Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “vulnerability discovery”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records
All sourcesNASA NTRSDOE OSTI
NASA NTRS2014

Scalable Asset Discovery, Vulnerability Scanning, and Penetration Testing for Remote Sites and Wireless Spectrums Utilizing an Embedded Linux Plug - PwniPlug and the Raspberry Pi B+ as a Sample Pen Test

All devices attached to the NASA KSC network are subject to security vulnerability scanning and/or penetration testing. In today's changing environment, vulnerable and/or unprotected systems can easily be overlooked. Systems that are not properly managed can become a potential threat to the operational integrity of our systems and networks. This includes all NASA (internal and external) information systems within NASA KSC Internet Protocol (IP) address space, and NASA KSC facilities. The Office of the Chief Information Officer (OCIO) recommends that all NASA Centers and information systems be subject to penetration testing on a regular interval in accordance with the guidelines identified by the National Institute of Standards and Technology (NIST). (ITS-HBK-2810.04-02A) Protecting information and equipment at NASA is an area of increasing concern. In addition to the CPU's on the network; Supervisory, Control and Data Acquisition (SCADA) systems are especially vulnerable because these systems have lacked standards, use embedded controllers with little computational power and informal software, are connected to physical processes, have few operators, and are increasingly also being connected to corporate networks. The scope of work is comprised of several individual components which together build upon previous work by Drew Branch, NASA KSC Intern. The Pwn Plug is the selected COTS (Commercial-Off-The-Shelf) device chosen to test simplification of mandatory IT Security tasks. The device will be utilized to provide services to NASA KSC and enable an assessment of infrastructure soundness and regulatory compliance in an efficient, economical, and business responsive manner. The Pwn Plug is designed as a pen testing appliance which provides a hardware platform that can support commercial penetration testing efforts at significantly reduced costs. The expected outcomes are: 1) External Penetration Testing, 2) Social Engineering, 3) Procedural Documentation, 4) Recommended Remediation Action Plan, 5) System Retest & Remediation Attestation and 6) Final Reports, out briefing and Presentation. Due to physical and material constraints beyond intern and mentor control, the project was redefined as a working pen-test scenario. Limitations of lab availability and tools dictated an academic exercise. This report was developed within the scenario guidelines suggested by the project mentor. The guidelines were to be creative in developing a Pen Test program for a client.

Penetration Testing↗
DOE OSTI2019

The Journey to Vulnerability Management?

Abstract Text Idaho National Laboratory’s Information Management (IM) is transforming how they manage IT vulnerabilities. The IM team realized the increasing risks to the Lab and the difficulty of ‘keeping tabs’ on multiple organizations and multiple process for Vulnerability Management (VM). They chose to stand up an IT Operations and Vulnerability Management group to help centralize VM across IM organizations. Come listen and participate as we describe the on-going journey to facilitating a centralized vulnerability management operation. A mature VM program should provide a manageable life cycle for vulnerabilities and variances. In addition, the program must provide visibility to management and stakeholders for continuous monitoring and reporting of vulnerability discovery and remediation across Applications, Databases, Workstations, Servers, Infrastructure Equipment, and remediation of Variances.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

Clean Energy Cybersecurity Accelerator: Cohort 2 - runZero Public Report

The U.S. Department of Energy (DOE) Office of Cybersecurity, Energy Security, and Emergency Response (CESER) sponsors the Clean Energy Cybersecurity Accelerator™ (CECA) to expedite the deployment of emerging security technologies that address the most urgent security concerns facing modern and future electric grids. CECA Cohort 2 assessed solutions focused on hidden risks due to incomplete system visibility and device security and configuration. Improving visibility can be achieved through operational technology (OT) asset identification solutions, including capabilities like automatic discovery, vulnerability reporting, and configuration monitoring. Solutions that monitor and identify assets in information technology (IT) networks in other domains are widely used; however, there is far less adoption of monitoring solutions for operational technology environments. Wider adoption may increase with increased confidence in the ability for these solutions to understand and respond to the specific requirements of OT environments. CECA Cohort 2 evaluated the active and passive asset discovery capabilities of market-ready solutions, documented and analyzed results, and identified gaps in functionality or capabilities. This report and describes how these results can help advance the adoption of these and similar solutions in the electric sector.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2024

