Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “coordinated attacks”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2024

Model-Based Detection of Coordinated Attacks (DCA) in Distribution Systems

The fast-paced growth in digitization of smart grid components enhances system observability and remote-control capabilities through efficient communication. However, enhanced connectivity results in heightened system vulnerability towards cybersecurity risks in the cyber-physical power system. Coordinated cyber-attacks (CCA), when undetected, lead to system-wide impact in terms of large disturbances or widespread outages. Detecting CCA in the cyber layer is critical to thwart cyber-attacks in real-time before the attack impacts the physical system. The challenge of locating CCA stems from the complex grid dynamics, making it difficult to distinguish between normal operational variations and cyber-attack impact. CCA often employs multiple attack vectors targeting geographically distributed components, further complicating CCA identification. Existing research in intrusion detection is primarily focused on the transmission network and limited to detecting individual attacks. In this paper, a novel proactive DCA strategy is proposed for early detection of CCA by establishing correlations among distinct attack events through model-based reinforcement learning that utilizes abductive reasoning to conclude the attacker goal. The solution includes understanding the system model, learning the system dynamics, and correlating individual cyber-attacks to extract the attacker’s objective. The developed learning algorithm identifies the most probable attack path to reach the attacker’s objective by predicting the next attack steps. A DNP3-based cyber-physical co-simulation testbed is developed to test the proposed algorithm using the IEEE 13-node test feeder.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2021

Cyber-Attack Detection for Photovoltaic Farms Based on Power-Electronics-Enabled Harmonic State Space Modeling

Here in this paper, a physics-data-based detection method is proposed to detect a variety of cyber-attacks in Photovoltaic (PV) farms using the power electronics-enabled harmonic state space (HSS) models, which, to our knowledge, is original. At the device level, HSS-based detection is developed to monitor harmonic vectors of individual PV converter with minimum sensor measurements, thus improving accuracy and robustness compared to Kalman Filter-based detection. At the system level that involves multiple PV converters, a clustering approach is developed to investigate attack propagation and accurately locate attack sources within a PV farm. The proposed approach is one of the first attempts to address PV security through interaction between the device and system, maximizing the accuracy and robustness at different levels. To verify the feasibility, a comprehensive attacks model is built, including single attack, coordinated attacks, and replay attacks. Besides, the impacts of irradiance changes are taken into consideration in the test scenarios. With the real-time data acquisition and hardware-in-the-loop testbed, comprehensive test results are provided to verify the feasibility of the proposed detection methodology.

42 ENGINEERING↗
DOE OSTI2025

Secure State Estimation with Asynchronous Measurements for Coordinated Cyber Attack Detection in Active Distribution Systems

Coordinated cyber attacks tamper with measurement data to disrupt the situational awareness of active distribution systems. Various sensors report measurements asynchronously at different rates, which introduces challenges during state estimation. In addition, this forces cyber intruders to exert greater effort to compromise multiple communication channels and launch coordinated attacks. Therefore, multi-channel and asynchronous measurements could be harnessed to develop more secure cyber defense strategies. In this paper, a prediction-correction-based multi-rate observer is designed to exploit the value of asynchronous measurements for the detection of coordinated false data injection (FDI) attacks. First, a time-function-dependent prediction-correction strategy is proposed to adjust the sampling interval for each sensor’s measurement. Then, an observer is designed based on the trade-off between estimation error and the optimal period of the most recent sampling instant, with the convergence of estimation error with the maximum permitted sampling interval. Moreover, the conditions for exponential stability are developed using the Lyapunov–Krasovskii functional technique. Next, a coordinated FDI attack detection strategy is developed based on the dual nonlinear minimization problem. The proposed attack detection and secure state estimation strategies are tested on the IEEE 13-node system. Simulation results show that these schemes are effective in enhancing attack detection based on asynchronous measurements or compromised data.

