latent space. Our method, which we call LTAU (Loss Trajectory Analysis for Uncertainty), efficiently estimates the full probability distribution function of errors for any test point using the logged training errors, achieving speeds that are 2–3 orders of magnitudes faster than typical ensemble methods and allowing it to be used for tasks where training or evaluating multiple models would be infeasible. We apply LTAU towards estimating parametric uncertainty in atomistic force fields (LTAU-FF), demonstrating that it produces well-calibrated confidence intervals and predicts errors that correlate strongly with the true errors for data near the training domain. Furthermore, we show that the errors predicted by LTAU-FF can be used in practical applications for detecting out-of-domain data, tuning model performance, and predicting failure during simulations. We believe that LTAU will be a valuable tool for uncertainty quantification in atomistic force fields and is a promising method that should be further explored in other domains of machine learning.

97 MATHEMATICS AND COMPUTING↗

Automated Integration of Continental-Scale Observations in Near-Real Time for Simulation and Analysis of Biosphere–Atmosphere Interactions

The National Ecological Observatory Network (NEON) is a continental-scale observatory with sites across the US collecting standardized ecological observations that will operate for multiple decades. To maximize the utility of NEON data, we envision edge computing systems that gather, calibrate, aggregate, and ingest measurements in an integrated fashion. Edge systems will employ machine learning methods to cross-calibrate, gap-fill and provision data in near-real time to the NEON Data Portal and to High Performance Computing (HPC) systems, running ensembles of Earth system models (ESMs) that assimilate the data. For the first time gridded EC data products and response functions promise to offset pervasive observational biases through evaluating, benchmarking, optimizing parameters, and training new machine learning parameterizations within ESMs all at the same model-grid scale. Leveraging open-source software for EC data analysis, we are already building software infrastructure for integration of near-real time data streams into the International Land Model Benchmarking (ILAMB) package for use by the wider research community. We will present a perspective on the design and integration of end-to-end infrastructure for data acquisition, edge computing, HPC simulation, analysis, and validation, where Artificial Intelligence (AI) approaches are used throughout the distributed workflow to improve accuracy and computational performance.

Durden, David J.↗

Investigation of 3D printed lightweight hybrid composites via theoretical modeling and machine learning

Hybrid composites combine two or more different fillers to achieve multifunctional or advanced material properties, such as lightweight and enhanced mechanical properties. The properties of the composites significantly depend on their microstructures, which can be tailored via advanced 3D printing processes. Understanding the process-structure-property relationships is critical to enable the design and engineering of novel hybrid composites for applications in aerospace, automotive, and protective coatings. Here, for this work, we develop 3D printable and lightweight hybrid composites and leverage the conventional design of experiments, a theoretical hybrid model, and an image-driven machine learning (ML) method to investigate their mechanical behaviors. The hybrid composites are formulated with elastomer matrix, microfillers, and thin-shell particles, enabling a significant degree of design freedom of microstructures with densities and mechanical properties varying up to 70% and 91%, respectively. Our statistical analysis indicates that the 3D printing path direction and the microfibers fraction are dominating process parameters with contribution percentages of 45.3% and 57.7% on the specific stiffness and strength, respectively. A hybrid mechanics model is developed based on a simple Weibull distribution function and classical single-filler models to effectively capture the variations in mechanical properties, however, it overestimates the values due to its statistical constraints and idealization of experimental uncertainty. The image-driven ML model leverages the microscale images directly without losing the structural details, shows more accurate predictions with experimental data, and has 48.6% lower root mean square error than the theoretical model.

3D printing↗

A baseline for ensemble-based, time-resolved inflow reconstruction for a single turbine using large-eddy simulations and latent diffusion models

We are interested in reconstructing winds flowing through a turbine on a second-by-second basis over a 10 min window. Previously, we developed a machine learning algorithm that takes in a snapshot of wind speed measurements and generates ensembles of three-dimensional wind field estimates. Here, we use these estimates as initial conditions in large-eddy simulations and reconstruct atmospheric and turbine response dynamic quantities in a synthetic field campaign. In doing so, we establish a baseline for model validation that future time-aware data assimilation techniques will be compared to. In turbine-free case studies, ground truth wind speeds consistently fall within our estimated wind speed distribution for the first 100 s after the simulation start. In simulations with turbines, the wind estimates show a small bias of 0.10 m s 1 and good correlation of 0.80 during the first 100 s. During this window, our estimates of the Blade 1 bending moment and generator power typically span the ground truth, with the estimate of the former performing better overall. In summary, this approach shows promise as a stand-alone technique for reconstructing real-world inflow and turbine dynamics in 1-2 min windows and as a foundation for future time-aware data assimilation techniques.