Clean Energy Cybersecurity Accelerator: Cohort 2 - Asimily Public Report

The U.S. Department of Energy (DOE) Office of Cybersecurity, Energy Security, and Emergency Response (CESER) sponsors the Clean Energy Cybersecurity Accelerator (TM) (CECA) to expedite the deployment of emerging security technologies that address the most urgent security concerns facing modern and future electric grids. CECA Cohort 2 assessed solutions focused on hidden risks due to incomplete system visibility and device security and configuration. Improving visibility can be achieved through operational technology (OT) asset identification solutions, including capabilities like automatic discovery, vulnerability reporting, and configuration monitoring. Solutions that monitor and identify assets in information technology (IT) networks in other domains are widely used; however, there is far less adoption of monitoring solutions for operational technology environments. Wider adoption may increase with increased confidence in the ability for these solutions to understand and respond to the specific requirements of OT environments. CECA Cohort 2 evaluated the active and passive asset discovery capabilities of market-ready solutions, documented and analyzed results, and identified gaps in functionality or capabilities. This report and describes how these results can help advance the adoption of these and similar solutions in the electric sector.

24 POWER TRANSMISSION AND DISTRIBUTION↗
NASA NTRS2014

Analyzing Risks and Vulnerabilities of Various Computer Systems and Undergoing Exploitation using Embedded Devices

Security is one of the most if not the most important areas today. After the several attacks on the United States, security everywhere has heightened from airports to communication among the military branches legionnaires. With advanced persistent threats (APTs) on the rise following Stuxnet, government branches and agencies are required, more than ever, to follow several standards, policies and procedures to reduce the likelihood of a breach. Attack vectors today are very advanced and are going to continue to get more and more advanced as security controls advance. This creates a need for networks and systems to be in an updated, patched and secured state in a launch control system environment. Attacks on critical systems are becoming more and more relevant and frequent. Nation states are hacking into critical networks that might control electrical power grids or water dams as well as carrying out advanced persistent threat (APTs) attacks on government entities. NASA, as an organization, must protect its self from attacks from all different types of attackers with different motives. Although the International Space Station was created, there is still competition between the different space programs. With that in mind, NASA might get attacked and breached for various reasons such as espionage or sabotage. My project will provide a way for NASA to complete an in house penetration test which includes: asset discovery, vulnerability scans, exploit vulnerabilities and also provide forensic information to harden systems. Completing penetration testing is a part of the compliance requirements of the Federal Information Security Act (FISMA) and NASA NPR 2810.1 and related NASA Handbooks. This project is to demonstrate how in house penetration testing can be conducted that will satisfy all of the compliance requirements of the National Institute of Standards and Technology (NIST), as outlined in FISMA. By the end of this project, I hope to have carried out the tasks stated above as well as gain an immense knowledge about compliance, security tools, networks and network devices, as well as policies and procedures.

Penetration Testing↗
NASA NTRS2017

Qualitative Future Safety Risk Identification an Update

The purpose of this report is to document the results of a high-level qualitative study that was conducted to identify future aviation safety risks and to assess the potential impacts to the National Airspace System (NAS) of NASA Aviation Safety research on these risks. Multiple external sources (for example, the National Transportation Safety Board, the Flight Safety Foundation, the National Research Council, and the Joint Planning and Development Office) were used to develop a compilation of future safety issues risks, also referred to as future tall poles. The primary criterion used to identify the most critical future safety risk issues was that the issue must be cited in several of these sources as a safety area of concern. The tall poles in future safety risk, in no particular order of importance, are as follows: Runway Safety, Loss of Control In Flight, Icing Ice Detection, Loss of Separation, Near Midair Collision Human Fatigue, Increasing Complexity and Reliance on Automation, Vulnerability Discovery, Data Sharing and Dissemination, and Enhanced Survivability in the Event of an Accident.

