Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Cyber”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 109 records · Page 6
All sourcesNASA NTRSDOE OSTI
DOE OSTI2024

Large-Scale Hydrogen Storage Cyber Risk Assessment

Hydrogen storage systems may become more widely deployed throughout the country, and so it is possible that individual and interconnected systems will be exposed to cyber-attacks. These events can cause physical and financial harm to employees, people in the vicinity of the facility, and the company that owns the facility. The two main ways bad actors may access information or control from a hydrogen storage facility are through information technology and operations technology devices, the former of which refers to data and information from networked devices and the latter of which refers to onsite controls for the physical system. Both types of entryways into the system should be considered when companies conduct cyber risk assessments and when regulators develop or revise relevant codes and standards. This report analyzes cybersecurity risks associated with a generic hydrogen storage system by outlining the system's purpose and the importance of its cybersecurity. The hydrogen storage system architecture and communication protocols are provided to understand potential cyber vulnerabilities. Later, an event tree analysis is performed on hydrogen operation to identify system weaknesses by outlining potential attack scenarios. This report also identifies critical cyber assets related to different hydrogen operations followed by an examination of potential threats, and the impact of cyber assets on those operational assets.

08 HYDROGEN↗
DOE OSTI2024

Large-Scale Hydrogen Storage Cyber Risk Assessment

Hydrogen storage systems are becoming more widely deployed throughout the country, and as their presence continues to grow, it is possible that individual and interconnected systems will be exposed to cyber-attacks. These events can cause physical and financial harm to employees, people in the vicinity, and to the company that owns the facility. The two main mechanisms malicious actors may access information or control from a hydrogen storage facility are through information technology and operations technology devices, the former of which refers to data and information from networked devices and the latter of which refers to onsite controls for the physical system. Both types of entryways into the system should be considered when facility managers conduct cyber risk assessments and when regulators develop or revise relevant codes and standards. This report analyzes cybersecurity risks applicable to a wide variety of hydrogen storage systems by outlining the system's purpose and the importance of its cybersecurity. The hydrogen storage system architecture and communication protocols are provided to understand potential cyber vulnerabilities. Later, an event tree analysis is performed on hydrogen operation to identify system weaknesses by outlining potential attack scenarios. This report also identifies critical cyber assets related to different hydrogen operations followed by an examination of potential threats, and the impact of cyber assets on those operational assets.

08 HYDROGEN↗
DOE OSTI2025

InterGraph-CPS: A Graph-Theoretic Approach to Characterize Cross-Domain Cyber-Physical Interdependencies and Uncertainties in Electric Grid Systems for Improved Decision-Making in Operation and Response

Critical infrastructure systems such as the electric grid are increasingly cyber-physical; yet, despite the cyber-physical characteristics of critical infrastructure systems, the physical process system and communication/control network system are traditionally analyzed in siloes. As these systems become more cyber-physical, it is crucial that models and methods are available to assess the cyber physical system (CPS) interdependencies, characteristics, and event propagation for improved planning, operation, and response. Thus, we proposed an integrated structural and temporal CPS interdependency analysis framework, InterGraph-CPS, that provides insight into the CPS function during normal operation as well as disturbances. This integrated structural and temporal interdependency framework is uniquely designed for assessing CPSs by account for the challenges of analyzing cyber and physical data streams together due to data availability, data type, and time scale differences. By leveraging both structural (e.g., graph analysis) and temporal (e.g., data analytics) techniques, different CPS behaviors and configurations can be accounted for.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2024

Sovereign Credit Rating Processes Adapted to Critical Infrastructure Cyber Risk Assessment

United States critical infrastructure entities are increasingly targeted by motivated and capable threat actors and must be prepared to assess and treat a diverse range of cyber risks. Consequently, this necessitates some form of analytical process to evaluate risks and inform cyber security investment decisions. A potential solution for structuring cyber risk evaluation exists within the field of sovereign credit ratings – where agencies employ mature approaches that integrate quantitative and qualitative data to produce a singular value of assessment. Adapting such approaches, we present a novel criterion and methodology for measuring and communicating the likelihood element of cyber risk. The methodology is composed of three sequential phases: a quantitative baseline organized by distinct capability frames, a bounded qualitative adjustment per frame, and a greater-bounded qualitative adjustment spanning the entire process. The process culminates in publication of a cyber capability rating that communicates a critical infrastructure entity’s ability and willingness to mitigate discontinuous function due to cyberattack.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2024

Anomaly detection for cyber-physical systems

An anomaly detector is configured to construct cyber and/or physical features comprising information configured to characterize the cyber and/or physical state of a cyber-physical system. The physical features may be based on physical and/or physics-based relationships between a plurality of physical state attributes. A health of the cyber-physical system may be based on an error between estimates of one or more of the physical state attributes and measurements of the one or more physical state attributes. The relationships may be incorporated into machine learning membership functions used to classify cyber and/or physical behavior of the system.

