SEARCH · Engineering Papers

Results for “Cyber”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 1,153 records · Page 64

All sources NASA NTRS DOE OSTI

DOE OSTI2025

Grid Communications: Digital Assurance and Supply Chain Challenges and Emerging Regulation Session Two

The TADA Grid Communications Workshops are designed to strengthen cybersecurity and digital assurance across the energy sector by focusing on secure deployment and management of grid communications technologies. These workshops bring together state energy offices, utilities, and technology suppliers to explore the intersection of communications infrastructure, supply chain risks, and emerging regulatory requirements. Participants will apply Cyber-Informed Engineering (CIE) principles to reduce risks in communications systems, engage with INL’s procurement guidance, and explore future tools. Through scenario-based exercises and peer exchange, attendees will develop risk-based security strategies and actionable compliance roadmaps tailored to their grid communications projects. The workshops also help participants navigate evolving regulatory frameworks such as FEOC rules in the OBBB, NERC CIP-013, and NDAA 2024, while identifying compliance gaps in mixed-technology environments. A key outcome is the formation of a practitioner network with ongoing access to INL expertise and resources, fostering long-term resilience in the digital energy ecosystem. This is Session 2 of 3 (Full Version).

29 - ENERGY PLANNING, POLICY AND ECONOMY↗

DOE OSTI2025

Grid Communications: Cybersecurity and Supply Chain Challenges and Emerging Regulation Session Three

29 - ENERGY PLANNING, POLICY AND ECONOMY↗

DOE OSTI2025

Grid Communications Supply Chain & Emerging Regulation Challenges Session 1

29 - ENERGY PLANNING, POLICY AND ECONOMY↗

DOE OSTI2022

Multilayered Network Models for Security: Enhancing System Security Engineering with Orchestration

Security engineering approaches can often focus on a particular domain—physical security, cyber security, or personnel security, for example. Yet, security systems engineering consistently faces challenges requiring socio-technical solutions to address evolving and dynamic complexity. While some drivers of this complexity stem from complex risk environments, innovative adversaries, and disruptive technologies, other drivers are endogenous and emerge from the interactions across security engineering approaches. In response, INCOSE's Systems Security Working Group identified the need to better coordinate “disparate security solutions [that] operate independently” as one of eleven key concepts in their IS21 FuSE Security Roadmap. From this perspective, this need for “security orchestration” aligns with the perspective that security is a property that emerges from interactions within complex systems. Current efforts at Sandia National Laboratories are developing a systems security engineering approach that describes high consequence facility (HCF) security as a multidomain set of interacting layers. The result is a multilayered network (MLN)-based approach that captures the interactions between infrastructure, physical components, digital components, and humans in nuclear security systems. This article will summarize the MLN-based approach to HCF security and describe two preliminary results demonstrating potential benefits from incorporating interactions across disparate security solutions. Here, leveraging the logical structure of networks, this MLN model-based approach provides an example of how security orchestration provides enhanced systems security engineering solutions.

42 ENGINEERING↗

DOE OSTI2023

Enhancing Early Systems R&D Capabilities with Systems —Theoretic Process Analysis

