Linear Algebra Applications in National Security
Presentation to be given in a mini-symposium for the SIAM Conference on Applied Linear Algebra 2021: https://www.siam.org/conferences/cm/conference/la21
97 MATHEMATICS AND COMPUTING↗
SEARCH · Engineering Papers
Results for “Security Applications”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
METHODOLOGY AND APPLICATION OF PHYSICAL SECURITY EFFECTIVENESS BASED ON DYNAMIC FORCE-ON-FORCE MODELING
This paper describes ongoing work within the Light Water Reactor Sustainability (LWRS) Program at Idaho National Laboratory (INL) to optimize security and cost of nuclear power plants (NPPs). It reviews the conservatisms in conventional physical security posture and regulations. It introduces the dynamic risk assessment tool developed at INL, Event Modeling Risk Assessment using Linked Diagrams (EMRALD). The dynamic assessment methodology leverages EMRALD to process results of force-on-force (FOF) simulations and crediting safety mitigation actions from probabilistic risk assessment (PRA) models as well as diverse and flexible coping strategies (FLEX) mitigation strategies. Timing information from these simulations are compared against the available time to perform mitigations obtained from Reactor Excursion and Leak Analysis Program (RELAP5) simulations. To illustrate the methodology, a station blackout (SBO) attack scenario was modeled in commercially available FOF simulation tools. The simulation results provide valuable insights into possible attack outcomes and as the probabilistic risk of a core damage event given these outcomes. Safety mitigation procedures were modeled in EMRALD, and were dependent on the attack outcomes by considering human operator uncertainties. RELAP5 simulations incorporating human and hardware uncertainties were performed to estimate the distribution of time-to-core damage. The results demonstrate that, even in the extreme case of a successful adversarial attack, plant mitigation strategies provide significantly high-likelihood of preventing radiological release. The proposed modeling and simulation framework of integrating FLEX equipment with FOF models enables the NPPs to credit FLEX portable equipment in the plant security posture, resulting in an efficient and optimized physical security.
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
Evaluating Efficiency and Security of Connected and Autonomous Vehicle Applications
Evaluating efficiency and security of Connected and Autonomous Vehicles (CAVs) requires an environment that can support applications and measurements under real-world conditions. This work introduces our implementation and evaluation of a Connected and Autonomous Vehicle Research Environment (CAVRE). We implement and evaluate an existing CAV application called Cooperative Adaptive Cruise Control (CACC) using physical Vehicle-to-Vehicle (V2V) communications between a virtual agent and a real autonomous vehicle operating on a steerable dynamometer. CAVRE allows the follower to autonomously control longitudinal behavior on the dynamometer in order to maintain a steady following time gap from the leader. The effects of a wireless jamming attack on CACC and fuel efficiency is also evaluated. By executing attacks in a controlled environment, we learn how compromised communications can degrade CAV applications. We show that jamming V2V communications can impact CACC’s string stability and decrease fuel efficiency by more than 50%.
Taylor, Curtis↗
Shifting Left for Machine Learning: An Empirical Study of Security Weaknesses in Supervised Learning-based Projects
Context: Supervised learning-based projects (SLPs), i.e., software projects that use supervised learning algorithms, such as decision trees are useful for performing classification-related tasks. Yet, security weaknesses, such as the use of hard-coded passwords in SLPs, can make SLPs susceptible to security attacks. A characterization of security weaknesses in SLPs can help practitioners understand the security weaknesses that are frequent in SLPs and adopt adequate mitigation strategies. Objective: The goal of this paper is to help practitioners se-curely develop supervised learning-based projects by conducting an empirical study of security weaknesses in supervised learning-based projects. Methodology: We conduct an empirical study by quantifying the frequency of security weaknesses in 278 open source SLPs. Results: We identify 22 types of security weaknesses that occur in SLPs. We observe ‘use of potentially dangerous function’ to be the most frequently occurring security weakness in SLPs. Of the identified 3,964 security weaknesses, 23.79 % and 40.49 % respectively, appear for source code files used to train and test models. We also observe evidence of co-location, e.g., instances of command injection co-locates with instances of potentially dangerous function. Conclusion: Based on our findings, we advocate for a shift left approach for SLP development with security-focused code reviews, and application of security static analysis.
