NIC-Based Ultra-High-Speed Intrusion Detection System (IDS), Final Report on Grant DE-SC0002662 for 2009 SBIR Topic "High-Speed Network Security Systems (52.b)".
Explore the source record for details and available documents.
SEARCH · Engineering Papers
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Explore the source record for details and available documents.
Today’s networked systems utilize advanced security components such as Next Generation Firewall (NGFW), Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), and methods for network traffic classification. A fundamental aspect of these security components and methods is network packet visibility and packet inspection. To achieve packet visibility, a compute mechanism used by these security components and methods is Deep Packet Inspection (DPI). DPI is used to obtain visibility into packet fields by looking deeper inside packets, beyond just IP address, port, and protocol. However, DPI is considered extremely expensive in terms of compute processing costs and very challenging to implement on high speed network systems. The fundamental scientific paradigm addressed in this research project is the application of greater network packet visibility and packet inspection at data rates greater than 40Gbps to secure computer network systems. The greater visibility and inspection will enable detection of advanced content-based threats that exploit application vulnerabilities and are designed to bypass traditional security approaches such as firewalls and antivirus scanners. Greater visibility and inspection are achieved through identification of the application protocol (e.g., HTTP, SMTP, Skype) and, in some cases, extraction and processing of the information contained in the packet payload. Analysis is then performed on the resulting DPI data to identify potentially malicious behavior. In order to obtain visibility and inspect the application protocol and contents at high speed data rates, advanced DPI technologies and implementations are developed.
Smart inverters connected to a communication network are vulnerable to various anomalies in the form of cyberattacks. In this paper, a self-security approach is implemented using the digital twin concept for smart inverters. The digital twin is formed using the inverter’s dynamic model. Then, the incoming setpoints are autonomously examined using the digital twin, and only the safe setpoints are engaged to the inverter’s local controller. This paper demonstrates the details of the self-security algorithm and how the inverter’s digital twin is formed. In particular, the stable and unstable operation region is experimentally verified by changing the power setpoints engaged to the local controller, using a laboratory setup including a three-phase 1.5-kVA SiC-MOSFET inverter and a 12-kW NHR 9410 regenerative power grid emulator. The results demonstrate that the digital twin model can potentially protect inverters from abnormal operation by examining the incoming commands (new setpoints) using the inverter’s digital twin before engaging the setpoints to the local controller.
Nanotechnology offers the ability to work at the molecular level, atom by atom, to create large structures with fundamentally new molecular organization. It is essentially concerned with materials, devices, and systems whose structures and components exhibit novel and significantly improved physical, chemical and biological properties, phenomena, and process control due to their nanoscale size. A nanosensor technology has been developed at NASA Ames using nanostructure, single walled carbon nanotubes (SWNTs). The nanosensors have achieved low detection limit of chemicals in the concentration range of ppm to ppb. Due to large surface area, low surface energy barrier and high thermal and mechanical stability, nanostructured chemical sensors offer higher sensitivity, lower power consumption and a more robust solution than most state-of-the-art systems making them attractive for space and terrestrial applications. An example of a sensor module, the first space flown nano device, will be introduced in this presentation. Such sensors have drawn attention from space community for global weather monitoring, space exploration, life search in the universe, and launch pad fuel leak detection and in-flight cabin air and life support system monitoring, and engine operation monitoring. Additionally, the wireless capability of such sensors can be leveraged to network mobile and fixed-base detection and warning systems for civilian population centers, military bases and battlefields, as well as other high-value or high-risk assets and areas in industry.
In today’s world of distributed scientific collaborations, there are many challenges to providing reliable inter-domain network infrastructure. Network operators use a combination of active monitoring and trouble tickets to detect problems, but these are often ineffective at identifying issues that impact wide-area network users. Additionally, these approaches do not scale to wide area inter-domain networks due to unavailability of data from all the domains along typical network paths. The Pythia Network Diagnostic InfrasTructure (PuNDIT) project aims to create a scalable infrastructure for automating the detection and localization of problems across these networks. The project goal is to gather and analyze metrics from existing perfSONAR monitoring infrastructures to identify the signatures of possible problems, locate affected network links, and report them to the user in an intuitive fashion. Simply put, PuNDIT seeks to convert complex network metrics into easily understood diagnoses in an automated manner. We present our progress in creating the PuNDIT system and our status in developing, testing and deploying PuNDIT. We report on the project progress to-date, describe the current implementation architecture and demonstrate some of the various user interfaces it will support. We close by discussing the remaining challenges and next steps and where we see the project going in the future.
