Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “MALWARE”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 127 records · Page 7
All sourcesNASA NTRSDOE OSTI
DOE OSTI2019

A Multidimensional Holistic Framework for the Security of Distributed Energy and Control Systems

The digitization of smart grid distributed generation and industrial control systems has prompted utilities to deploy tools with ubiquitous communications that potentially widen the attack surface. The utilities still continue to rely on the traditional cybersecurity technologies, such as firewalls, anti-malware tools, and passwords that do not ensure security across all dimensions of the information assurance model required for a strong cybersecurity business process. This paper proposes a multidimensional holistic framework that addresses this gap through advanced technologies, intelligent algorithms, and continued assessments. To show proof, the layered defense model, a solution dimension of the framework, is integrated into the National Renewable Energy Laboratory's Security and Resilience Testbed to replicate a utility's enterprise and substation networks. The model is used to evaluate the security and resilience of microgrid control systems, and, based on the insights gathered, recommend best practices for utility cybersecurity analysts for a strong business process. Here, with this baseline, the paper conceptually introduces intelligence-driven solutions comprising contextual data analysis and machine learning to respond to advanced persistent threats sponsored by campaign efforts.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2017

Pattern Discovery in Internet Background Radiation

Internet Background Radiation (IBR) is observed in empty network address spaces. No traffic should arrive there, but it does in overwhelming quantities, gathering evidences of attacks, malwares and misconfigurations. The study of IBR helps to detect spreading network problems, common vulnerabilities and attack trends. However, network traffic data evolves quickly and is of high volume and diversity, i.e., an outstanding big data challenge. When used to assist network security, it also requires the online classification of dynamic streaming data. In this paper, we introduce an AGgregation & Mode (AGM) vector to represent network traffic. The AGM format characterizes IP hosts by extracting aggregated and mode values of IP header fields, and without inspecting payloads. We performed clustering and statistical analysis to explore six months of IBR from 2012 with the AGM mapping. The discovered patterns allow building a classification of IBR, which identifies phenomena that have been actively polluting the Internet for years. The AGM representation is light and tailored for monitoring and pattern discovery. We show that AGM vectors are suitable to analyze large volumes of network traffic: they capture permanent operations, such as long term scanning, as well as bursty events from targeted attacks and short term incidents.

Iglesias, Felix↗
DOE OSTI2017

Akatosh: Automated Cyber Incident Verification and Impact Analysis

Akatosh, a U.S. Department of Homeland Security Transition to Practice Program (TTP) project developed by Oak Ridge National Laboratory with industry and academic partnership, enables automated, real-time forensic analysis of endpoints after malware-attacks and other cyber security incidents by automatically maintaining detailed snapshots of host-level activity on endpoints over time. It achieves this by integrating intrusion detection systems (IDS) with forensic tools. The combination allows Akatosh to collect vast amounts of endpoint data and assists in verifying, tracking, and analyzing endpoints in real time. This provides operations personnel and analysts as well as managers and executives with continuous feedback on the impact of malicious software and other security incidents on endpoints in their network.

Smith, Jared M.↗
DOE OSTI2018

Recurrent Neural Network Attention Mechanisms for Interpretable System Log Anomaly Detection

Deep learning has recently demonstrated state-of-the art performance on key tasks related to the maintenance of computer systems, such as intrusion detection, denial of service attack detection, hardware and software system failures, and malware detection. In these contexts, model interpretability is vital for administrator and analyst to trust and act on the automated analysis of machine learning models. Deep learning methods have been criticized as black box oracles which allow limited insight into decision factors. In this work we seek to "bridge the gap'' between the impressive performance of deep learning models and the need for interpretable model introspection. To this end we present recurrent neural network (RNN) language models augmented with attention for anomaly detection in system logs. Our methods are generally applicable to any computer system and logging source. By incorporating attention variants into our RNN language models we create opportunities for model introspection and analysis without sacrificing state-of-the art performance. We demonstrate model performance and illustrate model interpretability on an intrusion detection task using the Los Alamos National Laboratory (LANL) cyber security dataset, reporting upward of 0.99 area under the receiver operator characteristic curve despite being trained only on a single day's worth of data.