Bhuiyan, Farzana Ahamed↗
Protecting Websites from Cross-Site Scripting (XSS) Attacks: A Novel Configuration using Pulse Secure © Pulse Connect Secure © and Virtual Web Application Firewall (vWAF)
Cross-site scripting (XSS), one of the most prevalent forms of client-side attacks, is when bad actors attempt to access sensitive information from the backend web server and other systems on the backend network. Some XSS attacks attempt to access client-side sensitive information, such as cookies. Web application firewalls (WAFs) are a first line of defense where common Uniform Resource Locator (URL) patterns are analyzed to detect and block known attacks. This paper describes a novel configuration using the Pulse Secure © Pulse Connect Secure © (PCS © ) Secure Socket Layer Virtual Private Network software and Virtual Web Application Firewall (vWAF) that protects a website from XSS attacks. This paper also presents novel aspects of the configuration that control the redirection of traffic through the vWAF and provide fine-grained behavioral control at the application level while decoupling the PCS and vWAF configurations. The intended audience for this paper comprises system and site administrators who are familiar with standard web server environments. These configuration details might prove useful during the design of a more secure infrastructure.
97 MATHEMATICS AND COMPUTING↗
Hot-pressed 6 LiInSe 2 for use as a ceramic radiation detector
Lithium based chalcogenides have many uses in the nuclear science field. 6 LiInSe 2 (or LISe) has been researched extensively because of its ability to operate in both scintillator and semiconductor modes. Here, this makes it useful in applications including nuclear material detection for national security, space applications, and medical imaging. In some applications growth and fabrication costs are of concern, as it takes upwards of 40 days to synthesize a charge, grow a crystal and fabricate a detector. Ceramics are a solution for this long route of preparation. This research shows that using a 6 LiInSe 2 ceramic instead of a single crystal significantly decreases the time required to make a detector. In the present work, ceramic wafers can be formed using a mechanical press equipped with a heating attachment. The resulting ceramic wafer performs very similar to a slow-growth single crystal when used in the scintillator mode.
36 MATERIALS SCIENCE↗
High-Resolution Magnetic Microscopy for Hardware Security and Other Sandia Applications.
Abstract not provided.
Kehayias, Pauli Mark↗
Using Machine Learning to Reduce Safety and Security Risk: The ARMOR Applications
Explore the source record for details and available documents.
Yao, Yun [Sandia National Laboratories (SNL-NM), A↗
Standoff trace explosives vapor detection at meter distances
Vapor detection is a noncontact sampling method, which is a less invasive means of explosives screening than physical swiping. Explosive vapor detection is a challenge due to the low levels of vapors available for detection. This study demonstrates that the parts-per-quadrillion sensitivity of atmospheric flow tube-mass spectrometry (AFT-MS) combined with a high-volume air sampler enables standoff detection of trace explosives vapor at distances of centimeters to meters. Standoff detection of explosives vapor was possible both upstream and downstream of the vapor source relative to room air currents. RDX vapor from a saturated source was detected at up to 2.5 m. Vapors from RDX residue and nitroglycerin residue were detected at distances up to 0.5 m. The sampling can be optimized by accounting for air movement in the room or environment, which could further extend standoff detection distances. In conclusion, using AFT-MS with a high-volume sampler could also be effective for standoff vapor detection of drugs and additional chemical threats and could be useful for security screening applications such as at mail facilities, border crossings, and security checkpoints.
47 OTHER INSTRUMENTATION↗
ModuleOT: A Hardware Security Module for Operational Technology: Preprint
With increasing penetration levels of distributed energy resources (DERs) on the distribution grid, as well as new technological advancements in the cyber space, new cyberattack vectors are being introduced, and the available attack surface is constantly increasing. Despite this increasing risk, the standard IEEE 1547-2018 does not yet recommend cybersecurity measures for DERs. To address this and to better protect data on the distribution grid - from the standpoints information security as well as operational security - ModuleOT has been developed. The module aims to significantly reduce cyberattack vectors by improving data privacy for user applications. This is accomplished by performing the core functions of encryption, authentication, authorization, certificate management, and user access control. The module integrates a custom security application with hardware cryptographic acceleration. The application secures all communications using Transmission Control Protocol over Internet Protocol (TCP/IP). These include the three most commonly used communications protocols for power systems information exchange: Modbus, Distributed Network Protocol 3 (DNP3), and Smart Energy Profile 2.0 (SEP2.0). These three protocols are also supported by IEEE 1547-2018 for all DER devices. This paper tests the data encryption/decryption feature on a physical networking test bed with emulated Modbus devices reporting grid data and presents the results.