asynchronous measurements↗
DOE OSTI2025

Coordinated Thermal Safety Attack and Defense on EV Battery Management Systems

Battery temperature sensor and battery current sensor data which are key sensing inputs to the Battery Management Controllers in electric vehicles, are vulnerable to possible cyber/ physical manipulation due to known vulnerabilities inherited from CAN bus technology that is used for in-vehicle communications between electronic control units that transfer sensing and control data. In this paper, we first create a simulation that enables us to evaluate impact of cyber physical attacks on electric vehicle battery management system in a controlled environment that violates thermal safety. Specifically, we emulate a Level 3 - DC fast charging system with SAE J1772/CCS, integrated with standard charging controls and thermal safety controls on EVs, and various sensing data flows. Second, we propose a coordinated current and battery temperature attack that has crippling economic, and safety impacts. Third, we quantify the usability, economic and safety impacts of such attacks as a function of the extent of data manipulation. Finally, we propose a physics model driven detection technique to detect presence of such attacks.

25 ENERGY STORAGE↗
DOE OSTI2023

Protecting and Defending against Autonomous Control Systems and Digital Twin Cyber Attacks: Response Strategy for Hyperparameter attacks of Digital Twin Machine Learning Models in Nuclear Power Plants (Final)

Navigating through the complex tapestry of technological advancements, "Response Strategy for Hyperparameter attacks of Digital Twin Machine Learning Model in Nuclear Power Plants" stands at the intersection of cybersecurity and nuclear power plant operations, embarking on a journey through the intricacies of securing digital twins against malicious cyber activities. As nuclear power plants progressively integrate digital twin technology and machine learning models to optimize operations and ensure system reliability, they inadvertently expose themselves to a new spectrum of vulnerabilities, notably in the realm of hyperparameter attacks. Hyperparameters, integral in machine learning model tuning and optimal performance of digital twins, have emerged as a target for adversaries aiming to destabilize the predictive capabilities and therefore, the operational accuracy of these digital entities within critical infrastructures like nuclear plants. This paper, therefore, meticulously threads the needle through the development of a robust response strategy, poised to shield these digital reflections against calculated hyperparameter manipulations, ensuring that the digital twin can effectively and securely function as a reliable proxy for its physical counterpart. The ensuing sections delve into the orchestrated maelstrom of multi-rate time-changing intelligent coordinated hyperparameter attacks and the implementation of event-triggered predictive control, laying down a structured, predictive, and responsive framework that safeguards the nexus where the digital and physical realms of nuclear power plants coalesce. The operational integrity of digital twins in nuclear power plants depends critically on the security of machine learning hyperparameters. This study makes two different contributions. First, a decision-based idea known as a multi-rate time changing intelligent coordinated hyperparameter attack is put forth. In this attack, many hyperparameters are repeatedly changed using both random and intelligent optimal techniques by the attacker. These assaults introduce varied rates at different attack steps, compromise various amounts of hyperparameters, and improve stealth and flexibility. Second, a technique is developed for event triggered predictive control to rapidly respond to potential hyperparameter attacks. This control integrates a sliding window framework, retaining a history of previous data points and employing linear regression to predict the next data point from the current dataset. The control gain K is determined using the Lyapunov-Krasovskii method, and subsequently, an action is developed. Finally, the outcome of the simulation demonstrates the viability of the proposed method for defending nuclear power plant digital twins from hyperparameter attacks.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2019

Efficient Modeling of HIL Multi-Grid System for Scalability & Concurrency in CPS Security Testbed

Cyber-event-triggered power grid blackout compels utility operators to intensify cyber-aware and physics-constrained recovery and restoration process. Recently, coordinated cyber attacks on the Ukrainian grid witnessed such a cyber-event-triggered power system blackout. Various cyber-physical system (CPS) testbeds have attempted with multitude designs to analyze such interdependent events and evaluate remedy measures. However, resource constraints and modular integration designs have been significant barriers while modeling large-scale grid models (scalability) and multi-grid isolated models (concurrency) under a single real-time execution environment for the hardware-in-the-loop (HIL) CPS security testbeds. This paper proposes a meticulous design and effective modeling for simulating large-scale grid models and multi-grid isolated models in a HIL realtime digital simulator environment integrated with industry-grade hardware and software systems. We have used our existing HIL CPS security testbed to demonstrate scalability by the realtime performance of a Texas-2000 bus US synthetic grid model and concurrency by the real-time performance of simultaneous ten IEEE-39 bus grid models and an IEEE-118 bus grid model. The experiments demonstrated significant results by 100% realtime performance with zero overruns, low latency while receiving and executing control signals from SEL Relays via IEC-61850 protocol and low latency while computing and transmitting grid data streams including stability measures via IEEE C37.118 synchrophasor data protocol to SEL Phasor Data Concentrators.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2019