Systems engineering today faces a wide array of challenges, ranging from new operational environments to disruptive technological — necessitating approaches to improve research and development (R&D) efforts. Yet, emphasizing the Aristotelian argument that the “whole is greater than the sum of its parts” seems to offer a conceptual foundation creating new R&D solutions. Invoking systems theoretic concepts of emergence and hierarchy and analytic characteristics of traceability, rigor, and comprehensiveness is potentially beneficial for guiding R&D strategy and development to bridge the gap between theoretical problem spaces and engineering-based solutions. In response, this article describes systems–theoretic process analysis (STPA) as an example of one such approach to aid in early-systems R&D discussions. STPA—a ‘top-down’ process that abstracts real complex system operations into hierarchical control structures, functional control loops, and control actions—uses control loop logic to analyze how control actions (designed for desired system behaviors) may become violated and drive the complex system toward states of higher risk. By analyzing how needed controls are not provided (or out of sequence or stopped too soon) and unneeded controls are provided (or engaged too long), STPA can help early-system R&D discussions by exploring how requirements and desired actions interact to either mitigate or potentially increase states of risk that can lead to unacceptable losses. This article will demonstrate STPA's benefit for early-system R&D strategy and development discussion by describing such diverse use cases as cyber security, nuclear fuel transportation, and US electric grid performance. Together, the traceability, rigor, and comprehensiveness of STPA serve as useful tools for improving R&D strategy and development discussions. In conclusion, leveraging STPA as well as related systems engineering techniques can be helpful in early R&D planning and strategy development to better triangulate deeper theoretical meaning or evaluate empirical results to better inform systems engineering solutions.

42 ENGINEERING↗

DOE OSTI2022

First Plant Cell Atlas symposium report

The Plant Cell Atlas (PCA) community hosted a virtual symposium on December 9 and 10, 2021 on single cell and spatial omics technologies. The conference gathered almost 500 academic, industry, and government leaders to identify the needs and directions of the PCA community and to explore how establishing a data synthesis center would address these needs and accelerate progress. This report details the presentations and discussions focused on the possibility of a data synthesis center for a PCA and the expected impacts of such a center on advancing science and technology globally. Community discussions focused on topics such as data analysis tools and annotation standards; computational expertise and cyber-infrastructure; modes of community organization and engagement; methods for ensuring a broad reach in the PCA community; recruitment, training, and nurturing of new talent; and the overall impact of the PCA initiative. These targeted discussions facilitated dialogue among the participants to gauge whether PCA might be a vehicle for formulating a data synthesis center. The conversations also explored how online tools can be leveraged to help broaden the reach of the PCA (i.e., online contests, virtual networking, and social media stakeholder engagement) and decrease costs of conducting research (e.g., virtual REU opportunities). Major recommendations for the future of the PCA included establishing standards, creating dashboards for easy and intuitive access to data, and engaging with a broad community of stakeholders. The discussions also identified the following as being essential to the PCA's success: identifying homologous cell-type markers and their biocuration, publishing datasets and computational pipelines, utilizing online tools for communication (such as Slack), and user-friendly data visualization and data sharing. In conclusion, the development of a data synthesis center will help the PCA community achieve these goals by providing a centralized repository for existing and new data, a platform for sharing tools, and new analytical approaches through collaborative, multidisciplinary efforts. A data synthesis center will help the PCA reach milestones, such as community-supported data evaluation metrics, accelerating plant research necessary for human and environmental health.

59 BASIC BIOLOGICAL SCIENCES↗

DOE OSTI2020

Hypergraph Analytics of Domain Name System Relationships

We report on the use of novel mathematical methods in hypergraph analytice over a large quantity of DNS data. Hypergraphs generalize graphs, as used in network science, to better model complex multiway relations in cyber data. Specifically, casting DNS data from Georgia Tech's ActiveDNS repository as hypergraphs allows us to fully represent the interactions between {\em collections} of domains and IP addresses. To facilitate large-scale analytics, we fielded an analytical pipeline of two capabilities. HyperNetX (HNX) is a Python package for the exploration and visualization of hypergraphs, acting as a frontend. For the backend, the Chapel HyperGraph Library (CHGL) is a library for high performance hypergraph analytics written in the exascale programming language Chapel. CHGL was used to process gigascale DNS data, performing compute-intensive calculations for data reduction and segmentation. Identified portions are then sent to HNX for both exploratory analysis and knowledge discovery targeting known tactics, techniques, and procedures.

