SEARCH · Engineering Papers

Results for “threat analysis”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 109 records · Page 6

All sources NASA NTRS DOE OSTI

DOE OSTI2021

Critical Roles of Information, Analysis, Research, and Operations in the Cyber Realm

PNNL has developed an adaptive cyber integration framework (ACIF) to facilitate the timely sharing of cyber threat information along with the advancement of situational awareness tools to enhance protection against and respond to critical infrastructure cybersecurity threats. The ACIF comprises components implemented iteratively to achieve research and mission goals. The ACIF components include data generation technologies, analytic tools development and maturation, data enrichment and fusion, trust building with stakeholders, investigative research, analytic rigor, production, and dissemination. Each component, its importance to the ACIF, and how they can be adopted and applied across other information-sharing sectors and domains are discussed in this paper.

Cyber Threat Intelligence, Cyber Security, Data En↗

DOE OSTI2024

Multisectoral analysis of drought impacts and management responses to the 2008–2015 record drought in the Colorado Basin, Texas

Abstract. Drought has long posed an existential threat to society. Engineering and technological advancements have enabled the development of complex, interconnected water supply systems that buffer societies from the impacts of drought, enabling growth and prosperity. However, increasing water demand from population growth and economic development, combined with more extreme and prolonged droughts due to climate change, poses significant challenges for governments in the 21st century. Improved understanding of the cascading multisectoral impacts and adaptive responses resulting from extreme drought can aid in adaptive planning and highlight key processes in modeling drought impacts. The record drought spanning 2008 to 2015 in the Colorado Basin in the state of Texas, United States, serves as an outstanding illustration to assess multisectoral impacts and responses to severe, multi-year drought. The basin faces similar water security challenges to those across the western US, such as groundwater depletion and sustainability, resource competition between agriculture and growing urban populations, limited options for additional reservoir expansion, and the heightened risk of more severe and frequent droughts due to climate change. By analyzing rich, high-quality data sourced from nine different local, state, and federal sources, we demonstrate that characterizing regional multisector dynamics is crucial to predicting and understanding future vulnerability and possible approaches to reduce impacts to human and natural systems in the face of extreme drought conditions. This review reveals that, despite the severe hydrometeorological conditions of the drought, the region's advanced economy and existing water infrastructure effectively mitigated economic and societal impacts.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2021

Autonomous Tools for Attack Surface Reduction (Final Report)

The electric power grid is a complex critical infrastructure that forms the lifeline of modern society, and its secure and reliable operation is of paramount importance to national security and economic wellbeing. However, recent findings documented in authoritative sources indicate the threat of cyber-based attacks growing in numbers and sophistication. However, securing the grid against stealthy cyberattacks is a challenging task due to legacy nature of the infrastructure coupled with dynamic nature of threat landscape and ever-growing sophistication of the adversaries. Additionally, the grid’s attack surface continues to grow with the increased dependence on digital communications and control that now extends to each consumer through smart meters and distributed energy resources. Unfortunately, this expansive surface increases the grid’s vulnerability and further exposes critical control systems in both substations and control centers. To respond to this emerging need, we had successfully assembled an interdisciplinary team with academic- industry partnership to successfully conduct research, development, evaluation, demonstration, and commercialization of attack surface reduction tools, whose goal was to significantly reduce the cyber attack surface in the North American power grid. Our proposed project was a synergistic collaborative effort leveraging the synergistic expertise of the team members across power systems, cyber security and CPS security, testbeds, field deployments and demonstration, and successful commercialization. The following are the specific tasks that have been successfully completed two phases (2016-2020). Phase I: Task 1: Developed and implemented a robust Project Management and Data Management Plan, coupled with a well thought out Risk Mitigation Plan. Task 2.1: Developed a comprehensive framework that continually assesses and autonomously reduces the attack surface for the power grid control environment spanning across substations, control center and the SCADA network to significantly reduce the risks of cyber attacks. Task 2.2: Developed attack surface analysis techniques, metrics, and tools that assess the attack surface at multiple levels including the control center, substations, and the SCADA network. Task 2.3: Developed attack surface reduction techniques and tools that dynamically reduce attack surface and hence increase attacker’s cost without interfering in the critical functions of the system. Task 2.4: Prototyped, implemented, and quantitatively evaluated/validated the techniques and tools on a realistic industrial CPS security testbed environment by leveraging the unique resources of the team. Task 3: Developed Commercialization plan to transition the developed tools into power system industry stakeholders for a broader adoption by leveraging the expertise of our industrial members. Phase II: Task 4: Successfully completed field demonstration, verification, and evaluation of the effectiveness of the attack surface analysis and reduction techniques on a realistic utility testbed environment. This also involved the development of realistic scenarios, sound metrics, data sets, evaluation criteria, and documentation. Technology integration & Field demonstration: The project had significantly advanced the state-of-the-art research and practice in improving the cybersecurity of our nation’s power grid infrastructure against cyber threats. In particular, the proposed, designed, and deployed attack surface analysis and reduction algorithms and tools have contributed to significantly reducing the exposure and risk of the devices, substations, and the integrated SCADA/EMS/ DMS grid environment to cyber threat. Strong demonstration and evaluation techniques have verified the feasibility of the developed techniques on realistic cyber-physical testbeds and utility partner's real grid environment, and collaborative research and evaluation of attack surface reduction techniques (for wide-are monitoring and control) within a vendor (GE) EMS platform. The Attack Host Analyzer (AHA) tool that was developed through this project was made available through GitHub.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2021

