Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Cyber security”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 1,243 records · Page 69

Enhancing Automotive Intrusion Detection Through Multi-Modal Fusion: A CAN FD-LiDAR Approach

As vehicles become smarter and more autonomous, they increasingly depend on advanced sensors and communication technologies to operate securely. However, such growing dependence on technology—whether it’s CAN (Controller Area Network) for internal communication or LiDAR (Light Detection and Ranging) for sensing the world around them—also expands the attack surface for the types of cyber attacks. Traditional intrusion detection systems (IDS) typically monitor these systems in isolation, limiting their ability to detect sophisticated, crosssystem attacks. To address this, we propose a multi-modal fusion approach that combines real-world CAN FD signals (from the HCRL dataset) with LiDAR features (from the nuScenes dataset) to enhance attack detection. Our method employs a twostage ensemble approach. Calibrated XGBoost and LightGBM models initially process CAN FD (Fuzzing Data) and LiDAR data independently, detecting timing anomalies and space abnormalities. They are subsequently logarithmically combined with a logistic regression meta-model along with 17 engineered features capturing cross-modal behavior, prediction conflicts, and nonlinear interactions. This approach achieves an AUC of 0.87 and an F1-score of 0.82, surpassing single-modality baselines and early fusion methods, at merely 2 ms inference latency. Compared with deep learning competitors, it is 3 times more efficient, providing a lightweight, interpretable, and real time solution to automotive cybersecurity.

97 MATHEMATICS AND COMPUTING↗

INL Control System Situational Awareness Technology Final Report 2013

The Situational Awareness project is a comprehensive undertaking of Idaho National Laboratory (INL) in an effort to produce technologies capable of defending the country’s energy sector infrastructure from cyber-attack. INL has addressed this challenge through research and development of an interoperable suite of tools that safeguard critical energy sector infrastructure. The technologies in this project include the Sophia Tool, Mesh Mapper (MM) Tool, Intelligent Cyber Sensor (ICS) Tool, and Data Fusion Tool (DFT). Each is designed to function effectively on its own, or they can be integrated in a variety of customized configurations based on the end user’s risk profile and security needs.

24 POWER TRANSMISSION AND DISTRIBUTION↗

Risk Assessment at the Edge: Applying NERC CIP to Aggregated Grid-Edge Resources

Distributed energy resources (DERs) promise to deliver benefits for both utilities and consumers by dynamically interoperating utility systems with customer-owned grid-edge technologies. These small energy-consuming devices are increasingly being aggregated for participation in grid markets, planning and operations. A cyber attack penetrating the control system of aggregated DERs could negatively impact the operation of the grid. In the worst case, the power grid could be severely damaged and physical safety compromised. In this paper we analyze cybersecurity risks associated with the aggregation of DERs and develop an approach to mitigating that risk. The approaches to both cyber risk analysis and mitigation were developed during a recent research project that serves as an example of how the approaches could be applied. However, both the risk analysis and mitigation are applicable to the broader domain of all DERs. An important conclusion is that the successful cyber compromise of aggregated DERs could have a significant impact on the bulk power system. This is the case even if each individual DER falls below the threshold of compliance with bulk-grid cybersecurity standards. For this reason, we specifically investigate how National Electricity Reliability Corporation's Critical Infrastructure Protection requirements could flow down to interactions between DER aggregators and the DERs themselves in order to protect the grid from these bulk-scale cyber attack impacts.

24 POWER TRANSMISSION AND DISTRIBUTION↗

Pulsar Based Timing for Grid Synchronization

Existing synchronization systems in the power grid, such as the global positioning system, are susceptible to temporary or permanent failures due to various unpredictable and uncontrollable factors such as cyber-attack and electromagnetic interferences, thus affecting the accuracy and reliability of generated timing signal. In this article, a pulsar astronomy-based timing system is proposed to provide an alternative synchronization signal. Further, this clock will offer significant security improvements to power grid applications, such as a wide-area monitoring system, which depends on a precise timing signal. The hardware and software frameworks are described in detail. First, a high-speed sampling hardware platform is designed to collect signals from radio telescopes. Then a periodic pulse extraction method with three steps is proposed to process the pulsar signal, including polyphase filterbanks, incoherent de-dispersion, and sliding window folding. Lastly, three experiments are conducted to verify the effectiveness of the frameworks. The generated pulsar timing pulse is presented, and the factors affecting its accuracy are also discussed. The analysis results demonstrate that the pulsar signals can provide high-accurate timing pulses for grid synchronization.