71 CLASSICAL AND QUANTUM MECHANICS, GENERAL PHYSIC↗

Uncertainty Quantified Machine Learning for Street Level Flooding Predictions in Norfolk, Virginia

Everyday citizens, emergency responders, and critical infrastructure can be dramatically affected by street flooding caused by the increasing tidal levels and major storm events magnified by climate change. Low-level flooding, such as nuisance flooding, continues to increase in frequency, especially in cities like Norfolk, Virginia, which can expect nearly 200 flooding events by 2050 [1]. Recently, machine learning (ML) models have been leveraged to produce real-time predictions based on local weather and geographic conditions. However, ML models are known to produce unusual results when presented with data that varies from their training set. For decision-makers to determine the trustworthiness of the model's predictions, ML models need to quantify their prediction uncertainty. This study applies Deep Quantile Regression (DQR) to a previously published, LSTM-based model for hourly water depth predictions [2], and analyzes its out-of-distribution (OOD) performance.

Goldenberg, Steven↗

Infrared spectroscopy data- and physics-driven machine learning for characterizing surface microstructure of complex materials

There is a need to characterize complex materials and their dynamics under reaction conditions to accelerate materials design. Adsorbate vibrational excitations are selective to adsorbate/surface interactions and infrared (IR) spectra associated with activating adsorbate vibrational modes are accurate, capture details of most modes, and can be obtained operando. Current interpretation depends on heuristic peak assignments for simple spectra, precluding the possibility of obtaining detailed structural information. Here, we combine data-based approaches with chemistry-dependent problem formulation to develop physics-driven surrogate models that generate synthetic IR spectra from first-principles calculations. Using synthetic IR spectra of carbon monoxide on platinum, we implement multinomial regression via neural network ensembles to learn probability distributions functions (pdfs) that describe adsorption sites and quantify uncertainty. We use these pdfs to infer detailed surface microstructure from experimental spectra and extend this methodology to other systems as a first step towards characterizing complex interfaces and closing the materials gap.

Science & Technology - Other Topics↗

Short-term electricity load forecasting: Application-driven evaluation of machine learning models across spatial and temporal scales

As we transition towards a decarbonized economy, the integration of variable renewable energy resources and new demands (e.g., electric vehicles, heat pumps) into the electricity grid places unprecedented pressure on grid operators to effectively anticipate and manage peak load. In this context, machine learning algorithms are proving to be indispensable for accurate short-term load forecasting, a crucial task to address these challenges. This study benchmarks 6 machine learning algorithms, including three neural networks and three tree-based algorithms, across various levels of spatial aggregation and time horizons (1, 4, 8, 24, and 48 h). The central contribution of this work is the comparison and analysis of load forecasting models not only based on statistical metrics, but also based on a novel error metric, which evaluates the cost implications of forecast errors for power system stakeholders. Results show that tree-based models outperform neural networks, based on statistical metrics, and yield less skewed error distributions for most spatial scales. However, through the lens of the novel error metric, neural networks are the more competitive choice, especially for forecast horizons that exceed 8 h. The study concludes with actionable recommendations to grid operators and highlights the need for the development of error metrics that link forecasting accuracy to operational costs. To promote transparency and open science, the datasets and Python code are open-sourced via a supplementary repository.