Anomaly detection, Attention, Recurrent Neural Net↗
DOE OSTI2018

Tools, Techniques, and Methodologies: A Survey of Digital Forensics for SCADA Systems

Security aspects of SCADA environments and the systems within are increasingly a center of interest to researchers and security professionals. As the rise of sophisticated and nation-state malware targeting such systems flourishes, traditional digital forensics tools struggle to transfer the same capabilities to systems lacking typical volatile memory primitives, monitoring software, and the compatible operating-system primitives necessary for conducting forensic investigations. Even worse, SCADA systems are typically not designed and implemented with security in mind, nor were they purpose-built to monitor and record system data at the granularity associated with traditional IT systems. Rather, these systems are often built to control field devices and drive industrial processes. More succinctly, SCADA systems were not designed with a primary goal of interacting with the digital world. Consequently, forensics investigators well-versed in the world of digital forensics and incident response face an array of challenges that prevent them from conducting effective forensic investigation in environments with vast amounts of critical infrastructure. In order to bring SCADA systems within the reach of the armies of digital forensics professionals and tooling already available, both researchers and practitioners need a guide to the current state-of-the-art techniques, a road-map to the challenges lying on the path forward, and insight into the future directions R&D must move towards. To that end, this paper presents a survey into the literature on digital forensics applied to SCADA systems. We cover not only the challenges to applying digital forensics to SCADA like most other reviews, but also the range of proposed frameworks, methodologies, and actual implementations in literature.

Asmar Awad, Rima↗
DOE OSTI2021

Metagames and Hypergames for Deception-Robust Control

Cyber-physical systems (CPSs) consist of computing and communication devices integrated with physical components such as sensors and actuators. Increasing connectivity to the Internet for remote monitoring and control has made CPSs more vulnerable to deliberate attacks, which are distinctly different from random perturbations in the system. This provides a way for purely cyber attacks to have physical consequences. Stuxnet is a prominent example of such an attack, one in which the malware acted over an extended period of time while deliberately remaining undetected. Such attacks can be described as Advanced Persistent Threats (APTs) -- long-term, stealthy attacks. Here, we extend our previous work on hypergames to develop defender strategies that are robust to deception and do not rely on attack detection. We prove that the defender can bound the attacker payoff with these strategies even when the attacker can choose between different attack modes, and we numerically demonstrate our approach on a realistic building control system. Finally, we discuss next steps in extending this approach towards an operational capability.

hypergames, cyber-physical systems, robust control↗
DOE OSTI2023

Accelerating Random Forest Classification on GPU and FPGA

Random Forests (RFs) are a commonly used machine learning method for classification and regression tasks spanning a variety of application domains, including bioinformatics, business analytics, and software optimization. While prior work has focused primarily on improving performance of the training of RFs, many applications, such as malware identification, cancer prediction, and banking fraud detection, require fast RF classification. In this work, we accelerate RF classification on GPU and FPGA. In order to provide efficient support for large datasets, we propose a hierarchical memory layout suitable to the GPU/FPGA memory hierarchy. We design three RF classification code variants based on that layout, and we investigate GPU- and FPGA-specific considerations for these kernels. Our experimental evaluation, performed on an Nvidia Xp GPU and on a Xilinx Alveo U250 FPGA accelerator card using publicly available datasets on the scale of millions of samples and tens of features, covers various aspects. First, we evaluate the performance benefits of our hierarchical data structure over the standard compressed sparse row (CSR) format. Second, we compare our GPU implementation with cuML, a machine learning library targeting Nvidia GPUs. Third, we explore the performance/accuracy tradeoff resulting from the use of different tree depths in the RF. Finally, we perform a comparative performance analysis of our GPU and FPGA implementations. Our evaluation shows that for high accuracy targets, our GPU implementation yields 5-9x speedup over CSR, and up to a 2x speedup over cuML.

FPGA, Xilinx FPGA, GPU, Random Forest classificati↗
DOE OSTI2022

Binary Driller

Binary Driller (BD) is a visualization tool which uses the data produced from the Troglodyte tool developed on the Deep Learning Malware project. Binary Driller performs function matching using the provided function embeddings (function representations), then displays the matches for each function in a layout that mimics the location of each function within the binary.

Cutsha, Michael↗
DOE OSTI2025

OGhidra

This is an AI driven Binary Analysis tool. It uses locally hosted Agentic AI's to automatically reverse engineer binaries to find malware and vulnerabilities.

Wang, Enoch↗
DOE OSTI2015

UVI Cyber-security Workshop Workshop Analysis.