24 POWER TRANSMISSION AND DISTRIBUTION↗

Water Network Tool for Resilience (WNTR) User Manual

Drinking water systems face multiple challenges, including aging infrastructure, water quality concerns, uncertainty in supply and demand, natural disasters, environmental emergencies, and cyber and terrorist attacks. All of these have the potential to disrupt a large portion of a water system causing damage to infrastructure and outages to customers. Increasing resilience to these types of hazards is essential to improving water security. As one of the United States (US) sixteen critical infrastructure sectors, drinking water is a national priority. The National Infrastructure Advisory Council defined infrastructure resilience as “the ability to reduce the magnitude and/or duration of disruptive events. The effectiveness of a resilient infrastructure or enterprise depends upon its ability to anticipate, absorb, adapt to, and/or rapidly recover from a potentially disruptive event”. Being able to predict how drinking water systems will perform during disruptive incidents and understanding how to best absorb, recover from, and more successfully adapt to such incidents can help enhance resilience.

54 ENVIRONMENTAL SCIENCES↗

General Requirements for Designing and Implementing a Cryptography Module for Distributed Energy Resource (DER) Systems

Penetration of distributed energy resources (DERs) is rapidly increasing in the bulk power system (BPS); they are growing to be a significant portion of generation. As such, grid-support capabilities are being developed and implemented; IEEE Std. 1547 mandates new interconnection and interoperability standards to achieve these capabilities and allow remote users to change behaviors to many devices. However, as their presence increases, the impact of DERs on the BPS also increases. Therefore, if a disturbance occurs in the DER system, its effects could propagate throughout the BPS. These disturbances could range from equipment malfunctions to resource variability to cyber attacks. This document will discuss general requirements needed for developing a distributed cryptography module for implementation in DER systems. First, we will examine the composition of DER systems in Section 2. Procedures to identify critical assets and the security of DERs is discussed in Section 3. Section 4 introduces cryptography concepts and Section 5 discusses implementation needs and options. Finally, practical considerations are provided in Section 6 and conclusions are provided in Section 7.

24 POWER TRANSMISSION AND DISTRIBUTION↗

Cyber100 Compass User Guide

This document provides an overview of the Cyber100 Compass tool and serves as a guide to users interested in understanding the cybersecurity risks facing their clean energy transition. The National Renewable Energy Laboratory (NREL) developed the Cyber100 Compass tool for cyber risk assessment at the system-of-systems level for system planners trying to reach high levels of renewables. Two offices of the U.S. Department of Energy (DOE) - the Office of Electricity and the Office of Cybersecurity, Energy Security, and Emergency Response-funded NREL to develop this framework that will enable grid system planners to understand and mitigate cybersecurity risk for grids transitioning to high levels of renewable generation, including 100%. Cyber100 Compass can help systems planners apply the principle of security-by-design at scale. Investing in an upfront understanding of system-of-systems (where the constituent systems are operating entities of the different renewable resources) risks from high-renewable grids will result in a more resilient grid at a lower long-term cost.

24 POWER TRANSMISSION AND DISTRIBUTION↗

Exploring Multilayer Network Models to Build a Scientific Basis for Integrated Deterrence: Final Report

The emerging multipolar international security environment represents a fundamental restructuring of global nuclear balance of power to include two nuclear peer competitors, growing non-peer nuclear threats, and concerns of nuclear latency from both allies and adversaries. Conflicts in the grey zone, cyber operations, mis- and disinformation campaigns, and emerging disruptive technologies like drones, and hypersonic missiles are becoming more prevalent. These present a risk of cross-domain and multi-domain conflicts that may not follow known escalatory patterns. In order to prepare for the new deterrence environment, it is critical to have quantitative and qualitative understandings of these cross-domain conflicts, their potential for escalation, and which systems they may impact. To that end, our team created a Multi-Layer Network (MLN) model of ‘integrated deterrence’ where instruments of national power are modeled as individual network graph layers that include efforts from all domains. We then evaluate the potential for escalation against escalation scenarios. Analysis of the escalation scenarios is then used to identify insights of potential risk and escalation within integrated deterrence.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

Automated Behavior Analysis of Malware: A Case Study of WannaCry Ransomware

Ransomware, a class of self-propagating malware that uses encryption to hold the victims’ data ransom, has emerged in recent years as one of the most dangerous cyber threats, with widespread damage; e.g., zero-day ransomware WannaCry has caused world-wide catastrophe, from knocking U.K. National Health Service hospitals offline to shutting down a Honda Motor Company in Japan [1]. Our close collaboration with security operations of large enterprises reveals that defense against ransomware relies on tedious analysis from high-volume systems logs of the first few infections. Sandbox analysis of freshly captured malware is also commonplace in operation. We introduce a method to identify and rank the most discriminating ransomware features from a set of ambient (non-attack) system logs and at least one log stream containing both ambient and ransomware behavior. These ranked features reveal a set of malware actions that are produced automatically from system logs, and can help automate tedious manual analysis. We test our approach using WannaCry and two polymorphic samples by producing logs with Cuckoo Sandbox during both ambient, and ambient plus ransomware executions. Our goal is to extract the features of the malware from the logs with only knowledge that malware was present. We compare outputs with a detailed analysis of WannaCry allowing validation of the algorithm’s feature extraction and provide analysis of the method’s robustness to variations of input data—changing quality/quantity of ambient data and testing polymorphic ransomware. Most notably, our patterns are accurate and unwavering when generated from polymorphic WannaCry copies, on which 63 (of 63 tested) antivirus (AV) products fail.