Houben, Nikolaus↗

Generative machine learning for detector response modeling with a conditional normalizing flow

In this paper, we explore the potential of generative machine learning models as an alternative to the computationally expensive Monte Carlo (MC) simulations commonly used by the Large Hadron Collider (LHC) experiments. Our objective is to develop a generative model capable of efficiently simulating detector responses for specific particle observables, focusing on the correlations between detector responses of different particles in the same event and accommodating asymmetric detector responses. Here, we present a conditional normalizing flow model ($\mathcal{CNF}$) based on a chain of Masked Autoregressive Flows, which effectively incorporates conditional variables and models high-dimensional density distributions. We assess the performance of the $\mathcal{CNF}$ model using a simulated sample of Higgs boson decaying to diphoton events at the LHC. We create reconstruction-level observables using a smearing technique. We show that conditional normalizing flows can accurately model complex detector responses and their correlation. This method can potentially reduce the computational burden associated with generating large numbers of simulated events while ensuring that the generated events meet the requirements for data analyses. We make our code available at https://github.com/allixu/normalizing_flow_for_detector_response

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗

Exploring the physics of cesium lead halide perovskite quantum dots via Bayesian inference of the photoluminescence spectra in automated experiment

The unique optoelectronic properties of metal halide perovskite quantum dots (QDs) make them promising candidates for applications in light-emitting diodes (LEDs), scintillators, and other photonic devices. The automated micropipetting synthesis platform equipped with an optical reader enables the opportunity for high throughput synthesis and photoluminescent (PL) characterization of metal halide perovskite QDs for the first time. Here, we explore the compositional dependence of the PL behavior and stability of the combinatorial library of cesium lead halide (CsPbX 3 ) perovskites QDs via the automated platform. To study the stability of synthesized QDs in the binary and ternary configurations, we study the time-dependent PL properties using previously developed machine learning analysis. Additionally, to systematically explore the PL behavior in the ternary CsPbX 3 QDs system, we introduce the Bayesian inference framework that allows the probabilistic fit of multiple models to the PL data and establishes both optimal model and model parameter robustly. Furthermore, these behaviors can be used as a control parameter for the navigation of the multidimensional compositional spaces in automated synthesis. Furthermore, this analysis shows the nonuniformity of the PL peak behavior in the ternary CsPbX 3 QDs system. Further, the analysis confirms narrow size distribution and good quality of CsPbBr 3 QDs alloyed with low concentrations of iodide and chloride. We note that Bayesian Inference fit parameters can be further used as a control signal for navigation of the chemical spaces in automated synthesis.

36 MATERIALS SCIENCE↗

Quantification of the Crack Evolution Process by Extracting Relevant Signal Components from Wave Propagation and Diffusive Transport Front Measurements

Wave propagation and diffusive transport phenomena in a geological rock sample undergoing crack evolution process are expected to interact with the mechanical discontinuities in the medium. The measurements of the signals associated with these phenomena can be used to assess and monitor the crack-driven micromechanical alterations in the rock. Different wave/diffusion phenomena, such as sonic propagation, pressure diffusion, and acoustic emission (AE), are sensitive to different elements of the mechanical discontinuities generated during the evolution of the crack clusters from initiation to coalescence. Sonic propagation, AE, and pressure diffusion monitoring have the potential to map the crack evolution because the transmitter-receiver arrays can be designed, arranged and tuned to (1) achieve maximum recovery of the scattered waveforms and travel times, (2) capture the later arrivals and multiple reflections, and (3) illuminate large rock volume. However, the structural/topological complexities of the mechanical discontinuities, complex distribution of the stress fields, complex mechanical alterations in media, and fluid redistribution in the crack system pose serious challenges for the detection and modeling of the crack evolution process (from here on, we will use the term ‘crack evolution process’ to mean that the crack evolution occurred under shallow crustal conditions). For purposes of accurately accounting such complexities and heterogeneities in the absence of reliable physical laws, simulation methods, and signal processing techniques, my early-career research proposal will develop and apply novel data-driven machine learning methods to: (1) extract signal components relevant to the various phases of crack evolution and (2) generate a 2D visual map of the crack evolution process.

