Mark A. Buckner

Machine learning for power system disturbance and cyber-attack discrimination

Power system disturbances are inherently complex and can be attributed to a wide range of sources, including both natural and man-made events. Currently, the power system operators are heavily relied on to make decisions regarding the causes of experienced disturbances and the appropriate course of action as a response. In the case of cyber-attacks against a power system, human judgment is less certain since there is an overt attempt to disguise the attack and deceive the operators as to the true state of the system. To enable the human decision maker, we explore the viability of machine learning as a means for discriminating types of power system disturbances, and focus specifically on detecting cyber-attacks where deception is a core tenet of the event. We evaluate various machine learning methods as disturbance discriminators and discuss the practical implications for deploying machine learning systems as an enhancement to existing power system architectures.

An Evaluation of Machine Learning Methods to Detect Malicious SCADA Communications

Critical infrastructure Supervisory Control and Data Acquisition (SCADA) systems have been designed to operate on closed, proprietary networks where a malicious insider posed the greatest threat potential. The centralization of control and the movement towards open systems and standards has improved the efficiency of industrial control, but has also exposed legacy SCADA systems to security threats that they were not designed to mitigate. This work explores the viability of machine learning methods in detecting the new threat scenarios of command and data injection. Similar to network intrusion detection systems in the cyber security domain, the command and control communications in a critical infrastructure setting are monitored, and vetted against examples of benign and malicious command traffic, in order to identify potential attack events. Multiple learning methods are evaluated using a dataset of Remote Terminal Unit communications, which included both normal operations and instances of command and data injection attack scenarios.

MICLOG RFID tag program enables total asset visibility

RFID tagging and tracking efforts sponsored by DLA under the MICLOG program will support total asset visibility for the military. This system can be used to provide programs such as FCS with persistent knowledge of the location and status of every asset. This will provide commanders the assurance they need to verify logistics and plan missions.

Wireless infrastructure protection using low-cost radio frequency fingerprinting receivers

Low-data-rate wireless networks incorporated in critical infrastructure applications can be protected through 128-bit encryption keys and address-based access control lists. However, these bit-level credentials are vulnerable to interception, extraction and spoofing using software tools available free of charge on the Internet. Recent research has demonstrated that wireless physical layer device fingerprinting can be used to defend against replay and spoofing attacks. However, radio frequency (RF) fingerprinting typically uses expensive signal collection systems; this is because fingerprinting wireless devices with low-cost receivers has been reported to have inconsistent accuracy. This paper demonstrates a robust radio frequency fingerprinting process that is consistently accurate with both high-end and low-cost receivers. Indeed, the results demonstrate that low-cost software-defined radios can be used to perform accurate radio frequency fingerprinting and to identify spoofing attacks in critical IEEE 802.15.4-based infrastructure networks such as ZigBee.

Selection of Multiple Regularization Parameters in Local Ridge Regression Using Evolutionary Algorithms and Prediction Risk Optimization

This paper presents a new methodology for regularizing data-based predictive models. Traditional modeling using regression can produce unrepeatable, unstable, or noisy predictions when the inputs are highly correlated. Ridge regression is a regularization technique used to deal with those problems. A drawback of ridge regression is that it optimizes a single regularization parameter while the methodology presented in this paper optimizes several local regularization parameters that operate independently on each component. This method allows components with significant predictive power to be passed while components with low predictive power are damped. The optimal combination of regularization parameters are computed using an Evolutionary Strategy search technique with the objective function being a predictive error estimate. Examples are presented to demonstrate the advantages of this technique.

Scoping Study on Research and Development Priorities for Distribution-System Phasor Measurement Units

Author(s): Eto, Joseph H.; Stewart, Emma; Smith, Travis; Buckner, Mark; Kirkham, Harold; Tuffner, Francis; Schoenwald, David | Abstract: This report addresses the potential use of phasor measurement units (PMUs) within electricity distribution systems, and was written to assess whether or not PMUs could provide significant benefit, at the national level. We analyze examples of present and emerging distribution-system issues related to reliability, integration of distributed energy resources, and the changing electrical characteristics of load. We find that PMUs offer important and irreplaceable advantages over present approaches. However, we also find that additional research and development for standards, testing and calibration, demonstration projects, and information sharing is needed to help industry capture these benefits.