Scientific and stakeholder evidence-based assessment: Ecosystem response to floating solar photovoltaics and implications for sustainability

Floating solar photovoltaic (FPV) installations are increasing globally. However, their interaction with the hosting water body and implications for ecosystem function is poorly understood. Understanding potential impacts is critical as water bodies provide many ecosystem services on which humans rely and are integral for delivering the United Nations Sustainable Development Goals (SDGs). Here, we used scientific evidence from a systematic review and stakeholder expertise, captured through an international survey and a workshop, alongside existing understanding of the role of water bodies in delivering ecosystem services and the SDGs. We found 22 evidence outcomes that indicated potential physical, chemical and biological impacts of FPV on water bodies. Assessment by stakeholders from across sectors indicated that reduced water evaporation is the greatest opportunity, whilst changes to water chemistry, including nitrification and deoxygenation, are the greatest threat. Despite these findings, FPV operators reported no observed water quality or ecosystem impacts. However, only 15% of respondents had performed water quality analysis; visual inspection alone cannot ascertain all water quality impacts. Based on the integration of these findings, we determined that FPV could impact nine ecosystem services. Furthermore, established linkages between ecosystem services and SDGs indicate the potential for impacts on eight SDGs, although whether the impact is positive or negative is likely to depend on FPV design and water body type. Our results further the understanding of the effects of FPVs on host water bodies and may help to ensure the anticipated growth in FPVs minimises threats and maximises opportunities, safeguarding overall sustainability.

14 SOLAR ENERGY↗

DOE OSTI2026

Equipment Assessment Guide: A Technical Inspection and Hardening Guide for Devices in Power Grid Operations

This Equipment Assessment Guide, developed by Idaho National Laboratory (INL), provides a comprehensive framework designed to enhance the security of operational technology (OT) devices within power grid operations. The guide outlines essential steps for asset owners to conduct technical inspections and harden vulnerable hardware and firmware components commonly found in embedded systems. It focuses on components frequently targeted by cyber threats, offering valuable identification techniques for locating and recognizing critical components on devices. Additionally, the guide presents recommended secure configurations aimed at minimizing exposure and reinforcing defenses, along with impact analysis that highlights the potential consequences for grid operations if components are compromised. By implementing the recommendations outlined in this guide, asset owners can significantly enhance their cybersecurity posture, reduce the attack surface of field-deployed devices, and improve the resilience of grid services against emerging cyber threats.

42 - ENGINEERING↗

DOE OSTI2021

Tri-molybdenum phosphide (Mo 3 P) and multi-walled carbon nanotube junctions for volatile organic compounds (VOCs) detection

Detection and analysis of volatile organic compounds' (VOCs) biomarkers lead to improvement in healthcare diagnosis and other applications such as chemical threat detection and food quality control. Here, we report on tri-molybdenum phosphide (Mo3P) and multiwalled carbon nanotube (MWCNT) junction-based vapor quantum resistive sensors (vQRSs), which exhibit more than one order of magnitude higher sensitivity and superior selectivity for biomarkers in comparison to pristine MWCNT junctions based vQRSs. Transmission electron microscope/scanning tunneling electron microscope with energy dispersive x-ray spectroscopy, x-ray diffraction, and x-ray photoelectron spectroscopy studies reveal the crystallinity and the presence of Mo and P elements in the network. The presence of Mo3P clearly enhanced the performance of vQRS as evidenced in sensitivity and selectivity studies. The vQRSs are stable over extended periods of time and are reproducible, making them a potential candidate for sensing related applications.