Descriptive Analytics-Based Anomaly Detection for Cybersecure Load Forecasting

As power delivery systems evolve and become increasingly reliant on accurate forecasts, they will be more and more vulnerable to cybersecurity issues. A coordinated data attack by sophisticated adversaries can render existing data corrupt or outlier detection methods ineffective. This would have a very negative impact on operational decisions. The focus of this paper is to develop descriptive analytics-based methods for anomaly detection to protect the load forecasting process against cyberattacks to essential data. We propose an integrated solution (IS) and a hybrid implementation of IS (HIIS) that can detect and mitigate cyberattack induced long sequence anomalies. HIIS is also capable of improving true positive rates and reducing false positive rates significantly comparing with IS. The proposed HIIS can serve as an online cybersecure load forecasting scheme.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2019

Polarized Radar for Detection and Automatic Non-Visual Assessment of Unmanned Aerial Systems

This Laboratory Directed Research and Development (LDRD) effort performed fundamental Research and Development (R&D) to develop a robust radar processing algorithm capable of assessing the difference between an Unmanned Aerial System (UAS) and a biological target such as a bird, based on mathematics applied to the polarized radar returns of the target object, alone. The current threats of using such a UAS as a delivery platform for a host of destructive components is a major concern for the protection of various assets. Most recently, on 14th Sept. 2019, dozens of suicide or kamikaze drones (UAV-X) coordinated an attack on two Saudi oil facilities that demonstrated the potential to disrupt global oil supplies. While radar-based UAS detection systems can detect UAS at ranges greater than 1-km, the issues of excessive Nuisance/False Alarm Rates (NAR/FAR) from natural sources (birds in particular) has not been sufficiently addressed. In this effort we describe and utilize the Adaptive Polarization Difference Imaging-based (APDI) algorithms for the detection and automatic non-visual assessment of Unmanned Aerial System applications. Originally developed for optical imaging and sensing of polarization information in nature, the algorithms developed here are modified to serve for the target detection purposes in counter-UAS (cUAS) environments. We exploit the polarization statistics of the observing scene for detection and identification of changes within the scene and assess from these changes for UAS/bird classifications. Several cases are considered from independent data sources, including numerically generated data, anechoic chamber data as well as experimental radar data, to show the applicability of the techniques developed here. The methods developed in this effort are designed to be used in cUAS setups but have shown promise for a multitude of other radar-based classification uses as well.

47 OTHER INSTRUMENTATION↗
NASA NTRS1972

Solar observations from Skylab.

A wide variety of problems in solar physics will be attacked with coordinated observations made by the following instruments on Skylab: a white light coronagraph, a spectrograph for the 950-3900 A range, a spectrometer-spectroheliometer for the 300-1300 A range, a spectroheliograph for 150-650 A, X-ray telescopes, and supporting instrumentation. There will be complementary measurements from the ground and from space with 1-sec angular resolution on the sun. A coordinated program of correlative ground-based observations, sounding rocket launches, and observations from other spacecraft is being developed to provide calibration in orbit and simultaneous observations of solar phenomena over a broad range of the electromagnetic spectrum.

Oertel, G. K.↗
DOE OSTI2020

Anomaly Detection and Mitigation for Wide-Area Damping Control using Machine Learning