24 POWER TRANSMISSION AND DISTRIBUTION↗
A Novel Authentication Management for the Data Security of Smart Grid
Bidirectional wireless communication is employed in various smart grid components such as smart meters and control and monitoring applications where security is vital. The Trusted Third Party (TTP) and wireless connectivity between the smart meter and the third party in the key management-based encryption techniques for the smart grid are expected to be totally trustworthy and dependable. In a wired/wireless medium, however, a man-in-the-middle may seek to disrupt, monitor and manipulate the network, or simply execute a replay attack, revealing its vulnerability. Recognizing this, this study presents a novel authentication management (model) comprised of two layer security schema. The first layer implements an efficient novel encryption method for secure data exchange between meters and control center with the help of two partially trusted simple servers (constitutes the TTP). In this setting, one server handles the data encryption between the meter and control center/central database, and the other server administers the random sequence of data transmission. The second layer monitors and verifies exchanged data packets among smart meters. It detects abnormal packets from suspicious sources. To implement this node-to-node authentication, One class support vector machine algorithm is proposed which takes advantages of the location information as well as the data transmission history (node identification, packet size, and data transmission frequency). This schema secures data communication, and imposes a comprehensive privacy throughout the system without considerably extending the complexity of the conventional key management scheme.
24 POWER TRANSMISSION AND DISTRIBUTION↗
Investigate the Security of Electric Vehicle (EV) Ecosystem Applications
Apps that run on mobile devices are one of critical components of the electric vehicle (EV) ecosystem and pose possible threat actor points of entry that may impact the trust and security of EV charging systems in the future. Mobile apps often rely on communication between cloud servers and users, thereby creating potential points of entry for cyberattacks. Although app stores such as Apple App Store or Google Play Store generally test the security of apps, the cyber aspects may not be sufficient for many entities including DOD, federal fleets, and commercial entities. A more thorough inspection and the ability to influence developers is imminently needed. This research studies security attributes and vulnerabilities of a sample of mobile applications that support key user functions in the EV ecosystem. The study shows that all analyzed apps have security risks, categorized as either high or medium or both and a comprehensive cybersecurity guideline for developing mobile apps is necessary.
33 ADVANCED PROPULSION SYSTEMS↗
Foundations of Rigorous Cyber Experimentation
This report presents the results of the “Foundations of Rigorous Cyber Experimentation” (FORCE) Laboratory Directed Research and Development (LDRD) project. This project is a companion project to the “Science and Engineering of Cyber security through Uncertainty quantification and Rigorous Experimentation” (SECURE) Grand Challenge LDRD project. This project leverages the offline, controlled nature of cyber experimentation technologies in general, and emulation testbeds in particular, to assess how uncertainties in network conditions affect uncertainties in key metrics. We conduct extensive experimentation using a Firewheel emulation-based cyber testbed model of Invisible Internet Project (I2P) networks to understand a de-anonymization attack formerly presented in the literature. Our goals in this analysis are to see if we can leverage emulation testbeds to produce reliably repeatable experimental networks at scale, identify significant parameters influencing experimental results, replicate the previous results, quantify uncertainty associated with the predictions, and apply multi-fidelity techniques to forecast results to real-world network scales. The I2P networks we study are up to three orders of magnitude larger than the networks studied in SECURE and presented additional challenges to identify significant parameters. The key contributions of this project are the application of SECURE techniques such as UQ to a scenario of interest and scaling the SECURE techniques to larger network sizes. This report describes the experimental methods and results of these studies in more detail. In addition, the process of constructing these large-scale experiments tested the limits of the Firewheel emulation-based technologies. Therefore, another contribution of this work is that it informed the Firewheel developers of scaling limitations, which were subsequently corrected.