37 INORGANIC, ORGANIC, PHYSICAL, AND ANALYTICAL CH↗

DOE OSTI2024

Collection And Analysis Of Telemetry For The Cyote Heuristic

CATCH CLI focuses on gathering telemetry data, storing it in the Neo4j database, querying for Mitre ATT&CK patterns, and creating STIX 2.1 reports. Key Components: Analysis Modules: Analyze data to detect attack patterns. GoSTOTS Collection Engines: Collect telemetry data. These tools can be used together or individually. Analysis modules rely on data from specific engines to identify attack patterns. Source Code Organization: Engines: CATCH/catch/cmd/collection Modules: CATCH/catch/cmd/analysis CGUI Overview CATCH Graphical User Interface (CGUI) offers a graphical shell to execute CATCH CLI, allowing easy editing of: Analysis Modules Database configurations Profiles (collection and device settings) Neo4j Overview Neo4j is a graph database using the Cypher query language, storing data in JSON. It seamlessly integrates with STIX 2.1 data for: Data Submission: CATCH Collection Engines Data Querying: Analysis Modules CATCH modifies STIX 2.1 data for Neo4j submission and reverts it back during querying. STIG Overview Structured Threat Intelligence Graph (STIG) is a tool for creating, editing, querying, analyzing, and visualizing threat intelligence using STIX 2.1 and storing data in Neo4j. Usage Tools can be run: Manually (CLI): Refer to CATCH documentation User Interface: Run ./cgui/CGUI or go run ./cgui/ Additional Information Logging System: Detailed in the config documentation Further Documentation: Available for CATCH and CGUI

Madsen, MichaelJ. [Idaho National Laboratory (INL)↗

DOE OSTI2025

Adapting Traditional Hazards Analysis Methods to Address Cyber Risks

Traditional hazards analysis (HA) methods, originally developed to address physical and operational risks, often fall short when it comes to identifying and mitigating cyber threats. These cyber threats pose unique and evolving risks to critical infrastructure and industrial control systems (ICS). This report explores the integration of Cyber-Informed Engineering (CIE) principles into existing HA methods to enhance their ability to address cyber-induced risks. CIE provides organizations with a practical, cost-effective approach to closing the gap between traditional HA methods and the need for cyber risk mitigation. By leveraging existing safety processes and controls, CIE allows users to examine and mitigate cyber vulnerabilities without overhauling existing HA methods. This report identifies areas where HA and CIE naturally align and where their approaches diverge. It emphasizes how CIE principles can be used to adapt HA methods, broadening their scope to include cyber risks and enabling the mitigation of cyber- induced impacts alongside traditional hazards and failure scenarios. This report examines how CIE can be applied across various HA methods—such as Hazard and Operability Studies (HAZOP), Probabilistic Risk Assessment (PRA), Failure Modes and Effects Analysis (FMEA), Systems-Theoretic Process Analysis (STPA), Hazard and Consequence Analysis for Digital Systems (HAZCADS), and Layers of Protection Analysis (LOPA). It provides strategies for integrating CIE to strengthen the identification, assessment, and mitigation of cyber-induced risks. The findings offer a structured entry point for organizations to embed CIE concepts into hazards and safety analyses, as well as broader engineering processes, ultimately supporting the design and operation of a more resilient infrastructure.

42 ENGINEERING↗

DOE OSTI2025

Adapting Traditional Hazards Analysis Methods to Address Cyber Risks

42 - ENGINEERING↗

DOE OSTI2020

Discovering the Molecular Determinants of Phaeobacter inhibens Susceptibility to Phaeobacter Phage MD18

Bacteriophages are useful nonantibiotic therapeutics for bacterial infections as well as threats to industries utilizing bacterial agents. This study identified Phaeobacter virus MD18 , a phage antagonist of Phaeobacter inhibens , a bacterium with promising use as a probiotic for aquatic farming industries. Genomic analysis suggested that Phaeobacter phage MD18 has evolved to enhance its replication in P. inhibens by adopting favorable tRNA genes as well as through genomic sequence adaptation to resemble host codon usage. Lastly, a high-throughput analysis of P. inhibens transposon insertion mutants identified genes that modulate host susceptibility to phage MD18 and implicated the type IV pilus as the likely receptor recognized for adsorption. This study marks the first characterization of the relationship between P. inhibens and an environmentally sampled phage, which informs our understanding of natural threats to the bacterium and may promote the development of novel phage technologies for genetic manipulation of this host.