The developed T-Type Modular DC Circuit Breaker (T-Breaker) technology offers an all-in-one solution to challenges in DC networks. This includes swift fault detection and protection, power transient stability, and power quality improvement, achieved through the utilization of wide bandgap (WBG) power semiconductors and energy storage devices. The T-Breaker not only facilitates rapid fault current detection and interruption but also implements fault current limiting through active insertion of storage devices or by operating WBG devices in the saturation region. Additionally, with the assistance of energy storage devices, potential overvoltage issues on power devices induced by control signal misalignment can be mitigated. The T-Breaker can be regulated to perform shunt current injection/absorption using the vertical arm and series voltage insertion via the horizontal arm, thereby enhancing DC system stability during voltage or load power fluctuation transients. The OSU team and Raytheon team actively worked together on designing, fabricating, assembling, and testing of two T-Breaker prototypes. The first prototype is rated at 1 kV, 500 A with half-bridge (unipolar) structure to validate the T-Breaker concept. The second prototype is rated at 20 kV, 50 A with full-bridge (bipolar) topology which can reach an efficiency of 99.977%, realize a power density of 60.2 MW/m3, and eliminate the 500-A fault current with a fault response time of around 20 µs. The prototypes show great feasibility of adopting this technology in multiple applications including electrified aircraft, super charging stations, data centers, etc.
The rapid growth of large-scale datasets in fields like biology and social networks has driven the need for advanced graph analytics techniques. Community detection, a fundamental task in graph analytics, identifies closely connected groups of nodes within a network, providing valuable insights across various disciplines. This study focuses on two classic community detection methods, the Louvain algorithm and Markov Clustering (MCL), and evaluates the performance of two prominent distributed community detection algorithms: HiPDPL-GPU, our prior implementation, and HipMCL. We conduct experiments on GPU-accelerated heterogeneous HPC systems, Summit and Frontier, to assess their performance under varying conditions. Our objective is to identify the strengths and weaknesses of these algorithms in terms of scalability, and quality of solutions. We evaluate these algorithms on a diverse set of 70+ networks spanning 13 domains, with sizes ranging up to 4.2 billion edges. Our results demonstrate that HiPDPL-GPU consistently outperforms HipMCL, especially for large-scale networks. HiPDPL-GPU achieves significantly faster runtimes (47x to 1439x), higher modularity scores, and improved scalability. These findings highlight HiPDPL-GPU as a promising solution for efficient and effective large-scale graph analytics in diverse application domains, and provide insights into the feasibility of using MCL-based approaches for certain application domains.
Energy management of transmission and distribution networks is becoming more challenged with the accelerated increasing of distributed energy resources (DERs) such as distributed photovoltaic (PV) generation and distributed energy storage. To better analyze the impacts of DERs on both transmission and distribution systems, a comprehensive transmission and distribution co-simulation platform should be developed. Furthermore, with DERs more actively participated in system operation such as providing real time grid services, their cyber vulnerability should be better understood to maintain system reliability. This paper discussed a cyber-physical events emulation based transmission & distribution co-simulation platform to perform different cyber events emulation and analyze the impacts of cyber physical events happened in distribution system on the T&D system operation. The case studies with both a transmission network and a synthetic distribution network data validate that the proposed T&D co-simulation platform can perform comprehensive cyber physical events emulation. Therefore, with extensive simulation using the proposed model, the system operator can accumulate adequate training data for the system situation awareness and grid anomaly detection purpose.
The inspirals and mergers of compact binaries are among the most promising events for ground-based gravitational-wave (GW) observatories. The detection of electromagnetic (EM) signals from these sources would provide complementary information to the GW signal. It is therefore important to determine the ability of GW detectors to localize compact binaries on the sky, so that they can be matched to their EM counterparts. We use Markov Chain Monte Carlo techniques to study sky localization using networks of ground-based interferometers. Using a coherent-network analysis, we find that the Laser Interferometer Gravitational Wave Observatory (LIGO)-Virgo network can localize 50% of their detected neutron star binaries to better than 50 deg{sup 2} with a 95% confidence interval. The addition of the Large Scale Cryogenic Gravitational Wave Telescope (LCGT) and LIGO-Australia improves this to 12 deg{sup 2}. Using a more conservative coincident detection threshold, we find that 50% of detected neutron star binaries are localized to 13 deg{sup 2} using the LIGO-Virgo network, and to 3 deg{sup 2} using the LIGO-Virgo-LCGT-LIGO-Australia network. Our findings suggest that the coordination of GW observatories and EM facilities offers great promise.