In an interconnected multi-area power system, wide-area measurement based damping controllers are used to damp out inter-area oscillations, which jeopardize grid stability and constrain the power flows below to their transmission capacity. The effect of wide-area damping control (WADC) significantly depends on both power and cyber systems. At the cyber system layer, an adversary can inflict the WADC process by compromising either measurement signals, control signals or both. Stealthy and coordinated cyber-attacks may bypass the conventional cybersecurity measures to disrupt the seamless operation of WADC. This paper proposes an anomaly detection (AD) algorithm using supervised Machine Learning and a model-based logic for mitigation. The proposed AD algorithm considers measurement signals (input of WADC) and control signals (output of WADC) as input to evaluate the type of activity such as normal, perturbation (small or large signal faults), attack and perturbation-and-attack. Upon anomaly detection, the mitigation module tunes the WADC signal and sets the control status mode as either wide-area mode or local mode. The proposed anomaly detection and mitigation (ADM) module works inline with the WADC at the control center for attack detection on both measurement and control signals and eliminates the need for ADMs at the geographically distributed actuators. Here, we consider coordinated and primitive data-integrity attack vectors such as pulse, ramp, relay-trip and replay attacks. The performance of the proposed ADM algorithms was evaluated under these attack vector scenarios on a testbed environment for 2-area 4-machine power system. The ADM module shows effective performance with 96:5% accuracy to detect anomalies.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2023

Advanced Reactor Cyber Analysis and Development Environment (ARCADE) for System-Level Design Analysis

Cybersecurity is a persistent concern to the safety and security of Nuclear Power Plants (NPPs), but has lacked data-driven, evidence-based research. Rigorous cybersecurity analysis is critical for the licensing of advanced reactors using a performance-based approach. One tool that enables cybersecurity analysis is modeling and simulation. The nuclear industry makes extensive use of modeling and simulation throughout the decision process but lacks a method to incorporate cybersecurity analysis with existing models. To meet this need, the Advanced Reactor Cyber Analysis and Development Environment (ARCADE) was developed. ARCADE is a suite of publicly available tools that can be used to develop emulations of industrial control system devices and networks and integrate those emulations with physics simulators. This integration of cyber emulations and physics models enables rigorous cyber-physical analysis of cyber-attacks on NPP systems. This report provides an overview of key considerations for using ARCADE with existing physics models and demonstrates ARCADE’s capabilities for cybersecurity analysis. Using a model of the Small Modular Advanced High Temperature Reactor (SmAHTR), ARCADE was able to determine the sensitivity of the primary heat exchangers (PHX) to coordinated cyber-attacks. The analysis determined that while the PHX’s failures cause disruption to the reactor, they did not cause any safety limits to be exceeded because of the plant design, including passive safety features. Further development of ARCADE will enable rigorous, repeatable, and automated cyber-physical analysis of advanced reactor control systems. These efforts will also help reduce regulatory uncertainty by presenting similar types of cybersecurity analyses in a common format, driving standard approaches and reporting.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2024

Logistics of defense: The contribution of endomembranes to plant innate immunity

Phytopathogens cause plant diseases that threaten food security. Unlike mammals, plants lack an adaptive immune system and rely on their innate immune system to recognize and respond to pathogens. Plant response to a pathogen attack requires precise coordination of intracellular traffic and signaling. Spatial and/or temporal defects in coordinating signals and cargo can lead to detrimental effects on cell development. The role of intracellular traffic comes into a critical focus when the cell sustains biotic stress. In this review, we discuss the current understanding of the post-immune activation logistics of plant defense. Specifically, we focus on packaging and shipping of defense-related cargo, rerouting of intracellular traffic, the players enabling defense-related traffic, and pathogen-mediated subversion of these pathways. We highlight the roles of the cytoskeleton, cytoskeleton–organelle bridging proteins, and secretory vesicles in maintaining pathways of exocytic defense, acting as sentinels during pathogen attack, and the necessary elements for building the cell wall as a barrier to pathogens. We also identify points of convergence between mammalian and plant trafficking pathways during defense and highlight plant unique responses to illustrate evolutionary adaptations that plants have undergone to resist biotic stress.

59 BASIC BIOLOGICAL SCIENCES↗
DOE OSTI2020

Net Load Redistribution Attacks on Nodal Voltage Magnitude Estimation in AC Distribution Networks

A high penetration level of smart devices and communication networks increases the threat of cyber-attacks in the distribution system. In this paper, we model a hidden, coordinated, net load redistribution attack (NLRA) in an AC distribution system. Based on local information of an attack region, the attacker’s goal is to create violations in nodal voltage magnitude estimation. Acting as a system operator equipped with global AC state estimation and bad data detection, we validate the stealthiness of the hidden NLRA in multiple attack cases. Simulation results on a modified PG&E 69-node distribution system show the validity of the proposed NLRA. The influence of NLRA on the distribution system is assessed and the impact of attack regions, attack timing, and system observability is also revealed.