future aviation safety risk↗
NASA NTRSDate not supplied

Anomaly Detection in Flight Operational Data Using Deep Learning

In this session, we demonstrate two recently developed deep learning models for anomaly detection in flight operational data by the Data Sciences Group at NASA Ames Research Center. The first model is Convolutional Variational Auto-Encoder (CVAE) [1], which is an unsupervised deep encoder-decoder model, designed specifically for finding anomalies in heterogeneous multivariate time series data. We will demonstrate its application to finding anomalies in streaming data from NASA’s Digital Information Platform’s Fuser source. CVAE identifies data instances that are not representative of expected nominal behavior as anomalous. Since it is an unsupervised approach, the flagged anomalies will need to be reviewed by the subject matter experts (SMEs) for validation and labeling and is designed to assist with vulnerability discovery within Safety Monitoring System programs. The second model is Robust and Explainable Semi-supervised Anomaly Detection (RESAD) model [2], which builds on CVAE to allow learning from both minimally labeled data (previously reviewed by the SMEs) as well as majority unlabeled data. RESAD takes advantage of graph theoretic techniques to propagate the labels from the labeled data to the unlabeled data based on a pre-defined similarity metric and structures the learned feature space from flight time-series so that data of the same class would cluster tightly together. This model characteristic is enabled by training with an augmented loss function and allows learning of a more informative feature space for down-stream tasks such as search and active learning. We demonstrate RESAD using data from the NASA DASHlink project [3].

anomaly detection↗
DOE OSTI2019

Safer and optimized vulnerability scanning for operational technology through integrated and automated passive monitoring and active scanning

Vulnerability scanning of embedded sensors and controllers have a history of causing disruption and malfunction within operation technology environments. Traditional information technology vulnerability scanning generally consists of blunt exercising all or a large population of test conditions to understand how equipment responds. Often the large number and varied conditions of the tests are too much for embedded systems to handle. This paper presents a methodology and framework for integrating passive monitoring and active scanning techniques to optimize the type and amount of necessary active communication tests while achieving acceptable levels of device and vulnerability discovery. Bayesian probability and networks are leveraged for inference to drive the automation of the scanning actions to achieve confidence in discovery. Through inference, selecting the optimal active scans with the least risk and highest confidence impact is possible, thereby eliminating unnecessary scans with uncertain effects. Results of experimenting with real power systems and the following probabilities are provided.

Key Management, ICS, SCADA, Authentication↗
DOE OSTI2013

Information Gain Based Dimensionality Selection for Classifying Text Documents

Selecting the optimal dimensions for various knowledge extraction applications is an essential component of data mining. Dimensionality selection techniques are utilized in classification applications to increase the classification accuracy and reduce the computational complexity. In text classification, where the dimensionality of the dataset is extremely high, dimensionality selection is even more important. This paper presents a novel, genetic algorithm based methodology, for dimensionality selection in text mining applications that utilizes information gain. The presented methodology uses information gain of each dimension to change the mutation probability of chromosomes dynamically. Since the information gain is calculated a priori, the computational complexity is not affected. The presented method was tested on a specific text classification problem and compared with conventional genetic algorithm based dimensionality selection. The results show an improvement of 3% in the true positives and 1.6% in the true negatives over conventional dimensionality selection methods.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

Automation of Vulnerability and Patch Management: Information Extraction, Association, and Optimization

Vulnerability and patch management is an integral part of a robust cybersecurity program, yet it grows increasingly complex due to the sheer amount of data that must be analyzed. Particularly in Operational Technology (OT) environments, analysis must be done manually because of the lack of automated solutions. Additionally, there are many steps in this process, from the initial discovery of the vulnerability to the implementation of its remediation, and each step in the process requires different data in order to be performed effectively. In this work, we provide approaches and strategies to assist operators in industrial or OT environments throughout the vulnerability management cycle. Security advisories provide key information about mitigation strategies, or actions that can be taken when a patch is unavailable or cannot be installed. Details of these strategies are not shared in public vulnerability databases and must be found manually. We approach this problem by designing a solution to automatically identify that information within vendor security advisories and retrieve it for operator use. We start with an approach that requires domain-specific knowledge of certain frequently-seen reference websites. Next, an approach that can work on an arbitrary website but relies on certain keywords. Finally, an approach that uses Natural Language Processing (NLP) methods and does not require specific knowledge or keywords. Each of these approaches is more general than its predecessor; we demonstrate high accuracy for all approaches Advisories also often contain details of affected products in non-standard or natural language formats. While this information can be easily understood when read by an operator, the non-standard format acts as a barrier to effective automation. We provide an approach for the first step in this process: identifying vendors in security advisories and mapping them to a standard framework for representing digital assets and software products. We evaluate five established string similarity algorithms, plus one of our own design that combines string similarity and information theory, on the task of mapping vendors to their corresponding entries in the Common Platform Enumeration (CPE) repository. Our results show that our proposed metric outperforms all others. Due to the constraints on time, finances, and personnel for organizations, Large Language Models (LLMs) may seem like attractive opportunities for security operators to speed up information gathering; however, it is still not clear whether LLMs can handle vulnerability management tasks well. To answer this question, we perform an empirical study of LLMs’ ability to provide consistent, accurate information about vulnerabilities in order to guide organizations in their adoption of LLMs. We observe poor performance for all models tested, suggesting that these models are not well-suited to the consistent retrieval of accurate vulnerability information. Finally, once vulnerabilities have been identified and any additional information has been obtained, operators must decide which remediation actions to implement based on their available resources. This already-complex problem becomes even more so when we consider that a vulnerability may have multiple avenues for remediation. We formulate this scenario as two knapsack problems and provide solutions, which we then compare against several existing strategies for vulnerability prioritization seen in real operational environments.