Joslyn, Cliff A.↗

DOE OSTI2022

Resilient Hierarchical Networked Control Systems: Secure Controls for Critical Locations and at Edge

Integration of information and communication technology (ICT) offers new opportunities in improving the management and operation of critical infrastructures such as power systems as it allows connection of different sensors and control components via a communication network, leading to the so-called networked control systems (NCS). However, the use of open and pervasive ICT such as the Internet or wireless communication technologies comes at a price of making NCS vulnerable to cyber intrusions/attacks which may cause physical damage. Here, this chapter presents control algorithms to ensure resilient and safe operation of NCS under unknown cyberattacks. Specifically, a variant of dynamic watermarking strategies is presented by embedding encoding/decoding components of chaotic signals into the NCS for secure control for critical locations where the measurement/control signals are transmitted to/from the control center via a communication network. In addition, resilient cooperative control algorithms are discussed to ensure safe operation at edge of the NCS which consists of a large number of distributed controllable devices. Several numerical examples are provided to illustrate the proposed control strategies.

96 KNOWLEDGE MANAGEMENT AND PRESERVATION↗

DOE OSTI2023

Topological Analysis of Temporal Hypergraphs

In this work we study the topological properties of temporal hypergraphs. Hypergraphs provide a higher dimensional generalization of a graph that is capable of capturing multi-way connections. As such, they have become an integral part of network science. A common use of hypergraphs is to model events as hyperedges in which the event can involve many elements as nodes. This provides a more complete picture of the event in comparison to the standard dyadic connection limitation of a graph. However, a common attribution to events is temporal information as an interval for when the event occurred. Consequently, a temporal hypergraph is born which accurately captures both the temporal information of events as well as their multi-way connections. Common tools for studying these temporal hypergraphs typically use summary statistics of snapshots from a sliding window procedure to capture changes in the underlying dynamics. However, these do not provide insight into how the changing structure of the hypergraph evolves and which components of the temporal hypergraph persist and are influential to the underlying system. To alleviate this need we leverage zigzag persistence from the field of Topological Data Analysis (TDA) to study the change in topological structure of time-evolving hypergraphs. We apply our pipeline to both a cyber security and social network dataset and show how the topological structure of their temporal hypergraphs change and can be used to understand the underlying dynamics.

hypergraphs, topological data analysis, zigzag per↗

DOE OSTI2025

An End-to-End Framework for Verifying and Validating Manufacturing Design Integrity

Cyber attacks on networked automated manufacturing systems can severely impact part quality. In fact, malicious modifications may be introduced at any point during the manufacturing lifecycle. Therefore, it is vital to verify and validate that manufactured parts conform to their designs. This chapter describes a formal, end-to-end framework that verifies and validates the design integrity of manufactured parts by considering all potential points of alteration during precision manufacturing processes. The framework prevents unauthorized changes to computer-aided designs, verifies the correctness of translations from CAD models to G-code, maintains the integrity of G-code transferred to manufacturing machines, verifies the runtime execution of G-code and part geometry, and considers the contexts of manufacturing machine operations and how manufactured parts could be altered.

Jablonski, Matthew [Cybersecurity Manufacturing In↗

DOE OSTI2025

Automated Programmable Logic Controller Memory Forensics Using RGB Image Analysis and Deep Learning

The introduction of Industry 4.0 and Internet-based technologies has enhanced industrial control system operations but have inadvertently increased their vulnerabilities to cyber attacks. When an industrial control system is compromised, security analysts need to identify the root cause quickly to start the recovery process and develop mitigation strategies. Memory forensics is critical in the incident analysis process to ascertain what occurred. Approaches for analyzing the persistent memory in industrial control devices are limited and almost nonexistent for volatile memory. This chapter proposes an automated methodology for programmable logic controller memory dump analysis using computer vision and deep learning techniques. The methodology converts the sequences of bytes in a programmable logic controller memory dump to red-green-blue pixels and employs a deep learning model that learns the underlying patterns and features of pre-labeled forensic artifacts in images and segments them into distinct regions. The trained model is employed to automatically segment new memory images and identify forensic artifacts. Evaluation of the methodology on a Schneider Electric Modicon M221 programmable logic controller under code injection and code modification attacks demonstrates its ability to detect attack artifacts in memory dumps.