59 BASIC BIOLOGICAL SCIENCES↗

DOE OSTI2020

Potential Academic Research Topics of National Security Relevance

Since even before its establishment as an independent national security laboratory in 1949, Sandia has been devoted to an overarching mission of developing advanced technologies for global peace. These technologies have taken a variety of forms, and they exist in and must address an ever-changing global security environment. An understanding of that global security environment and its possible or likely evolution is therefore critical to ensuring that Sandia can maintain its focus on strategic technology investments that will benefit the nation in the next 20- 30 years. Sandia sustains multiple Systems Analysis organizations whose responsibility includes maintaining an understanding of the global security environment as it applies across multiple mission domains. The topics below include two from Sandia's emerging threats and biodefense mission, three with relevance to Sandia's cyber defense mission, and four of particular but not exclusive relevance to Sandia's nuclear deterrence mission. All are intended to spur independent academic thought that could assist Sandia as well as the broader national security community in anticipating and adapting to a continually changing world. Sandia anticipates periodic interactions between Sandia Systems Analysis staff and SciPol Scholars Program faculty and students who choose to expand upon these topics in order to provide opportunities for feedback and communication throughout 2020-2021.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2024

Inertia Estimation and Trend Analysis of the United States Power Grid Interconnections

The transition from conventional to modern power systems is causing an increase in integration of inverter-based resources (IBRs). This generally leads to a decrease in total system inertia, which in-turn increases the system’s rate-of-change-of-frequency (RoCoF) during disturbances. This poses a threat to the frequency stability of the system and may falsely trigger protective devices. To monitor system status and plan for integrating renewable energy sources like photovoltaic, wind, and energy storage systems, a realistic study of inertia estimation and analysis in the United States (US) over the past decade is needed. This paper uses field-measured phasor measurement unit (PMU) data collected throughout the US from 2013 to 2023 via the Frequency Monitoring Network (FNET/GridEye) operated by the University of Tennessee, Knoxville (UTK) and Oak Ridge National Laboratory (ORNL). The collected PMU frequency data is utilized to estimate the system inertia of the three US interconnections: Eastern, Western, and Texas. Various RoCoF time windows are investigated for estimating the inertia of each interconnection by maximizing the correlation coefficient between the measured RoCoF and power mismatch. The resulting inertia trends over the past decade show approximately a 6% decline in inertia in the Eastern interconnection, a 15% decline in inertia in the Western interconnection, and a 16% increase in inertia in Texas. Key insights into how inertia is changing amidst the complex energy landscape are extracted using the fuel mix trend data. This provides valuable information for future energy strategies and planning.

30 DIRECT ENERGY CONVERSION↗

DOE OSTI2022

Resilience Enhancements through Deep Learning Yields

This report documents the Resilience Enhancements through Deep Learning Yields (REDLY) project, a three-year effort to improve electrical grid resilience by developing scalable methods for system operators to protect the grid against threats leading to interrupted service or physical damage. The computational complexity and uncertain nature of current real-world contingency analysis presents significant barriers to automated, real-time monitoring. While there has been a significant push to explore the use of accurate, high-performance machine learning (ML) model surrogates to address this gap, their reliability is unclear when deployed in high-consequence applications such as power grid systems. Contemporary optimization techniques used to validate surrogate performance can exploit ML model prediction errors, which necessitates the verification of worst-case performance for the models.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2024

Physical & Cyber Security Modeling Interfacing Through Dante and ARCADE

Physical security is increasingly facing new threats from cyber attackers, for which there is little research in the way of characterizing this threat. This report discusses the efforts to combine cyber and physical security modeling tools to investigate this novel combinatorial threat space. To accomplish this, the Dante force-on-force modeling and simulation software and the Advanced Reactor Cyber Analysis and Development Environment (ARCADE) were integrated. Dante provides a 3D environment which models the physical world, while ARCADE provides the cyber and control systems world.

42 ENGINEERING↗

DOE OSTI2025

Braxton Marlatt Intern Poster

The Internet of Things (IoT) encompasses a vast network of interconnected devices embedded with software, sensors, and network connectivity, enabling data collection and exchange. While IoT technology revolutionizes various industries, it also introduces significant security challenges. This research focuses on enhancing IoT security through the implementation of Zero Trust Architecture concepts, specifically targeting the Network and Device pillars of the Cybersecurity and Infrastructure Security Agency’s Zero Trust Maturity Model. By generating Codified Attack Surfaces (CAS) using custom Structured Threat Information eXpression bundles, this project aims to provide enhanced visibility into network communications, detect vulnerabilities in device firmware, and improve the overall security posture for IoT devices and networks. The methodology involves defining custom STIX schema and objects, collecting data from intra-IoT traffic, external network traffic, and firmware analysis, and automating the conversion and correlation of this data into STIX bundles. The automated generation of attack surfaces offers comprehensive insights into activity, vulnerabilities, and anomalies within an IoT environment, enabling proactive threat identification and mitigation.