We report scalable production of carbon nanotubes (CNTs) requires catalysts and reaction conditions that provide high nucleation efficiency. In situ characterization methods such as environmental transmission electron microscopy (ETEM) can reveal fundamental mechanisms of synthesis, but to date have primarily provided qualitative observations on small sample sizes. Here, quantitative analysis is performed using high-resolution, high-rate video capture of ETEM experimentation coupled with automated image processing, involving computer vision algorithms and convolutional neural networks. By this approach, we detect distinct nanoparticle formation from an alumina-supported iron thin film and subsequent CNT nucleation from the nanoparticles. The statistical summary of particles in each video shows that, compared to a H 2 -only atmosphere, pretreatment of the catalyst with carbon added to the H 2 atmosphere results in a smaller average particle diameter, a 2-fold increase in particle density (to 5300 particles/μm 2 ), a 3-fold increase in CNT nucleation efficiency (to 92%), and more than a 5-fold increase in CNT density (to 4800/μm 2 ). Addition of carbon during exposure to H 2 is also more effective than NH 3 at dewetting the catalyst film and increasing the CNT nucleation efficiency, in spite of NH 3 being a stronger reducing agent for iron. Insights from this study are applicable to improving CNT yield and productivity in both batch-style and continuous processes.
Mosquitoes are a key virus vector that poses significant health threats globally, affecting 700 million individuals and causing 1 million deaths annually. Accurately predicting mosquito abundance and dispersion remains a challenge. Complex interactions between mosquito dynamics and various environmental factors, notably hydrology, contribute to this challenge. Existing models typically focus on precipitation and temperature and often overlook further impacts of hydrological variables within mosquito modeling. In this study, we developed an artificial intelligence‐based model for mosquito dynamics, explicitly accounting for different hydrological variables, such as precipitation, soil moisture and streamflow. Using Toronto, Canada, as a case study, we identified causal relationships between changes in mosquito populations, hydrological factors, vegetation (e.g., leaf area index), and climate variables (e.g., daylight length, precipitation, and temperature). We embedded these relationships into a Long Short‐Term Memory (LSTM) Neural Network Model capable of accurately detecting mosquito dynamics across annual, seasonal, and monthly time scales. The LSTM is able to explain, on average, approximately 40% of the variance in the observed mosquito abundance data. Using the calibrated model, we predicted that the summer season mosquito abundance would increase by ∼16% and ∼19% under an intermediate greenhouse emission scenario, Shared Socioeconomic Pathway (SSP) 2–4.5, and a high greenhouse emission scenario, SSP5‐8.5, respectively. We expect that this model can serve as a valuable tool and inform science‐based decisions affecting mosquito dynamics and public health. It can also build a foundation for future risk analysis at the regional and larger scales.
The largest supercomputers in the world today consist of hundreds of thousands of processing cores and many more other hardware components. At such scales, hardware faults are a common place necessitating the need for fault-resilient software systems. While different fault resilient models are available today, most of them focus on allowing the computational processes to survive faults. On the other hand, we have recently started investigating fault resilience techniques for data-centric programming models such as the partitioned global address space (PGAS) models. The primary difference in data-centric models is the decoupling of computation and data locality. That is, data placement is decoupled from the executing processes allowing us to view process failure (a physical node hosting a process is dead) separately from data failure (a physical node hosting data is dead). In this paper, we take a first step towards data centric fault resilience by designing and implementing a fault resilient one-sided communication runtime framework using Global Arrays and its communication system, ARMCI. The framework consists of a fault resilient process manager, low overhead and network assisted remote node fault detection module, non-data moving collective communication primitives and providing failure semantics and error codes for one-sided communication runtime systems. Our performance evaluation indicates that our framework incurs little overhead compared to state of the art designs and provides a fundamental framework of fault resiliency for PGAS models. Keywords
Matching is an important combinatorial problem with a number of applications in areas such as community detection, sparse linear algebra, and network alignment. Since computing optimal matchings can be very time consuming, several fast approximation algorithms, both sequential and parallel, have been suggested. Common to the algorithms giving the best solutions is that they tend to be sequential by nature, while algorithms more suitable for parallel computation give solutions of less quality. We present a new simple 1 2 -approximation algorithm for the weighted matching problem. This algorithm is both faster than any other suggested sequential 1 2 -approximation algorithm on almost all inputs and also scales better than previous multithreaded algorithms. We further extend this to a general scalable multithreaded algorithm that computes matchings of weight comparable with the best sequential algorithms. The performance of the suggested algorithms is documented through extensive experiments on different multithreaded architectures.