58 GEOSCIENCES↗

A Data-Agnostic, Continuous Machine Learning Framework for Application in High Energy Physics and Beyond: Phase 1 Final Scientific/Technical Report

This Phase 1 effort has focused on the development of continual learning frameworks for use in machine learning, specifically in the applied context of High Energy Physics (HEP). Machine learning (ML) is a transformative technology by which computers, typically through the use of neural networks, are able to perform tasks with proficiency that rivals or surpasses that of human users. Model Degradation & Catastrophic Forgetting are two undesired phenomena which can occur in ML where the performance of a model degrades when either deployed on novel data streams, or trained on novel data which are sufficiently different than the data the models were initially trained on. A natural example where these sorts of effects can be observed is in the performance of detectors in harsh environments, where the detector signature may change over the lifetime of the detector as it ages and deteriorates — precisely what occurs in the experiments conducted in HEP. Real world HEP data is therefore an excellent test-ground and use-case for Continual Learning paradigms, which are techniques used in ML to counteract these problems. Ensemble learning is one such technique, where multiple smaller models are trained on subsets of the overall data and are ensembled together during inference. The intuition behind this technique is that, although there are shifts in the distributions which govern the incoming data streams, these shifts are not expected to be homogeneous or global. If a sufficient diversity in solutions within the various sub-models has been achieved, then at least one sub-model is expected to retain its performance within the overall ensemble. One further strength of this approach is that the architectures of the various models do not need to be identical, and in fact even different modalities of data can naturally be combined in this way. This work focused on applying ensemble learning techniques to derive results using two main datasets, anomaly detection in HEP data & time-series forecasting in semiconductor manufacturing data. Semiconductor manufacturing involves data with surprising similarity to that of HEP (e.g. wafer maps look very similar to digi-occupancy maps) and Cerium Lab’s prominence within the semiconductor industry makes semiconductor manufacturing a natural opportunity for commercialization of this work. Our efforts have led to two strong results. The first is that we evaluated the proposed ensembling techniques using previously proposed machine learning architectures for use in anomaly detection, namely AutoEncoder based models and their derivatives. We also developed new architectures which have not been evaluated in this context before. In fact, this work marks the first use of Vision Transformers for anomaly detection in HEP. Second, we demonstrated that ensemble learning significantly improves model performance in scenarios prone to degradation, validating its effectiveness across both HEP and semiconductor datasets. These results further support ensemble learning as a powerful strategy for mitigating catastrophic forgetting and maintaining robust performance in evolving data environments.

72 PHYSICS OF ELEMENTARY PARTICLES AND FIELDS↗

Detecting Unclassified Electromagnetic Signals for Secure Wireless Communication Using Open Set Recognition

We developed multiple machine learning methods for the detection and classification of new wireless communication waveforms, which is critical for targeted attacks in wireless networks and electronic warfare. Our machine learning models are capable of dynamically detecting security threats in near real time through our advanced open set recognition (OSR) approach. This model has demonstrated significant improvements in the detection of unknown waveforms, thereby enhancing the security and reliability of mission critical communications. Our approach to detecting uncertain security threats is novel; we advanced OSR techniques by incorporating domain knowledge of wireless signals. Specifically, we combined time and frequency domain model features to enhance the model’s performance. Utilizing an OSR approach eliminates the need for training data to be distributed similarly to the deployment environment and removes the requirement for the training set to contains all possible threat classes. This is crucial because it is often infeasible to determine and characterize all potential security threats in advance. Our model were trained on simulated data, generated in partnership with the University at Albany, State of New York. The data set contained a diverse array of wireless signals, including those with additive white Gaussian noise and multipath signals, with and without line of sight. This comprehensive training set allowed us to optimize our models to detect unknown waveforms under various challenging scenarios, such as low signal-to-noise ratios. By training on various waveforms, varying signal-to-noise ratio, and different sample sizes under normal conditions, our models were fine tuned to perform effectively in challenging environments.

99 - GENERAL AND MISCELLANEOUS↗

Forecasting Megaelectron-Volt Electrons Inside Earth's Outer Radiation Belt: PreMevE 2.0 Based on Supervised Machine Learning Algorithms