Chen, Qian↗

Security Enhancements for Distributed Energy Resource Systems Interconnected with Distribution Networks: Final Technical Report

The revised IEEE 1547 Standard defines new complex communication-adjustable voltage and frequency regulation and ride-through characteristics, while maintaining the general antiislanding requirement for unintentional islanding situations. Unintentional islanding is prohibited while intentional islanding is specifically allowed, thus effectively enabling microgrid operation mode. Further, IEEE 1547-2018 Standard introduces new requirements in terms of interoperability so that the DER plant/circuit segments may be seamlessly integrated with the utility networks but at the same time become vulnerable to a cyber-attack. Traditional cybersecurity measures including encryption, authentication and role-based access control may not be fully implementable to all communication protocols specified in the IEEE 1547 Standard. Therefore, in this project we have identified, researched, implemented and tested several cyberphysical approaches that rely mostly on the behavior of the DER circuit and may help with validating the incoming command and control action potentially coming through an insecure communications channel. Additionally, we have built semantic models and communications profiles for DER facilities and have implemented lightweight IEC 61850 based publisher-subscriber GOOSE messaging mechanism, with security extensions in terms of authentication and encryption. The project proposed information models for integration into UCA OpenFMB 2.0 profiles focusing on grid code compliance.

24 POWER TRANSMISSION AND DISTRIBUTION↗

Recommended Functionalities for Improving Cybersecurity of Distributed Energy Resources

The current electric grid is transitioning through increasing penetration of distributed energy resources (DERs), which include intermittent renewable generation resources on the distribution side. Both the monitoring and control of DERs require extensive data-exchange and communication networks. These networks lead to cyber vulnerabilities and risks of new kinds of cyberattacks that may be extremely destructive for power system operations. Although current standards, such as IEEE Std. 1547-2018, do not discuss cybersecurity measures for DERs, cybersecurity controls should be developed for securing DER systems at the device level, communications level, and applications level. This paper discusses the current industry's best practices related to DER cybersecurity and proposes recommended functionalities for improving the cybersecurity posture of DERs, specifically at the device/distribution level. These practical recommendations have been discussed and verified with the industry through a DER cybersecurity working group.

24 POWER TRANSMISSION AND DISTRIBUTION↗

EV Everywhere Sandia Appendix

Sandia National Laboratories has a large cybersecurity research program supporting the Department of Energy as well as other federal departments and agencies. Fundamental research helps us stay ahead of threats. Sandia’s research efforts in cybersecurity are focused in three broad areas: 1. Trusted hardware, software, and systems 2. Networks and systems architectures and analysis 3. Effective cyber defense systems Research is conducted in state-of-the-art facilities with extensive computing and information science capabilities, which range from architectures and algorithms to advanced modeling and simulation. Three areas of active research most applicable to connected vehicle security are: Red Team Assessments, Emulytics™, and Supply Chain Risk Management.

97 MATHEMATICS AND COMPUTING↗

Bayesian Attack Model (BAM) User Story

This document presents a user story for the Bayesian Attack Model (BAM) tool designed to aggregate and analyze cyber-attack observables for operational technology (OT) systems. BAM aims to empower cybersecurity analysts by providing a streamlined interface for collecting observable data from various sources, enabling real-time analysis of potential adversary activity. By enhancing the response capabilities of security teams, BAM facilitates risk-informed decision-making and improves organizational security posture. This user story outlines the key functionalities, user interactions, and requirements necessary to successfully integrate BAM with other security information and event management (SIEM) technology and cybersecurity operations centers (CSOCs).

97 MATHEMATICS AND COMPUTING↗

A Game-Theoretic Approach to Modeling Attacks and Defenses of Smart Grids at Three Levels

As optimization, user capabilities, and data-taking abilities are incorporated into next-generation power grids, or smart grids, they face cyber threats. The traditional electrical grid could only be damaged by physical attacks; however thesmart grid can suffer remote/cyber attacks, which have not been studied extensively in the literature. The electrical grid forms the backbone of the modern society and its security has significant implications in military settings. This paper applies game theory to model three-levels (power plants, transmission, and distribution networks) of defenses and attacks in smart grid network security. We characterize both the attacker and the defender (who interact at three network levels: distribution, transmission, and power plants) best responses and equilibrium strategies. We find that the defender's best response is not only a function of direct attacks but also of the spread from connected networks. Sensitivity analyses of the equilibrium strategies show that when success probability of an attack against power plantsreaches a threshold, the defender increases defending efforts for power plants. In contrast, the attack eort at all levels is not affected by this probability. This paper provides some novel insights to modeling and analyzing the emerging threats to the growing smart grid networks.