Asmar Awad, Rima [ORNL] (ORCID:0000000233407742)↗

DOE OSTI2022

ThunderSecure: deploying real-time intrusion detection for 100G research networks by leveraging stream-based features and one-class classification network

Nowadays, data generated by large-scale scientific experiments are on the scale of petabytes per month. These data are transferred through dedicated high-bandwidth networks (40/100G) across distributed sites for processing, storage, and analysis. Like general purpose networks, research networks experience intrusions. However, monitoring anomalies in such high-speed network traffics is challenging given current cyber-infrastructure. Moreover, traditional network intrusion detection systems (NIDS) are signature based. However, anomaly patterns are difficult to define and that rulesets are often not updated frequently enough to reflect the changes of attack behaviors. We present ThunderSecure, a high-throughput, unsupervised learning-based intrusions detection system for 100G research networks. ThunderSecure implements an efficient packet processing and detection pipeline using multi-cores and GPUs. It extracts statistical and temporal features from real-time network data streams and feeds them to a one-class anomaly detection network. A baseline of normal distribution will be created based on the training observation. Testing traffic deviated from the learned profile will be marked as anomalies. We trained ThunderSecure on hundreds of billions of science data packets mirrored from two 100G network connections at Fermi National Accelerator Laboratory. The detection performance was evaluated on traffic captured from the same research network days and weeks after the training with different types of attack flows injected. Results show that ThunderSecure can recognize science data traffic captured long after the training and made nearly certain detection on the segment of the streams where anomalous flows were injected.

100G research network↗

DOE OSTI2022

Microgrid Resilience: A Holistic and Context-Aware Resilience Metric

Microgrids present an effective solution for the coordinated deployment of various distributed energy resources and furthermore provide myriad additional benefits such as resilience, decreased carbon footprint, and reliability to energy consumers and the energy system as a whole. Boosting the resilience of distribution systems is another major benefit of microgrids. This is because they can also serve as a backup power source when the utility grid's operations are interrupted due to either high-probability low-impact events like a component failure or low-probability high-impact events - be it a natural disaster or a planned cyberattack. However, the degree to which any particular system can defend, adapt, and restore normal operation depends on various factors including the type and severity of events to which a microgrid is subjected. These factors, in turn, are dependent on the geographical location of the deployed microgrid as well as the cyber risk profile of the site where the microgrid is operating. Therefore, in this work, we attempt to capture this multi-dimensional interplay of various factors in quantifying the ability of the microgrid to be resilient in these varying aspects. This paper, thus, proposes a customized site-specific quantification of the resilience strength for the individual microgrid's capability to absorb, restore, and adapt to the changing circumstances for sustaining the critical load when a low-probability high-impact event occurs - termed as - context-aware resilience metric. We also present a case study to illustrate the key elements of our integrated analytical approach.

microgrid↗

DOE OSTI2022

Optimizing power system restoration with damaged communications

Utility procedures for power system blackstart and restoration typically assume that energization decisions can be reliably communicated across the grid. In reality, the communications and control network would likely also be affected in power outages, such as those caused by extreme weather events or cyber-attacks. This paper studies the effect of damage to the power system communications and control infrastructure on restoration operations following a blackout. We model the communications infrastructure as a graph, overlaying the power grid, and imposing the requirement that every energized element in the power grid be observable from a control center. We expand on a specialized branch-and-bound algorithm from the literature to optimize the restoration process and devise an initialization heuristic and a rounding heuristic to improve solution speed. We perform numerical experiments on synthetic systems for Illinois and Texas with outages based on a solar flare or hurricane. We compare the results of our specialized branch-and-bound algorithm to the results from (i) the initialization heuristic alone, (ii) a variation of this heuristic that we use as a baseline, and (iii) the restoration optimization for the power system without communications constraints. Here, we find that damage to the communications infrastructure significantly increases the time required to re-energize the grid. Moreover, by simultaneously optimizing communications repairs and grid energization decisions, we are able to re-energize the grid significantly faster than if communications repairs and energization decisions were made independently or with partial coordination, motivating improvements to current industry practice.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2021