Rieger, Craig G.↗
DOE OSTI2021

A Cyber-Resilience Risk Management Architecture for Distributed Wind

Distributed wind is an electric energy resource segment with strong potential to be deployed in many applications, but special consideration of resilience and cybersecurity is needed to address the unique conditions associated with distributed wind. Distributed wind is a strong candidate to help meet renewable energy and carbon-free energy goals. However, care must be taken as more systems are installed to ensure that the systems are reliable, resilient, and secure. The physical and communications requirements for distributed wind mean that there are unique cybersecurity considerations, but there is little to no existing guidance on best practices for cybersecurity risk management for distributed wind systems specifically. This research develops an architecture for the consideration of cyber risks associated with distributed wind systems. The architecture takes into account the configurations, challenges, and standards for distributed wind to create a risk-focused perspective that considers of threats, vulnerabilities, and consequences, with special emphasis on what sets distributed wind systems apart from other distributed energy resources (DER). We discuss common distributed wind architectures and how they are interconnected to larger power systems. Because cybersecurity cannot exist independently, the cyber-resilience architecture must consider the system holistically. Finally, we discuss the implementation of a risk assessment process that uses the cyber-resilience framework to address challenges specific to distributed wind.

17 WIND ENERGY↗
DOE OSTI2025

A distributed voltage inference framework for cyber-physical attacks detection and localization in active distribution grids

The transition to active distribution grids with real-time monitoring and control depends on the proliferation of advanced communication networks and devices. This paradigm shift towards a cyber-physical architecture also introduces new vulnerabilities for adversaries to exploit and launch sophisticated cyber-physical attacks targeting grid observability. Current research highlights the challenges in distinguishing attacks on voltage phasor or nodal injection measurements and isolating multi-source attack locations in a multiphase distribution grid. The attack detection and localization methods in literature face accuracy issues, applications across diverse attack scenarios, or scalability limits. Here, to bridge these gaps, this paper proposes a distributed Voltage Inference framework for real-time detection and localization of cyber-physical attacks, addressing scalability, adaptability, and accuracy challenges in state-of-the-art methods. The proposed methodology leverages the distributed nature of the Voltage Inference framework through a two-step process of prediction and correction, together with a tractable graph partitioning approach, providing a reliable solution to identify compromised measurement sources and facilitate isolation. Extensive testing on IEEE 13 and 123-node distribution feeders underscores the algorithm’s efficacy, enhancing the security and resilience of active distribution grids against evolving cyber threats. Additionally, Hardware-in-the-Loop (HIL) implementation validates the proposed strategy’s practical applicability in real-world scenarios.

active distribution grids↗
DOE OSTI2026

Cyber Labeling for Energy Industrial IoT

The U.S. Department of Energy’s (DOE) Office of Cybersecurity, Energy Security and Emergency Response (CESER), at the request of the Deputy National Security Advisor for Cyber and Emerging Technologies, Anne Neuberger, initiated research in 2023 to develop a cybersecurity labeling proof-of-concept for energy products to expand on the Federal Communications Commission’s (FCC) proposed U.S. Cyber Trust Mark program. DOE mobilized researchers from six National Laboratories to develop and gather feedback on a proof-of concept label for solar inverters and smart meters, which serve as representative products for market-facing energy sector Industrial Internet of Things (IIoT). This report details the research team’s process across two phases and the resulting findings, which include challenges facing cyber labeling programs and recommendations to implement an expanded IIoT cyber labeling program in the U.S.