97 MATHEMATICS AND COMPUTING↗
Simple, Secure, Internet Delivery of MOOSE-based Applications
Application packaging and distribution are the final steps for delivering software to end-users; both are frequently neglected when creating scientific software. Commercial businesses rely on electronic distribution systems that have rendered disk drives obsolete. Still, national laboratories continue to rely heavily on removable media to distribute and limit access to controlled applications. With increasing concerns of unauthorized copying of sensitive applications, a modern distribution system that utilizes cryptographically secure communication and authentication protocols has been developed. This new distribution system will secure the chain of custody for nuclear software while simultaneously simplifying access to these tools. This report summarizes four primary advancements made toward the secure distribution of Nuclear Energy Advanced Modeling and Simulation (NEAMS)-developed, Multiphysics Object Oriented Simulation Environment (MOOSE)-based applications: application installation, package distribution, automated package building, and distribution of documentation. NEAMS is currently developing more than ten separate applications based on the open-source MOOSE Framework. Distribution of these applications has primarily been accomplished by distributing source code, with end-users compiling the applications themselves. This work created a mechanism where MOOSE applications can be installed in a similar way to any other software. This allows both administrators and end-users simplified access to runnable executables. With this new installation capability, it was then possible to rethink distribution. A new, secure capability for delivering MOOSE-based applications over the internet has been created. This system requires unique cryptographic tokens for authentication, greatly securing the custody chain for software. Once granted access, installation of any NEAMS code can be accomplished with these terminal commands: "conda install ncrc" "ncrc install ncrc-bison." After these two commands (and authenticating) the BISON application will be securely down- loaded from Idaho National Laboratory (INL)’s servers, installed, and ready to use. To enable this new distribution capability to be successful, the open-source Continuous Integration, Verification, Enhancement, and Testing (CIVET) Continuous Integration (CI) capability was augmented to add Continuous Delivery (CD). CD enables the automated building and packaging of MOOSE-based applications as they are modified by development teams, ensuring that our customers can obtain up-to-date versions of the software at any time. The need for instruction on how to use these applications was addressed through modifications to the MOOSE documentation system. The MooseDocs capability, which enables robust documentation of MOOSE-based applications, has been extended to allow both for the installation of documentation and the packaging of documentation with installed applications. Together, these enhancements form the core of a new, secure distribution mechanism for nuclear simulation tools. In concert with the Nuclear Computational Resource Center (NCRC), NEAMS- developed applications will now be straightforward to obtain securely.
97 MATHEMATICS AND COMPUTING↗
Distributed Acoustic Sensing (DAS) on Opportunistic Networks_ A Feasibility Study Utilizing Fiber Optic Infrastructure at NEON Sites for DAS
This study demonstrates the feasibility of using Distributed Acoustic Sensing (DAS) on the opportunistic optical fiber infrastructure presented by NEON (National Ecological Observatory Network) sites. The test took place at the NEON Terrestrial Site designated D10 CPER. Unlit portions of the local fiber network were successfully spliced together and optimized for length and a Silixa iDAS sensor was installed. The resulting array (composed of 12 spliced fiber runs) totaled 875m in length. Over a period of 2 weeks, we gathered a high spatial and temporal resolution data set to characterize discernable signals and understand background noise. The data set was reviewed to extract wave signatures of identifiable origin, both anthropogenic and otherwise. Continent wide distribution of these sites makes them an interesting candidate for DAS and identifying measurable signal sources informs future DAS application on opportunistic fiber networks. These observations validate the utility of both the NEON and similarly small fiber networks (<1km) for geoscience, environmental, and security DAS applications and indicate possibilities for further inquiry in methods for DAS data collection and analysis.