Rao, Nageswara S.↗

Guided Resilience Self Assessment Application

Reliable electricity access is vital for everything from hospitals to national security. When grid disturbances occur, it is crucial to minimize the amount of time it takes to recover. Grid resiliency considers both the preparation for and recovery from high-impact low-frequency disturbances (HILF) such as weather events and cyber attacks. The Department of Energy (DOE) Wind Energy Technologies Office (WETO) funds the multi-laboratory Microgrids, Infrastructure Resilience, and Advanced Control Launchpad (MIRACL) project to investigate technologies to support and grow distributed wind. Researchers at Idaho National Laboratory (INL) contribute to resilience and cybersecurity efforts for the project, and have produced a resilience framework to evaluate system resilience based on individual system specifications. In order to make this framework easy for anyone to apply, I have coded a web application that allows users to input their power system qualities, goals, and perceived risks and then receive suggestions on how to improve their grid resiliency. The web application follows the seven steps in the planning stage of the framework process, allowing the user to input information about their grid and select from common goals, metrics, and hazards, as well as add their own. The application currently provides information about how to complete each step, requiring minimal prior knowledge of the framework. Future work for this application will include allowing the user to submit line drawings of their system and incorporate modeling tools so that the hazard simulations of applying the framework is completed for the user.

97 MATHEMATICS AND COMPUTING↗

Demystifying Cyberattacks: Potential for Securing Energy Systems With Explainable AI : Preprint

Modernization of energy systems has led to in- creased interactions among multiple critical infrastructures and diverse stakeholders making the challenge of operational decision making more complex and at times beyond cognitive capabilities of human operators. The state-of-the-art machine learning and deep learning approaches show promise of supporting users with complex decision-making challenges, such as those occurring in our rapidly transforming cyber-physical energy systems. However, successful adoption of data-driven decision support technology for critical infrastructure will be dependent on the ability of these technologies to be trustworthy and contextually interpretable. In this paper, we investigate the feasibility of implementing XAI for interpretable detection of cyberattacks in the energy system. Leveraging a proof-of-concept simulation use case of detection of a data falsification attack on a photovoltaic system using XGBoost algorithm, we demonstrate how Local Interpretable Model-Agnostic Explanations (LIME), a flavor XAI approach, can help provide contextual and actionable interpretation of cyberattack detection.

artificial intelligence↗

An Assessment of the Usability of Machine Learning Based Tools for the Security Operations Center

Gartner, a large research and advisory company, anticipates that by 2024 80% of security operation centers (SOCs) will use machine learning (ML) based solutions to enhance their operations. 1 1 https://www.ciodive.com/news/how-data-science-tools-can-lighten-the-load-for-cybersecurity-teams/572209/ In light of such widespread adoption, it is vital for the research community to identify and address usability concerns. This work presents the results of the first in situ usability assessment of ML-based tools. With the support of the US Navy, we leveraged the national cyber range-a large, air-gapped cyber testbed equipped with state-of-the-art network and user emulation capabilities-to study six US Naval SOC analysts' usage of two tools. Our analysis identified several serious usability issues, including multiple violations of established usability heuristics for user interface design. We also discovered that analysts lacked a clear mental model of how these tools generate scores, resulting in mistrust a and/or misuse of the tools themselves. Surprisingly, we found no correlation between analysts' level of education or years of experience and their performance with either tool, suggesting that other factors such as prior background knowledge or personality play a significant role in ML-based tool usage. Our findings demonstrate that ML-based security tool vendors must put a renewed focus on working with analysts, both experienced and inexperienced, to ensure that their systems are usable and useful in real-world security operations settings.

Oesch, T↗

CARILEC Resilient Energy Community CoP for Cybersecurity Workshop Series: Cybersecurity Assessment Tools [Slides]

For the last several years and in collaboration with CARILEC, USAID and NREL have been working to support cyber resilience at power sector utilities in Latin America and the Caribbean. Direct technical assistance with regional utilities has been a key component of USAID-NREL Partnership activities, and technical assistance has typically included a foundational cybersecurity assessment using NREL's Distributed Energy Resource Cybersecurity Framework (DER-CF) tool. The DER-CF allows organizations to benchmark and evaluate their cybersecurity posture across the areas of Governance, Technical Management, and Physical Security. To complement the activities of the newly created CAREC IT/OT and Cybersecurity Team, this webinar on cybersecurity assessment tools includes an overview of the DER-CF tool and a discussion with regional stakeholders and NREL experts on the DER-CF assessment process and other resources for cybersecurity assessments.

24 POWER TRANSMISSION AND DISTRIBUTION↗