32 - ENERGY CONSERVATION, CONSUMPTION, AND UTILIZA↗
DOE OSTI2022

Cyber-Resilient Distributed Autonomous Energy Grid

The aim of Cyber-Resilient Distributed Autonomous Grid research initiative is to advance fundamental science and engineering approaches for cyber-resilient design, control, and operation of a distributed, highly interconnected, and autonomous energy grid of the future. From increasing penetration of DERs, smart homes and building with highly controllable loads at the distribution layer, to the interconnection of bulk renewables at the transmission layer the fundamental nature of the energy grid is changing, and these changes are enabled by rapid increase in dependence on the communication infrastructure and independent third parties for control and operation of the grid. NREL's Integrated Energy Pathways critical objective correctly identifies that there are fundamental cyber-resilience challenges inherent in the grid's evolution, and this effort is establishing strong and novel integrated cyber-resilience framework and approaches to address these new and fundamental challenges.

controls↗
DOE OSTI2022

Cyber–physical vulnerability and resiliency analysis for DER integration: A review, challenges and research needs

High penetration of renewable and sustainable Distributed Energy Resources (DER) into the traditional distribution system requires a well-coordinated control strategy for the improvement of system-wide reliability and resiliency. Implementation of such a holistic control architecture requires a flexible, near real-time, and bi-directional communication framework for facilitating the participation of various agents in a multi-vendor heterogeneous smart grid. While the sustainability of energy generation is ensured, this exposes the smart grid to extrinsic cyber threats, and appropriate defense mechanism(s) must be deployed to guarantee continued reliability and resiliency of the power grid. Further, the comprehensive literature review presented in this paper discusses the latest trends in the DER control schemes with fast communication requirements and their accompanying cyber–physical vulnerabilities. These control schemes are compared and contrasted for various traits. A three-level DER system architecture has been depicted, facilitating the deployment of these control schemes. The current developments of standard communication protocols, key security mechanisms, and best practices along major standards and guidelines are explored. The impacts of different attack types with miscellaneous DER functions based on various control schemes and associated mitigation solutions are also provided. Finally, challenges and future research directions for limiting cyber-power susceptibility to enhance resiliency are summarized. The work presented here will help us enabling a cyber-resilient and sustainable smart electric grid.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2021

Model-based Cyber-attack Detection for Voltage Source Converters in Island Microgrids

With the upgrading of communication and control in microgrids, cyber threats on the power converters are increasing. Here, in this paper, a novel model-based cyber-attack detection methodology is proposed for each voltage source converter in microgrids. The Harmonics State Space Matrix (H-Matrix) is used to build the closed-loop transfer function, providing model-based estimation with the grid voltage and control reference. Then, the space phase model (SPM) is used to calculate residual to detect cyber-attacks in voltage source converter (VSC). As controller and converter parameters are included in the H-matrix, the proposed method also could detect cyber-attacks when voltage fluctuation occurs in the grid. To verify the feasibility of the proposed method, several attacks targeting VSC in an islanded microgrid are simulated in MATLAB. Simulation and detection results are introduced to demonstrate the resilience and feasibility of the proposed method.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2023

Cyber-Physical Reconfiguration for Disaster Resilience of Power Distribution Systems

Cyber-physical distribution systems (CPDS) have emerged from the integration of information technology into distribution systems. While offering substantial benefits, this integration also introduces vulnerabilities. The interaction between cyber networks and distribution systems renders CPDS susceptible to disasters. To ensure critical load supply and system resilience, rapid post-disaster load restoration is required. The paper proposes a critical load restoration (CLR) framework in CPDS using a network reconfiguration approach that exploits the existing post-disaster resources to restore critical loads within the shortest possible time. Using graph theory, the cyber network and distribution system are integrated into a single digraph, minimizing the CLR complexity in CPDS. A cost metric is also defined to satisfy network-specific objectives and constraints. A heuristic is proposed to guide the load restoration process using the cost metric within the integrated digraph. Simulation results confirm the framework's superiority over existing literature, which either overlooks cyber components or prolongs restoration with additional resource deployment.

cyber-physical system↗
DOE OSTI2024

Rapid Monitoring and Defense Approach for Resilience Improvement of Grid Cyber Security