Impact of cyberattacks on safety and stability of connected and automated vehicle platoons under lane changes

Connected and automated vehicles (CAVs) offer a huge potential to improve the operations and safety of transportation systems. However, the use of smart devices and communications in CAVs introduce new risks. CAVs would leverage vehicle to vehicle (V2V) and vehicle to infrastructure (V2I) communication, thus providing additional system access points compared to traditional systems. Automation makes these systems more vulnerable and increases the consequences of cyberattacks. This study utilizes an infrastructure-based communication platform consisting of cooperative adaptive cruise control and lane control advisories developed by the authors to perform cyber risk assessment of CAVs. The study emulates three types of cyberattacks (message falsification, dedicated denial of service, and spoofing attacks) in a representative traffic environment consisting of multiple CAV platoons and lane change events to analyze the safety and stability impacts of the cyberattacks. Simulation experiments using VISSIM reveals that traffic stream and CAV string is unstable under all three types of cyberattacks. The worst case is represented by the message falsification attack. Increases in volatility are observed over a no attack case, with variations increasing by an average of 43%–51% along with an increase of over 3000 crash conflicts. Similarly, lane change crash conflicts are observed to be more severe compared to rear end crash conflicts, showing a higher probability of severe injuries. Further, the case of slight cyberattack on a single CAV also creates significant disruption in the traffic stream. Analysis of variance (ANOVA) reveals the statistical significance of the results. Furthermore, these results pave the way for future design of secure systems from a monitoring perspective.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2023

Assessing the Impact of Cybersecurity Attacks on Energy Systems

This paper investigates the cyber resiliency of future power systems with high penetration of distributed energy resources using advanced distributed and (or) hierarchical control architectures. Specifically, we simulate cyberattacks on three prototypical use cases, and we identify attack scenarios that are the most damaging to the overall system performance. We show that these attacks can have a significant impact on grid operation. Results provide additional insights into the robustness of the system to the most common cyberattacks.

buildings↗

DOE OSTI2024

Physics-informed graphical neural network for power system state estimation

State estimation is highly critical for accurately observing the dynamic behavior of the power grids and minimizing risks from cyber threats. However, existing state estimation methods encounter challenges in accurately capturing power system dynamics, primarily because of limitations in encoding the grid topology and sparse measurements. Here, this paper proposes a physics-informed graphical learning state estimation method to address these limitations by leveraging both domain physical knowledge and a graph neural network (GNN). We employ a GNN architecture that can handle the graph-structured data of power systems more effectively than traditional data-driven methods. The physics-based knowledge is constructed from the branch current formulation, making the approach adaptable to both transmission and distribution systems. The validation results of three IEEE test systems show that the proposed method can achieve lower mean square error more than 20% than the conventional methods.

43 PARTICLE ACCELERATORS↗

DOE OSTI2021

Industrial control system device classification using network traffic features and neural network embeddings

Characterization of modern cyber–physical Industrial Control System (ICS) devices is critical to the evaluation of their security posture and an understanding of the underlying industrial processes with which they interact. In this work, we address two related ICS device identification tasks: (1) separating ICS from non-ICS devices and (2) identifying specific ICS device types. We propose two distinct methods (one based on the existing IP2Vec method, and a novel traffic-features-based method) for achieving the first task. For transferability of the first task between two datasets, the traffic-features-based method performs significantly better (75% overall accuracy) compared to IP2Vec (22.5% overall accuracy). We further propose a novel method called DNP2Vec to address the second task. DNP2Vec is evaluated on two different datasets and achieves perfect multi-class classification accuracy (100%) for both datasets.

42 ENGINEERING↗