We present the recent progress in upgrading a predictive model for megaelectron-volt (MeV) electrons inside the Earth's outer Van Allen belt. This updated model, called PreMevE 2.0, provides improved forecasts, particularly at outer L-shells, by adding upstream solar wind speeds to the model's input parameter list that originally includes precipitating electrons observed at low Earth orbits and MeV electron fluxes in situ measured by a geosynchronous satellite. Furthermore, based on several kinds of linear and artificial neural networks algorithms, a list of models was constructed, trained, validated, and tested with 42-month MeV electron observations from Van Allen Probes. Out-of-sample test results from these models show that, with optimized model hyperparameters and input parameter combinations, the top performer from each category of models has the similar capability of making reliable 1-day (2-day) forecasts of 1-MeV electron flux distributions with performance efficiency values ~0.87 (~0.82) averaged over the L-shell range of 2.8–6.6, significantly outperforming the previous version of PreMevE particularly at L-shells > ~4.5. Interestingly, the linear regression model is often the most successful when compared to other models, which suggests the relationship between dynamics of trapped 1-MeV electrons and precipitating electrons is dominated by linear components. Results also show that PreMevE 2.0 can reasonably well predict the onsets of MeV electron events in 2-day forecasts. PreMevE 2.0 is designed to be driven by observations from longstanding space infrastructure to make high-fidelity forecasts for MeV electrons, thus can be an invaluable space weather forecasting tool for the future.

79 ASTRONOMY AND ASTROPHYSICS↗

Multiscale modeling of packed-bed microwave reactors and estimation of intrinsic materials' permittivity

Modeling of packed-bed microwave reactors relies on an accurate representation of particle size, shape, and distribution within the bed, as well as the particles' dielectric properties. The measured permittivity of microwave susceptors (powders or structured materials) depends on the geometric features of the particles and the porosity of the bed, as well as the specific form factor of a structured material. These are effective properties and cannot be used to analyze other reactor configurations unless the geometric effects are removed. Therefore, we introduce a methodology for extracting the intrinsic particle permittivity from experimentally measured effective permittivity by combining cavity-based measurements with multiscale simulations and machine learning. Further, we develop the first multiscale model of packed-bed microwave reactors that incorporate particle effects (geometric features, random packing, and particle contact). This approach bridges macroscopic observables with mesoscopic physics, enabling analysis of local hotspots, arcing, and contact effects that control reactor performance. Using polymer-based spherical activated carbon (PBSAC) and silicon carbide (SiC) as examples, we demonstrate that the inferred particle permittivity is consistent with independent experimental heating profiles we collect from microwave reactors without adjustable parameters. Finally, this methodology establishes a foundation for predictive, multiscale design of microwave packed-bed reactors that explicitly accounts for particle-scale effects, enabling the estimation of intrinsic permittivity for the first time.

97 MATHEMATICS AND COMPUTING↗

The Role of Internal Variability in Springtime Arctic Amplification from 1980 to 2022

Arctic amplification (AA) refers to the enhanced warming of the Arctic relative to the global average due to rising greenhouse gases, measured as the ratio of Arctic-mean to global-mean surface air temperature (SAT) trends. From 1980 to 2022, annual-mean AA reached 4.2 (Arctic defined as north of 70°N). Climate models simulate AA but fail to reproduce its magnitude. Sweeney et al. attributed much of this model–observation discrepancy to internal variability. AA shows seasonality and so does the discrepancy. Spring (March–May) shows the largest gap: Observed AA is 4.2, while the multimodel mean is 2.7. This raises several questions: 1) What role does internal variability play in observed spring AA? 2) How does simulated spring AA compare to observations when internal variability is removed? 3) If internal variability is significant, what mechanisms drive it? To address these, we adapted the machine learning algorithm from Sweeney et al., training on simulated multidecadal spring SAT and sea level pressure (SLP) trend maps. Our results show that internal variability enhanced spring Arctic warming by 37% and reduced global warming by 10%. Removing internal variability reconciles the spring AA discrepancy. The estimated internal contribution to Arctic spring warming is supported by an independent dynamical adjustment approach. We identify an atmospheric circulation pattern in observations associated with this internal warming. Observed internal Siberian SAT and SLP trends follow the simulated SAT–SLP relationship but lie at the distribution’s extreme, suggesting models generally underestimate internal variability unless the observed configuration reflects a rare real-world realization.