Cyber-physical systems and electric utilities significantly depend on the reliability and efficiency of information and operational technology. However, false data injection attacks based on synchrophasor measurement data pose a serious threat to the safe and reliable operation of modern power systems. Here, to mitigate this problem, a rapid monitoring and defense approach is proposed to defend against cyber attacks. Initially, the Time and Frequency based Convolutional neural Network (TFCN) is proposed to detect different types of attacks. Within the TFCN, the advances are that both time and frequency domain information can be fused without extra spectrum analysis methods, and can save detection time to speed the calculation efficiency using the developed time-frequency block. Next, a comprehensive defense strategy is developed for multiple cyber attacks to ensure the stability and resilience of the power system according to the feedback detection results. The advances of this strategy are that different control strategies can be automatically selected to recover the stability to the greatest extent according to the detected attacks. To verify the effectiveness of the proposed approach, the high-speed frequency measurements collected from the wide-area monitoring system are used. The results demonstrate that the cyber attack detection performance can reach 95.57% accuracy, outperforming both traditional and some advanced neural networks. Importantly, the defense strategy is conducted and verified in a modified IEEE 39 bus system as well, which illustrates profound performance in faster stability restoration.

Comprehensive defense strategy↗
DOE OSTI2022

WAMS-Based HVDC Damping Control for Cyber Attack Defense

Owing to the fast and large power regulating the capacity of the HVDC system, the wide-area measurement system (WAMS) based high voltage direct current (HVDC) system has been regarded as a prospective solution to deal with the low-frequency oscillation issue. However, due to the vulnerability of the WAMS communication, WAMS based HVDC system control can be a prime target of malicious penetrations that could lead to disastrous events. To remediate this adverse effect, an improved WAMS based HVDC damping control framework is proposed in this paper. First, a lightweight network named Attack Shuffle convolutional neural Networks (ASNet) is proposed to learn the characteristics of cyber attacks. Then, a model-free-based cyber attack defense framework is introduced to quickly identify the attack types based on the continuous wavelet transform and ASNet. Additionally, an improved control framework of the WAMS and HVDC-based wide-area power oscillation damping control (WH-PODC) is developed to provide different response control for mitigation of the impact of cyber attacks. Finally, the performance of the proposed WH-PODC control framework is evaluated with real PMU data in multiple scenarios in RTDS, where the results indicate that the response intensity can be kept under multiple types of cyber attacks while providing similar effectiveness in oscillation suppression to conventional controls.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2021

Data-Driven Cyber-Attack Detection for PV Farms via Time-Frequency Domain Features

The internetworking of grid-connected power electronics converters (PECs) in photovoltaic (PV) farms has inevitably expanded the cyber-attack surfaces. Here this paper presents a comprehensive study on cyber-attack detection and diagnosis for PEC-enabled PV farms via single waveform sensor to distinguish between normal conditions, open-circuit faults, short-circuit faults, and cyber-attacks. To our knowledge, this has not been attempted before. Firstly, we propose frequency-domain magnitude-based residuals to identify short-circuit faults and a time-domain mean current vector-based feature to distinguish open-circuit faults from other threats. These features can fully reflect the specific physical characteristics of PV farms during threat duration. Secondly, unlike micro phasor measurement units (µPMU) and raw electric waveform-based methods, the proposed innovative features can address novel cyber-attacks that are excluded from the training process. Thirdly, an online hardware-in-the-loop (HIL) testbed using the OPAL-RT real-time digital simulator has verified the effectiveness. The monitoring system runs in real-time while using HIL as an operational solar farm and a National Instruments (NI) data acquisition card as the electric waveform sensor at the point of coupling.

