b'Signal decompositionMachine learning and artificial intelligence coupled with high-fidelity for intrusion detectionphysics algorithms enhance cyber security in integrated energy systems.in reliability assessmentT he complexity involved in ensuring cyber resilience for physical process interactions in connected systems such as energy grids increases in cyber resilience dramatically as the coupling between processes becomes more direct and responsive. An example of this growing complexity is seen in integrated energy systems where various processes such as nuclear heat generation and commodity production are coupled for increased responsiveness to variable signals such as market pricing and electricity demand. This causes the potential attack surface of the coupled processes to be larger than those of the two independent processes. PROJECT NUMBER:Securing these complex systems requires a two-fold monitoring approach that 21A1050-024FP involves both cybersecure monitoring for potential malicious incursions and physics TOTAL APPROVED AMOUNT:monitoring for system tampering. Physics monitoring includes analyzing the signals $1,287,000 over 3 years within the system for anomalous behavior. Such analyses have proven insufficient when based solely on data-driven machine learning and artificial intelligence PRINCIPAL INVESTIGATOR:techniques or on low-level model comparisons. Previous efforts at Purdue University Paul Talbot, INL indicated that combining high-fidelity models with machine learning and artificial CO-INVESTIGATORS: intelligence algorithms could serve as the basis for a software tool that detects Bri Rolston, INL anomalies in physical processes. Dylan McDowell, INL The present work built upon that concept, developing an advanced library for Hany Abdel-Khalik, Purdue University signal decomposition and analysis by using both machine learning and artificial intelligence and high-fidelity physics algorithms to enable greatly enhanced anomaly detection capabilities, especially regarding detecting false data injections. This software can be used as part of a secure embedded intelligence system designed under consequence-driven cyber-informed engineering for complex coupled systems. The new advanced library provides the foundation for online and posteriori digital signal analysis to detect potential malicious tampering that represents physical processes. Demonstrations conducted throughout the development highlight the effective use of characterization algorithms to detect signal perturbationsparticularly triangle-attack-style perturbationsin three wide-ranging applications: seismic monitoring, nuclear thermal-hydraulics system simulation, and custom manufacturing.Signal-Oriented Network Anomaly Recognition anomaly detection algorithm workflow. Mapping complex digital signals to a characterization space enables detection of otherwise undetectable perturbations.112'