The cybersecurity consortium, which was established by DOE/NNSA’s Minority Serving Institutions Partnerships Program (MSIPP), allows students from any of the partner schools (13 HBCUs, two national laboratories, and a public school district) to have all consortia options available to them, to create career paths and to open doors to DOE sites and facilities to student members of the consortium. As a part of this year consortium activities, Sandia National Laboratories and the University of Virgin Islands conducted a week long cyber workshop that consisted of three courses; Digital Forensics and Malware Analysis, Python Programming, and ThunderBird Cup. These courses are designed to enhance cyber defense skills and promote learning within STEM related fields.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2016

Watchdog Project

The Watchdog Project completed 100% of the project Statement of Project Objective (SOPO). The Watchdog project was a very aggressive project looking to accomplish commercialization of technology that had never been commercialized, as a result it took six years to complete not the original three that were planned. No additional federal funds were requested from the original proposal and SEL contributed the additional cost share required to complete the project. The result of the Watchdog Project is the world’s first industrial rated Software Defined Network (SDN) switch commercially available. This technology achieved the SOPOO and DOE Roadmap goals to have strong network access control, improve reliability and network performance, and give the asset owner the ability to minimize attack surface before and during an attack. The Watchdog project is an alliance between CenterPoint Energy Houston Electric, Pacific Northwest National Laboratories (PNNL), and Schweitzer Engineering Laboratories, Inc. (SEL). SEL is the world’s leader in microprocessor-based electronic equipment for protecting electric power systems. PNNL performs basic and applied research to deliver energy, environmental, and national security for our nation. CenterPoint Energy is the third largest publicly traded natural gas delivery company in the U.S and third largest combined electricity and natural gas delivery company. The Watchdog Project efforts were combined with the SDN Project efforts to produce the entire SDN system solution for the critical infrastructure. The Watchdog project addresses Topic Area of Interest 5: Secure Communications, for the DEFOA- 0000359 by protecting the control system local area network itself and the communications coming from and going to the electronic devices on the local network. Local area networks usually are not routed and have little or no filtering capabilities. Combine this with the fact control system protocols are designed with inherent trust the control system owners have very little choice on how to protect communications on the local network. The Watchdog project reduces security risks in electric sector control system local area networks (LANs) by providing: Network access control (NAC) Multi-Layer firewall (physical through transport layer) Containment of malware or unauthorized traffic spreading across the network White list protocols and application message types filtering Configurable, proactive traffic engineering The Watchdog project achieved all of the above by developing an SDN switch.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2017

After Action Report: Idaho National Laboratory Continuity of Operations Program 2017 Exercise September 26, 2017

On September 26, 2017, the Battelle Energy Alliance, LLC (BEA) Continuity of Operations Program (COOP) conducted an annual exercise to demonstrate the COOP responder’s ability to maintain COOP’s primary mission essential function (PMEF) and essential supporting activities (ESAs) during a national loss of commercial power caused by a malware attack to the United States power grid. The continuity emergency management team (CEMT) and continuity emergency response group (CERG) responded to CERG notifications and worked through simulated challenges, using COOP’s 3-D scenario visualization tool (3DSVT), that challenged COOP’s PMEF, essential support activities (ESAs), and impacted mission critical personnel’s human capital. The PMEF and ESAs were successfully maintained as the CERG developed incident action plans through several phases of the scenario, addressing appropriate needs, concerns and strategic planning.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2018

Intel x86 Assembly

These slides will be used to teach malware analysis at various training events.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2020

Dragonstone Strategy – State of Cybersecurity in the Oil & Natural Gas Sector

The oil & natural gas (ONG) system touches every corner of the nation and increased communications & control capabilities have not only allowed for greater efficiency of system operation, but have also created a massive target for adversaries to launch cyber-attacks. Like any other heavy industrial process, the ONG system relies on a complex system of information technology (IT) and operational technology (OT) devices. The current state of cyber-preparedness across the ONG industry varies from organization to organization. Among the most common challenges that ONG companies face are remote locations, longlived field assets, and lacking capabilities to find and track malware on their systems. ONG companies tend to be concerned with lack of cyber-awareness from employees, risk stemming from remote access for operations & maintenance, and software vulnerabilities within third-party equipment. Various industry and government organizations are performing research and development activities to address some of these challenges, but in many cases industry stakeholders are not aware of solutions that already exist. It is clear that a need exists for a coherent, comprehensive, multi-layered strategy for assuring the security and resilience of the nation's pipeline infrastructure against cyber threats. For a variety of reasons, the general consensus from stakeholders interviewed by LLNL is that the state of cyber-security within the electric grid is currently outpacing its ONG cousin. Existing strategies for the resilience and cyber-security of the electric grid can and should be leveraged to provide immediate benefits to the ONG system. In LLNL’s view, there are two key factors currently limiting the development of necessary cyber-practices within the ONG industry: The sheer number of differing regulatory bodies and trade groups offering both standards and best-practice recommendations for ONG cyber-security makes it difficult to create a comprehensive, directed, and coherent strategy that is applicable to all players within the ONG industry. The ONG industry is unaware of potentially useful technologies that have been developed for ensuring cyber-security of other infrastructure systems, such as the electric grid. Leveraging these technologies—and the science and engineering behind them—can provide some low-hanging fruit that can greatly improve cyber-security in the ONG industry without significant investments in terms of time and money. In the months following this report, LLNL will continue to perform outreach to key oil & gas industry stakeholders in a continual effort to identify the most pressing cyber-resilience issues in the industry. This outreach will be supplemented with LLNL’s threat intelligence capabilities to begin painting a clearer picture of the overall threat landscape faced by this sector. This assessment will be threat-informed and while the strategy itself will not be classified we will leverage intelligence analysis and adversary capabilities to identify gaps in current cybersecurity practices for oil & gas pipeline systems. Recommended efforts will be compiled into a cyber-resilience roadmap for the oil & gas pipeline sector, in which LLNL will highlight priority activities to immediately improve the state of cyber-resilience in the industry.