We report high-latitude tundra ecosystems are increasingly affected by climate warming. As an important fraction of soil microorganisms, fungi play essential roles in carbon degradation, especially the old, chemically recalcitrant carbon. However, it remains obscure how fungi respond to climate warming and whether fungi, in turn, affect carbon stability of tundra. In a 2-year winter soil warming experiment of 2°C by snow fences, we investigated responses of fungal communities to warming in the active layer of an Alaskan tundra. Although fungal community composition, revealed by the 28S rRNA gene amplicon sequencing, remained unchanged (p > .05), fungal functional gene composition, revealed by a microarray named GeoChip, was altered (p < .05). Changes in functional gene composition were linked to winter soil temperature, thaw depth, soil moisture, and gross primary productivity (canonical correlation analysis, p < .05). Specifically, relative abundances of fungal genes encoding invertase, xylose reductase and vanillin dehydrogenase significantly increased (p < .05), indicating higher carbon degradation capacities of fungal communities under warming. Accordingly, we detected changes in fungal gene networks under warming, including higher average path distance, lower average clustering coefficient and lower percentage of negative links, indicating that warming potentially changed fungal interactions. Together, our study reveals higher carbon degradation capacities of fungal communities under short-term warming and highlights the potential impacts of fungal communities on tundra ecosystem respiration, and consequently future carbon stability of high-latitude tundra.
This software generates realistic network traffic to test intrusion detection systems. The most realistic traffic is generated when software is used to drive actual applications, thereby behaving like a real user. Tools that generate such realistic user behavior are called user emulators. However, no existing user emulators use models based on data science and real user data, and they suffer from a decrease in the fidelity of the generated traffic. We develop a user emulator that uses real user data and data science to generate higher fidelity emulation and increase the accuracy of our experimental results.
We proposed to customize emerging in situ geophysical monitoring technology to generate time-series data during sporadic rain events in a semi-arid region. Electrodes were to be connected to wireless \nodes" which can be left in the eld for many months. Embedded software would then increase sampling frequency during periods of rainfall. We hypothesized that this contrast between no-volume ow in karst passageways dur- ing dry periods and partial- or saturated-volume ow during a rain event is detectable by these Wireless Sensor Network (WSN) geophysical nodes, we call this a Wireless Resistivity Network (WRN). The development of new methodologies to characterize semi-arid karst hydrology is intended to augment Sandia National Laboratorys mission to lead e orts in energy technologies, waste disposal and climate security by helping to identify safe and secure regions and those that are at risk. Development and initial eld testing identi ed technological barriers to using WRNs for identifying semi-arid karst, exposing R&D which can be targeted in the future. Gravity, seismic, and resis- tivity surveys elucidated how each technique might e ectively be used to characterize semi-arid karst. This research brings to light the importance and challenges with char- acterizing semi-arid karst through a multi-method geophysical study. As there have been very few studies with this emphasis, this study has expanded the body of practical experience needed to protect the nations water and energy security interests.
In recent decades, lightning activity at high latitudes has increased. Tall thunderstorm clouds affect radiation balance directly, as well as indirectly through lightning-initiated fires and the resulting smoke. One can remotely sense lightning strokes over the globe through their VLF radio emission, and, with multiple receivers, it is possible to precisely locate lightning strokes. This technique makes it possible to continuously monitor arctic lightning--a capability not possible by other means. In this research effort, a World-Wide Lightning Location Network station, consisting of a VLF receiver, signal processing hardware, and analysis software, were installed at the North Slope of Alaska (NSA) facility and planned to operate for several years. This far north location is expected to improve the network's high-latitude detection efficiency.
A system is described for determining the position of a vehicle or other target that emits radio waves and which is of the type that senses the difference in time of arrival at spaced ground stations of signals from the vehicle to locate the vehicle on a set of intersecting hyperbolas. A network of four ground stations detects the radio emissions from the vehicle and by means of cross correlation derives the relative signal delay at the ground stations from which the vehicle position is deduced. Because the signal detection is by cross correlation, no knowledge of the emission is needed, which makes even unintentional radio noise emissions usable as a locator beacon. By positioning one of the four ground stations at an elevation significantly above the plane of the other three stations, a three dimensional fix on the vehicle is possible.