McClanahan, Kylie↗
DOE OSTI2022

Aggregate attack surface management for network discovery of operational technology

Interconnectivity has become a substratum of technology as the benefits of data-driven functionality are being realized in nearly all industries. Increased connectivity of Operational Technology (OT) exacerbates cyber risks because Industrial Control Systems (ICS) are becoming exposed to the Internet. These exposures are often done inadvertently through misconfigurations as additional network devices come online. Attack surface management (ASM) platforms can be used to identify vulnerabilities by performing external network discovery over the Internet using web spiders. These web spiders enable big data analytics of Internet of Things (IoT) devices as identifiable information of Internet-exposed equipment are archived in searchable databases that are made publicly available. There are a multitude of ASM service providers on the market. Here, this study was conducted to evaluate several commonly known tools to determine the aggregate attack surface of control systems. Queries were crafted by targeting commonly known manufacturers and communication protocols found in OT networks. Identified devices were that categorized based on technology types. Each query was replicated between several tools to target identical ICS equipment. Findings in this paper suggested a significant variance in the exposures discovered by each tool, but unique contributions were identified for each tool when a merged attack surface was derived. Therefore, all tools should be used in aggregate.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

Speeding-up fuzzing through directional seeds

Abstract Fuzzing is an automated process for discovering inputs in a program that may trigger unexpected behavior. Today, fuzzing has become a standard practice for the discovery of bugs and security vulnerabilities. However, the main issue with such practices is that the exploration of the input space of programs can often be prohibitively expensive. Therefore, several alternative fuzzing strategies have been introduced during the last few years. Some fuzzing techniques rely on human expertise to provide a plausible set of initial input examples, namely, seeds. However, the process of handcrafting seeds for fuzzing purposes often becomes strenuous for humans as it requires a deeper understanding of the Program-Under-Test (PUT). Also, the use of known inputs to programs often does not trigger vulnerable program behavior or may not reach potentially vulnerable code locations. To address those issues, we propose a seed generation framework that enables Human-In-The-Loop (HITL) directed fuzzing where the human assumes a more active role in the creation of seeds that can penetrate and assess desired locations of the PUT. Our proposed framework uses Symbolic Execution (SE) to generate seeds that exercise paths to target program locations. Moreover, our framework enables the visualization of the explored execution paths in the binary of the PUT for the generated seeds. We evaluated our approach on a set of 12 carefully designed C programs with diverse characteristics that mimic real-world programs. The experimental results show the effectiveness of the proposed approach in improving the performance of standard fuzzing tools such as the American Fuzzy Lop ("Image missing" <#comment/> ). Specifically, our solution can generate seeds that substantially enhance the performance of the fuzzer, achieving speedups ranging from $$1.46\times $$ 1.46 × to $$68.53\times $$ 68.53 × for branch conditions, $$1.39\times $$ 1.39 × to $$254.62\times $$ 254.62 × for branch depths, $$14,879.59\times $$ 14 , 879.59 × to $$30,295.88\times $$ 30 , 295.88 × for branch widths over traditional seeds. Additionally, the speedup increases with the number of target function ranging from $$12,260\times $$ 12 , 260 × to $$22,856.07\times $$ 22 , 856.07 × over traditional seeds while only requiring less than 15 seconds on average for the seed generation step.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2019

Compared vulnerabilities to small cardiac motions between different cameras used for myocardial perfusion imaging