Arctic↗

Spatiotemporal Downscaling Model for Solar Irradiance Forecast Using Nearest-Neighbor Random Forest and Gaussian Process

Accurate solar photovoltaic (PV) capacity estimation requires high-resolution, site-specific solar irradiance data to account for localized variability. However, global datasets, such as the National Solar Radiation Database (NSRDB), provide regional averages that fail to capture the fine-scale fluctuations critical for large-scale grid integration. This limitation is particularly relevant in the context of increasing distributed energy resources (DERs) penetration, such as rooftop PV. Additionally, it is critical to the implementation of the U.S. Federal Energy Regulatory Commission (FERC) Order 2222, which facilitates DER participation in U.S. bulk power markets. To address this challenge, this study evaluates Nearest-Neighbor Random Forest (NNRF) and Nearest-Neighbor Gaussian Process (NNGP) models for spatiotemporal downscaling of global solar irradiance data. By leveraging historical irradiance and meteorological data, these models incorporate spatial, temporal, and feature-based correlations to enhance local irradiance predictions. The NNRF model, a machine-learning approach, prioritizes computational efficiency and predictive accuracy, while the NNGP model offers a level of interpretability and prediction uncertainty by numerically quantifying correlations and dependencies in the data. Model validation was conducted using day-ahead predictions. The results showed that the average Goodness of Fit (GoF) of the NNRF model of 90.61% across all eight sites outperformed the GoF of the NNGP of 85.88%. Additionally, the computational speed of NNRF was 2.5 times faster than the NNGP. Finally, the NNGP displayed polynomial scaling while the NNRF scaled linearly with increasing number of nearest neighbors. Additional validation of the model on five sites in Puerto Rico further confirmed the superiority of the NNRF model over the NNGP model. These findings highlight the robustness and computational efficiency of NNRF for large-scale solar irradiance downscaling, making it a strong candidate for improving PV capacity estimation and real-time electricity market integration for DERs.

Asiedu, Shadrack (ORCID:0009000646004826)↗

Improving Cyber Situational Understanding

Effective cybersecurity operations require the ability to analyze large amounts of information to assess security risks and formulate defensive strategies against adversaries. This has become more complex in recent years as the sprawl and interconnectivity of devices grows through implementation of virtualization, cloud computing, and Internet of Things (IoT). The amount of data and analysis required for effective cybersecurity command and control decisions far exceeds humans’ capacity to perform manually. We characterize the analysis problem as cyber situational understanding. The research presented to improve cyber situational understanding focuses on vulnerability analysis and threat intelligence. Regarding vulnerabilities, entities must analyze and plan work for between thousands and tens of thousands of software vulnerabilities annually. Entities heavily use network firewalls to limit vulnerability exposure. As a result, some of these vulnerabilities permit exposure to adversarial exploitation, whereas others are inaccessible and therefore present negligible risk of exploitation. Distinguishing between high and low risk software vulnerabilities requires a deep understanding of the vulnerability, network firewall protection, and characteristics of the targeted device. This problem is solved by extracting network service features from vulnerability data features using both machine-learning and natural language processing. Then, the network firewall topology is parsed to determine which vulnerabilities are reachable by adversaries. Ultimately, a state-based safety analysis ascertains which vulnerabilities are unsafe. A related vulnerability analysis problem occurs in cybersecurity operations when associating an entity’s hardware and software assets to public vulnerability databases. Assets often reveal hardware and software through installation artifacts and network service identification, and entities store these artifacts in inventory databases. However, software and hardware vendors apply a standard Common Platform Enumeration (CPE) naming convention when publicly reporting vulnerabilities. Associating these two datasets often requires many hours to days of manual inspection. The proposed solution automates the mapping approach of human analysts using fuzzy matching techniques, natural language processing, and, ultimately, machine learning to present a small set of recommendations for mapping the two datasets. The result significantly reduces human analysis time and reduces the occurrence of false positives in vulnerability notifications. Finally, cyber threat intelligence (CTI) requires associating cyber observable artifacts, such as IP addresses, URIs, and file hashes, with cyber threat tactics, techniques, and procedures. Unfortunately, most CTI data is compartmentalized across multiple organizations and cannot be shared due to the legal and reputational risk with cyber threat being associated with the entity. The approach to solving this problem inovlves using a distributed ledger with anonymous token spending and authentication. This allows a consortium of semi-trusted entities to share the workload of curating CTI for a threat sharing community’s cooperative benefit.

Huff, Philip↗