42 ENGINEERING↗
DOE OSTI2022

Prioritizing ICS Beachhead Systems for Cyber Vulnerability Testing

Cyber Testing for Resilient Industrial Control Systems™ (CyTRICS™) is the Department of Energy’s (DOE’s) program for cybersecurity vulnerability testing, digital subcomponent enumeration, and forensic assessment. CyTRICS leverages best-in-class test facilities and analytic capabilities at six DOE National Laboratories and strategic partnerships with key stakeholders including technology developers, manufacturers, asset owners and operators, and interagency partners. During the program’s development, CyTRICS established a unique methodology for prioritizing digital components within operational technology (OT) and industrial control systems (ICS) in the Energy Sector Industrial Base (ESIB) for cyber vulnerability testing. The CyTRICS Prioritization Process leverages multiple characteristics of systems, components, and their contextual deployment to calculate a quantification of individual digital components for CyTRICS testing. The initial version of the CyTRICS Prioritization Process was premised largely upon the impact which could result to an industrial control system if the digital component under testing was compromised, either through malicious means, faulty engineering, or other modes. The worldwide compromise of the SolarWinds Orion platform, first reported in December 2020, through malicious interference with the digital patching cycle was a watershed event in cyber supply chain security. The SolarWinds compromised demonstrated the strategic importance of certain types of ubiquitous software, and the ability to generate widespread cybersecurity effects. To address this challenge and as a part of the Department of Energy’s response to the SolarWinds compromise, DOE’s Office of Cybersecurity, Energy Security, and Emergency Response (CESER) directed the National Laboratories to evolve the CyTRICS Prioritization Process methodology to encompass additional factors related to the strategic importance of digital components. CESER directed CyTRICS researchers to identify, characterize, and append strategic factors to the CyTRICS Prioritization Process to provide additional weight to these characteristics. National Laboratory expert researchers identified functionality, distribution, and platform characteristics for digital components in ICS and OT that they assessed would be likely targeted in strategic initial-access cyber attack. CyTRICS has termed these factors “ICS Beachhead Systems,” leveraging a definition first advanced by Schneider Electric, which is intended as a blanket term to encompass digital components, products, and systems in OT. This paper describes the ICS Beachhead Systems identified and the rationale for inclusion. As a next step in the research and refinement process, the National Laboratories will validate this initial set of characteristics against digital components evaluated by the CyTRICS program and current implementation of the CyTRICS Prioritization Process. After validation, CyTRICS researchers will then develop a scoring methodology to generate a quantitative score to assess the degree to which a digital component is characterized as an ICS Beachhead System. Finally, the National Laboratories will append this scoring to the existing CyTRICS Prioritization Process algorithm.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

Cyber Informed Engineering (CIE) Principles Slide Presentation [Slides]

This document describes the concept and application of Cyber-Informed Engineering (CIE), a methodology that integrates cyber threat awareness into all stages of the systems engineering life cycle. It delineates how CIE enhances the security posture of critical infrastructure systems, which are increasingly targeted by sophisticated cyber threats. The exposition proceeds to methodically walk through the twelve foundational principles of CIE, each serving as a strategic guidepost for embedding cybersecurity into the fabric of system design, development, operation, and maintenance. The principles highlight the importance of proactive and comprehensive security measures that span from risk assessment to continuous improvement, ensuring that systems are not only designed with security in mind but are also resilient in the face of evolving cyber threats.

42 ENGINEERING↗
DOE OSTI2022

Precursor Analysis Report: Cyber Attack on Thyssenkrupp Blast Furnace 2014

The Cyber Attack on Thyssenkrupp Blast Furnace 2014 Precursor Analysis Report leverages publicly available information about the Thyssenkrupp Steel Mill cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. In December 2014, the German Government’s Federal Office for Information Security (BSI) released a report detailing a cyber attack on a German steel mill that occurred earlier that year, though exact dates and details of the attack were not revealed. While the report did not specify the name of the company, multiple sources identified the victim as one of Europe’s largest steel manufacturers, Thyssenkrupp AG. Further, Thyssenkrupp announced on 16 May of that year that Europe’s largest blast furnace, “Schwelgern 2,” located at its facility in Duisburg, Germany, would be offline for several weeks for repairs and upgrades, suggesting Schwelgern 2 was likely the target of the attack. The attack began in early 2014, when adversaries infiltrated the victim steel mill’s Information Technology (IT) network via a spearphishing campaign, then worked their way into the Operational Technology (OT) environment, where they executed software that caused denial of service, denial of control, and eventually a loss of control. This led to the blast furnace shutting down without proper safety procedures, resulting in catastrophic physical damage. No lives were lost in the incident, but ThyssenKrupp suffered $4 million in damage to the blast furnace and an additional $6 million in lost revenue. The adversaries required specialized knowledge and expertise in steel production, which enabled them to compromise a variety of internal systems and components across both IT and OT networks. The attack also demonstrated detailed knowledge of the industrial control systems (ICS) and production processes being used. This combination resulted in one of the earliest known publicly reported cybersecurity incidents resulting in physical damage to ICS equipment. Researchers and analysts identified 19 unique techniques (used in a sequence of 20 steps) utilized during the attack with a total of 454 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Fifteen of the identified techniques used during the Thyssenkrupp cyber attack were precursors to the triggering event. Analysis identified 369 observables associated with these precursor techniques, 316 of which were assessed to have an increased likelihood of being perceived in the 120 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