42 ENGINEERING↗
Modeling supercritical CO 2 flow and mineralization in reactive host rocks with PFLOTRAN v7.0
Understanding the flow and reactivity of CO 2 injected into geological reservoirs is important for many subsurface applications including secure geologic carbon storage (GCS), critical mineral extraction, enhanced geothermal systems (EGS), and enhanced oil recovery (EOR). Traditionally, subsurface CO 2 injection for GCS applications has focused on geologic formations with favorable subsurface configurations for CO 2 migration and trapping through non-reactive mechanisms such as structural, solubility, and petrophysical trapping. Recently, CO 2 -reactive rocks such as mafic and ultramafic basalts have been investigated for their potential to react with injected CO 2 in situ to simultaneously dissolve host rock minerals and mineralize CO 2 as carbonates. Engineering rapid CO 2 mineralization in the subsurface is attractive because of the increased density of stored CO 2 , the additional safety factors associated with solidification, and the potential to extract valuable critical minerals. Here we present recent developments in the parallel flow and reactive transport simulator PFLOTRAN to model coupled CO 2 -brine flow and reactive transport for a wide range of injection and production applications involving reactive CO 2 -brine systems. These developments are based on the well established and trusted CO 2 flow capabilities in the STOMP-CO 2 simulator. New capabilities added to PFLOTRAN include new CO 2 -brine equations of state with optional thermal coupling, several new constitutive relationships like capillary pressure smoothing and scanning path hysteresis, a fully implicit well model, and native linkage with PFLOTRAN's well-established reactive transport libraries. A series of benchmarks between PFLOTRAN and STOMP-CO 2 verify the newly developed CO 2 -brine flow capabilities. Demonstrations of coupled CO 2 -brine flow modeling and reactive transport show how CO 2 mineralization can be engineered in reactive host rocks. Finally, an example use case involving copper leaching by CO 2 and critical mineral extraction is presented to showcase the strengths of this new implementation. Several limitations still remain, including limited availability of field data to parameterize models. Future work should constrain the evolution of mineral surface area during mineralization and the temperature and/or pH dependence of geochemical reactions for specific systems of interest.
Critical Minerals↗
Countering Weapons of Mass Destruction Office (CWMD) Data Categorization Study: Chemical, Biological, Radiological, and Nuclear (CBRN) Detection Device Data
Pacific Northwest National Laboratory (PNNL) seeks to address critical questions related to chemical, biological, radiological, and nuclear (CBRN) detection devices. This research aims to enhance the security and understanding of these devices by investigating various aspects of their identification, communication, and functionality. The primary focus is on network security, malware detection, device identification, and intelligence gathering. CBRN data can be categorized in various ways depending on the purpose of CBRN detection devices and the specific context of the applications for analysis. Criteria that can be used to assist in this effort include but are not limited to data type, data protocol, source/destination, application, time, security, and content. This study will inform additional paths for data classification, data profiling, data mapping, and data modeling. This will help the Countering Weapons of Mass Destruction Office (CWMD) better understand their data and make informed decisions based on the insights gained from this study and their application. The CBRN Data Categorization study will include the identification of 5–10 different CBRN detection devices with unique characteristics for assessing and analyzing the data that is being produced by and transmitted from these devices.
45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
NEFTSec: Networked federation testbed for cyber-physical security of smart grid: Architecture, applications, and evaluation
As today's power grid is evolving into a densely interconnected cyber-physical system (CPS), a high fidelity and multifaceted testbed environment is needed to perform cybersecurity experiments in a realistic grid environment. Traditional standalone CPS testbeds lack the ability to emulate complex cyber-physical interdependencies between multiple smart grid domains in a real-time environment. Therefore, there are ongoing research and development (R&D) efforts to develop an interconnected CPS testbed by sharing geographically dispersed testbed resources to perform distributed simulation while analysing simulation fidelity. This paper presents a networked federation testbed for cybersecurity evaluation of today's and emerging smart grid environments. Specifically, it presents two novel testbed architectures, including cyber federation and cyber-physical federation, identifies R&D applications, and also describes testbed building blocks with experimental case studies. It also presents a novel co-simulation interface algorithm to facilitate distributed simulation within cyber-physical federation. The resources available at the PowerCyber CPS security testbed at Iowa State University (ISU) and the US Army Research Laboratory are utilised to develop this platform for performing multiple experimental case studies pertaining to wide-area protection and control applications in power system. Finally, experimental results are presented to analyse the simulation fidelity and real-time performance of the testbed federation.
24 POWER TRANSMISSION AND DISTRIBUTION↗