Zhang, Hang↗
NASA NTRS1981

Kinematic properties of the helicopter in coordinated turns

A study on the kinematic relationship of the variables of helicopter motion in steady, coordinated turns involving inherent sideslip is described. A set of exact kinematic equations which govern a steady coordinated helical turn about an Earth referenced vertical axis is developed. A precise definition for the load factor parameter that best characterizes a coordinated turn is proposed. Formulas are developed which relate the aircraft angular rates and pitch and roll attitudes to the turn parameters, angle of attack, and inherent sideslip. A steep, coordinated helical turn at extreme angles of attack with inherent sideslip is of primary interest. The bank angle of the aircraft can differ markedly from the tilt angle of the normal load factor. The normal load factor can also differ substantially from the accelerometer reading along the vertical body axis of the aircraft. Sideslip has a strong influence on the pitch attitude and roll rate of the helicopter. Pitch rate is independent of angle of attack in a coordinated turn and in the absence of sideslip, angular rates about the stability axes are independent of the aerodynamic characteristics of the aircraft.

Chen, R. T. N.↗
DOE OSTI2023

On the Feasibility of Market Manipulation and Energy Storage Arbitrage via Load-Altering Attacks

Around the globe, electric power networks are transforming into complex cyber–physical energy systems (CPES) due to the accelerating integration of both information and communication technologies (ICT) and distributed energy resources. While this integration improves power grid operations, the growing number of Internet-of-Things (IoT) controllers and high-wattage appliances being connected to the electric grid is creating new attack vectors, largely inherited from the IoT ecosystem, that could lead to disruptions and potentially energy market manipulation via coordinated load-altering attacks (LAAs). In this article, we explore the feasibility and effects of a realistic LAA targeted at IoT high-wattage loads connected at the distribution system level, designed to manipulate local energy markets and perform energy storage (ES) arbitrage. Realistic integrated transmission and distribution (T&D) systems are used to demonstrate the effects that LAAs have on locational marginal prices at the transmission level and in distribution systems adjacent to the targeted network.

25 ENERGY STORAGE↗
DOE OSTI2021

Security assessment and impact analysis of cyberattacks in integrated T&D power systems

In this paper, we examine the impact of cyberattacks in an integrated transmission and distribution (T&D) power grid model with distributed energy resource (DER) integration. We adopt the OCTAVE Allegro methodology to identify critical system assets, enumerate potential threats, analyze and prioritize risks for threat scenarios. Based on the analysis, attack strategies and exploitation scenarios are identified which could lead to system compromise. Specifically, we investigate the impact of data integrity attacks in inverted-based solar PV controllers, control signal blocking attacks in protective switches and breakers, and coordinated monitoring and switching time-delay attacks. Index Terms—Cyberattacks, security assessment, impact analysis, case studies, integrated power systems.

14 SOLAR ENERGY↗
NASA NTRS1981

Influence of sideslip on the kinematics of the helicopter in steady coordinated turns

A steep coordinated helical turn at extreme angles of attack with inherent sideslip is of primary interest in this study. Unlike fixed-wing aircraft, the helicopter in a steady coordinated turn will inherently sideslip. A set of exact kinematic equations describing this motion in steady helical turns has been developed, and a rational definition for the load factor that best characterizes a coordinated turn for a helicopter has been proposed. An analysis has also been completed on the effects of sideslip on the kinematic relationships in a coordinated turn which is based on new closed-form solutions which relate the aircraft angular rates and pitch and roll attitudes to the turn parameters, angle of attack, and sideslip. The results show that the bank angle of the aircraft can differ markedly from the tilt angle of the normal load factor and that the normal load factor can also differ substantially from the accelerometer reading along the vertical body axis of the aircraft. Generally, sideslip has a strong influence on the pitch attitude and roll rate of the helicopter. The study also indicates that pitch rate is independent of angle of attack in a coordinated turn and that in the absence of sideslip, angular rates about the stability axes are independent of the aerodynamic characteristics of the aircraft.

Chen, R. T. N.↗