02 PETROLEUM↗
DOE OSTI2020

Dragonstone Strategy Kickoff Report [Slides]

The oil & natural gas (ONG) system like any other heavy industrial process, relies on a complex system of information technology (IT) and operational technology (OT) devices. Cyber-preparedness varies across the ONG industry from organization to organization. Common challenges include remote locations, long-lived field assets, and insufficient capabilities to find and track malware. ONG companies tend to be concerned with lack of cyber-awareness from employees, risk stemming from remote access for operations & maintenance, and software vulnerabilities within third-party equipment. For a variety of reasons, the general consensus from stakeholders interviewed by LLNL is that the state of cybersecurity within the electric grid is currently outpacing its ONG cousin. Existing strategies for the resilience and cybersecurity of the electric grid can and should be leveraged to provide immediate benefits to the ONG system. In LLNL’s view, there are two key factors currently limiting the development of necessary cyber-practices within the ONG industry: regulatory overlap and inefficiencies, and lack of industry awareness of potentially useful technologies for solving known issues. In the months following this report, LLNL will develop a cyber-resilience roadmap for the oil & gas pipeline sector, coupling threat intelligence, industry knowledge base, and ongoing outreach

02 PETROLEUM↗
DOE OSTI2021

Review of Intrusion Detection Methods and Tools for Distributed Energy Resources

Recent trends in the growth of distributed energy resources (DER) in the electric grid and newfound malware frameworks that target internet of things (IoT) devices is driving an urgent need for more reliable and effective methods for intrusion detection and prevention. Cybersecurity intrusion detection systems (IDSs) are responsible for detecting threats by monitoring and analyzing network data, which can originate either from networking equipment or end-devices. Creating intrusion detection systems for PV/DER networks is a challenging undertaking because of the diversity of the attack types and intermittency and variability in the data. Distinguishing malicious events from other sources of anomalies or system faults is particularly difficult. New approaches are needed that not only sense anomalies in the power system but also determine causational factors for the detected events. In this report, a range of IDS approaches were summarized along with their pros and cons. Using the review of IDS approaches and subsequent gap analysis for application to DER systems, a preliminary hybrid IDS approach to protect PV/DER communications is formed in the conclusion of this report to inform ongoing and future research regarding the cybersecurity and resilience enhancement of DER systems.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2018

Stucco System

Security event data, such as intrusion detection system alerts, provide a starting point for analysis, but are information impoverished. To provide context, analysts must manually gather and synthesize relevant data from myriad sources within their enterprise and external to it. Analysts search system logs, network flows, and firewall data; they search IP blacklists and reputation lists, software vulnerability information, malware and threat data, OS and application vendor blogs, and news sites. All of these sources are manually searched for data relevant to the event being investigated. Relevant results must then be brought together and synthesized to put the event in context and make decisions about its importance and impact.

42 ENGINEERING↗
DOE OSTI2021

Science and Engineering of Cybersecurity by Uncertainty quantification and Rigorous Experimentation (SECURE) (Final Report)

This report summarizes the activities performed as part of the Science and Engineering of Cybersecurity by Uncertainty quantification and Rigorous Experimentation (SECURE) Grand Challenge LDRD project. We provide an overview of the research done in this project, including work on cyber emulation, uncertainty quantification, and optimization. We present examples of integrated analyses performed on two case studies: a network scanning/detection study and a malware command and control study. We highlight the importance of experimental workflows and list references of papers and presentations developed under this project. We outline lessons learned and suggestions for future work.

97 MATHEMATICS AND COMPUTING↗