24 - POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2020

Wireworm (Coleoptera: Elateridae) genomic analysis reveals putative cryptic species, population structure, and adaptation to pest control

The larvae of click beetles (Coleoptera: Elateridae), known as “wireworms,” are agricultural pests that pose a substantial economic threat worldwide. We produced one of the first wireworm genome assemblies (Limonius californicus), and investigated population structure and phylogenetic relationships of three species (L. californicus, L. infuscatus, L. canus) across the northwest US and southwest Canada using genome-wide markers (RADseq) and genome skimming. We found two species (L. californicus and L. infuscatus) are comprised of multiple genetically distinct groups that diverged in the Pleistocene but have no known distinguishing morphological characters, and therefore could be considered cryptic species complexes. We also found within-species population structure across relatively short geographic distances. Genome scans for selection provided preliminary evidence for signatures of adaptation associated with different pesticide treatments in an agricultural field trial for L. canus. We demonstrate that genomic tools can be a strong asset in developing effective wireworm control strategies.

59 BASIC BIOLOGICAL SCIENCES↗

DOE OSTI2021

Nuclear Safeguards: Feature Extraction for Machine Learning Enrichment Analysis of UF 6 Cylinders

With the increasing international interest in using nuclear material as sources of energy, comes the growing concern that we may see an increase in proliferation threats. Uranium hexafluoride (UF 6 ) is used in the nuclear fuel cycle for uranium enrichment. Inspectors from the International Atomic Energy Agency (IAEA) monitor the enrichment levels of UF 6 stored in transportation cylinders, to ensure the enrichments match that of a facility operator’s declarations. However, only a characteristic subset of UF 6 cylinders can be measured by inspectors from the IAEA during these inspections. In turn, the inspector may not identify a cylinder whose enrichment levels do not match the facility declarations. Therefore, our team attempts to develop a machine learning network that could determine the enrichment percentage of cylinders as they enter and exit facilities. The machine learning model must be robust against spectral variations due to factors that are internal and external to the UF 6 cylinder. Such factors include but are not limited to the speed and distance of the moving vehicle, cylinder type, cylinder orientation, and fill level. Many features in the spectral continuum can be used to identify and correct for some of these variations. As a consequence, the model must extract numerous features in the continuum. We investigate new approaches in continuum subtraction to verify enrichment percentage: interpolation and extrapolation of lines at the notable characteristic spectral peaks. It was determined that there was no clear answer on which method proved superior, therefore the decision was made to implement both new methods into the current codebase. We currently rely on synthetic training and testing data to analyze the results and fine tune our models but hope to test the system on measured data soon.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗

DOE OSTI2023

Proactive Intrusion Detection and Mitigation System

SAND2023-05661O The proactive intrusion detection and mitigation system (PIDMS) provides grid-edge situational awareness for cybersecurity defense by capturing real-time distributed energy resource (DER) network traffic and performance data with a novel approach that improves the detection and prevention of cyber-physical attacks. The PIDMS addresses the grid-edge security gap with real-time analysis of both network traffic and photovoltaic performance data to deliver a novel, cyber-physical intrusion detection system (IDS) approach that increases the accuracy and effectiveness of detection and mitigation. This hybrid IDS analysis enables dual monitoring that increases the workload of the adversary; both cyber and physical data would have to be simultaneously spoofed to evade detection. Furthermore, monitoring and analyzing cyber data are insufficient in some cases. For example, in an insider threat aimed at disrupting inverter grid-support functions where proper credentials and authentication are achieved, only the altered PV performance would indicate abnormal behavior. All in all, the PIDMS provides novel capabilities for: • Distributed, real-time cyber-physical detection and mitigation analysis • Cybersecurity defense for grid-edge systems • Analysis framework that can provide situational awareness across the transmission, distribution, and DER systems The PIDMS sensor is designed to collect cyber-physical data, process the data using machine-learning algorithms, detect abnormal events, and deploy mitigations. With these goals, the main functional PIDMS objectives are: • Capability to collect cyber-physical data • Onboard storage of cyber-physical data • Peer-to-peer communication • Computationally efficient machine-learning algorithms • Online cyber-physical data analysis • Alerting/visualization capabilities • Mitigation deployment capability with bump-in-the-wire (BITW) implementation Each of these functional objectives enable PIDMS to perform effective cyber-physical intrusion detection and mitigation. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.

Jones, Christian↗