APPLICATION OF LOCALIZED REGULARIZATION METHODS FOR NUCLEAR POWER PLANT SENSOR CALIBRATION MONITORING

Several U.S. Nuclear Power Plants are attempting to move from a periodic sensor calibration schedule to a condition-based schedule using on-line calibration monitoring systems. This move requires a license amendment that must address the requirements set forth in a recently released Nuclear Regulatory Commission Safety Evaluation Report (SER). The major issue addressed in the SER is that of a complete uncertainty analysis of the empirical models. It has been shown that empirical modeling techniques are inherently unstable and inconsistent when the inputs are highly correlated. Regularization methods such as ridge regression or truncated singular value decomposition produce consistent results but may be overly simplified and not produce optimal results. This paper describes a new local regularization method, generalized ridge regression (GRR), and its potential value for sensor calibration monitoring at nuclear power plants. A case study is used to quantitatively compare different modeling methods.

Automating and accelerating the additive manufacturing design process with multi-objective constrained evolutionary optimization and HPC/Cloud computing

The ultimate objective of additive manufacturing is the implementation of techniques that can be used throughout the full manufacturing cycle. However, since its introduction, the additive manufacturing process has been used for little more than pre-production prototyping. The goal of some current work at ORNL is to change that reality. ORNL recently completed the first step towards optimizing the final design and manufacture of a component part (a cantilever in this case) using computer-aided design (CAD) tools, finite element analysis and simulations, and internally-developed optimization software. This paper will describe the present design process, the tools used, and the progress made thus far. It will also discuss the recent porting of ORNLs Multi-Objective Constrained Evolutionary Optimization (MOCEO) algorithms to ORNLs high performance computing (HPC) resources and to other resources available for Cloud computing, and the path forward for implementing additive manufacturing designs on these resources.

Neutron dosimetric quantities for several radioisotopic neutron sources.

The fluence-weighted and dose equivalent-weighted average energies, and the spectrum-averaged fluence-to-dose equivalent conversion factors have been calculated for 52 spectrum variations of 20 different radioisotopic neutron sources. An internally consistent method of determination enables comparison of values for different spectra. The methodology and results are presented.

4G Security Using Physical Layer RF-DNA with DE-Optimized LFS Classification

Wireless communication networks remain underattack with ill-intentioned “hackers” routinely gaining unauthorized access through Wireless Access Points(WAPs)–one of the most vulnerable points in an informationtechnology system. The goal here is to demonstrate thefeasibility of using Radio Frequency (RF) air monitoring to augment conventional bit-level security at WAPs. The specific networks of interest are those based on Orthogonal Frequency Division Multiplexing (OFDM), to include 802.11a/g WiFi and 4G 802.16 WiMAX. Proof-of-concept results are presented to demonstrate the effectiveness of a “Learningfrom Signals” (LFS) classifier with Gaussian kernel bandwidth parameters optimally determined through DifferentialEvolution (DE). The resultant DE-optimized LFS classifier is implemented within an RF “Distinct Native Attribute” (RFDNA) fingerprinting process using both Time Domain (TD) and Spectral Domain (SD) input features. The RF-DNA isused for intra-manufacturer (like-model devices from a given manufacturer) discrimination of IEEE compliant 802.11a WiFi devices and 802.16e WiMAX devices. A comparative performance assessment is provided using results from the proposed DE-optimized LFS classifier and a Bayesian-based Multiple Discriminant Analysis/Maximum Likelihood (MDA/ML) classifier as used in previous demonstrations. The assessment is performed using identical TD and SD fingerprint features for both classifiers. Finally, the impact of Gaussian, triangular, and uniform kernel functions on classifier performance is demonstrated. Preliminary resultsof the DE-optimized classifier are very promising, with correct classification improvement of 15% to 40% realized over the range of signal to noise ratios considered.