This phantom-based study was aimed to determine whether cardiac CZT-cameras, which provide an enhanced spatial resolution and image contrast compared to Anger cameras, are similarly affected by small cardiac motions. Translations of a left ventricular (LV) insert at half-SPECT acquisitions through six possible orthogonal directions and with 5- or 10-mm amplitude were simulated on the Discovery NM-530c and DSPECT CZT-cameras and on an Anger Symbia T2 camera equipped with an astigmatic (IQ.SPECT) or conventional parallel-hole collimator (Conv.SPECT). SPECT images were initially reconstructed as currently recommended for clinical routine. The heterogeneity in recorded activity from the 17 LV segments gradually increased between baseline and motions simulated at 5- and 10-mm amplitudes with all cameras, although being higher for Anger- than CZT-cameras at each step and resulting in a higher mean number of artifactual abnormal segments (at 10-mm amplitude, Conv.SPECT: 3.7; IQ.SPECT: 1.8, Discovery: 0.7, DSPECT: 0). However, this vulnerability to motion was markedly (1) decreased for Conv.SPECT reconstructed without the recommended Resolution Recovery algorithm and (2) increased for DSPECT reconstructed without the recommended cardiac model. CZT-cameras and especially the DSPECT appear less vulnerable to small cardiac motions than Anger-cameras although these differences are strongly dependent on reconstruction parameters.

62 RADIOLOGY AND NUCLEAR MEDICINE↗
DOE OSTI2023

Cross-protective antibodies against common endemic respiratory viruses

Respiratory syncytial virus (RSV), human metapneumovirus (HMPV), and human parainfluenza virus types one (HPIV1) and three (HPIV3) can cause severe disease and death in immunocompromised patients, the elderly, and those with underlying lung disease. A protective monoclonal antibody exists for RSV, but clinical use is limited to high-risk infant populations. Hence, therapeutic options for these viruses in vulnerable patient populations are currently limited. Here, we present the discovery, in vitro characterization, and in vivo efficacy testing of two cross-neutralizing monoclonal antibodies, one targeting both HPIV3 and HPIV1 and the other targeting both RSV and HMPV. The 3 × 1 antibody is capable of targeting multiple parainfluenza viruses; the MxR antibody shares features with other previously reported monoclonal antibodies that are capable of neutralizing both RSV and HMPV. We obtained structures using cryo-electron microscopy of these antibodies in complex with their antigens at 3.62 Å resolution for 3 × 1 bound to HPIV3 and at 2.24 Å for MxR bound to RSV, providing a structural basis for in vitro binding and neutralization. Together, a cocktail of 3 × 1 and MxR could have clinical utility in providing broad protection against four of the respiratory viruses that cause significant morbidity and mortality in at-risk individuals.

60 APPLIED LIFE SCIENCES↗
DOE OSTI2025

Open Source Intelligence for Cybersecurity Events via Twitter Data

Open-Source Intelligence (OSINT) is largely regarded as a necessary component for cybersecurity intelligence gathering to secure network systems. With the advancement of artificial intelligence (AI) and increasing usage of social media, like Twitter, we have a unique opportunity to obtain and aggregate information from social media. In this study, we propose an AI-based scheme capable of automatically pulling information from Twitter, filtering out security-irrelevant tweets, performing natural language analysis to correlate the tweets about each cybersecurity event (e.g., a malware campaign), and validating the information. This scheme has many applications, such as providing a means for security operators to gain insight into ongoing events and helping them prioritize vulnerabilities to deal with. To give examples of the possible uses, we present three case studies demonstrating the event discovery and investigation processes. We also examine the potential of OSINT for identifying the network protocols associated with specific events, which can aid in the mitigation procedures by informing operators if the vulnerability is exploitable given their system’s network configurations.

Dale, Dakota↗
DOE OSTI2025

Causal machine learning uncovers conditions for convective intensification driven by organic and sulfate aerosols

Aerosols are often hypothesized to invigorate deep convective clouds (DCCs), but observational evidence remains limited and inconclusive. Clarifying this hypothesis is critical for regions vulnerable to thunderstorms and flooding, particularly highly polluted coastal cities. Leveraging a novel causal discovery–inference pipeline and high-resolution observations near Houston, TX, we identify multiple causal pathways among aerosols (mostly organic and sulfate), DCCs, and meteorological factors. However, a direct causal link from aerosols to DCCs is found to be uncommon, occurring in less than 35% of analyzed scenarios, and is characterized by strong conditionality and nonlinearity. When aerosol impacts on DCCs do occur, they can be substantial, enhancing DCC core heights by approximately 1.7 km, with 92% of this effect concentrated in warmer-phase cloud regions. Notably, the presence of sea breezes and the inclusion of all measured aerosol particles each enhance DCCs in over 95% of aerosol-sensitive cases.

54 ENVIRONMENTAL SCIENCES↗