CVT Workshop October 31 November 1, 2018 Anomaly Detection in the Monitoring of Nuclear Facilities Elizabeth Hou, Karen Miller, Alfred Hero University of Michigan, LANL, University of Michigan 11/01/2018 LA-UR-18-29296, LA-UR-18-26921, LA-UR-18-30107
Mission Relevance The objective of safeguards is to deter the spread of nuclear weapons through early detection of the misuse of nuclear material or technology Increased use of continuous, unattended monitoring has opened the door for the IAEA to move beyond static signatures to characterizing dynamic activities in aggregate over time and space Characterizing activity patterns provides a baseline to define normal so we can identify early indicators of events and cue on things that are abnormal 2
Motivation Want to be able to process this continuous unattended data in an automated fashion Learn to detect abnormal or anomalous activity through models and algorithms Modeling the baseline or distribution of nominal activity and detecting deviations from it Directly separating anomalous activity from nominal activity 3
Motivation Learning requires training on data 1. Computer simulations: generate data from computer models 2. Real Life simulations: collect data from real sources 1) Using expert knowledge, simulate data using Matlab/R/Python 2) Collect data from a representative testbed that has meaningful real world applications 4
TA-66 Safeguards Training Facility TA-66 is used for nondestructive assay training courses featuring hands-on U and Pu measurements Building includes office spaces, conference rooms, and a laboratory Course instructor with IAEA safeguards inspectors in the TA-66 laboratory 5
Why TA-66? Category 3 radiological facility where sealed sources are used regularly for training and experiments e.g., U, Pu, fresh fuel assemblies Not a production facility allows for greater flexibility in performing experiments No sensitive operations are performed at the facility, which minimizes security overhead and allows results to be shared 6
LANL s Source Tracker database logs transactions associated with nuclear material movements between material balance areas The database records information such as Date and time Name of person making transaction Transaction type (check in, check out, transfer, etc.) Source ID number Material type (U, Pu, etc.) Facility Data Streams 7
Facility Data Streams Standalone 3 He-based neutron slab detector in the TA-66 lab continuously collecting data Standard IAEA hardware and software Portable Handheld Neutron Counter (PHNC) Advanced Multiplicity Shift Register (AMSR) Laptop running Multi- Instrument Collect (MIC) 8
Facility Data Streams Inexpensive sensor nodes assembled with COTS components & capable of onboard processing RoboDyn Microphone SenseHat (IMU, Humidity, Temp) Wingoneer Light Sensor Raspberry Pi Computer 9
Misuse Example Detecting scenarios pertaining to the misuse of nuclear facilities is a safeguards problem Mimic the change in status of a plant from a normal commercial plant to one that is misusing by a change in status of the use of a room in a testbed facility Different activities will have different neutron signatures Always a certain amount of background neutrons Target misuse events specifically by labeling some examples of misuse and some examples of other rare events in neutron detector data 10
Safety Example Faulty ventilation in an area exposed to radioactive materials is a testbed scenario that mimics a real life problem A faulty HVAC system could cause the amount of radiation in a facility to increase Reduce risk by early detection of increasing radiation background levels Cannot physically simulate this in a real-world testbed, but can induce it synthetically in real data collected by a testbed facility Synthesize by using domain knowledge from safety experts, physics modeling, and simulation codes 11
Other Examples Some other testbed scenarios that have real world applications include: Materials being diverted during shipping transactions within a network Diversions causing a material to change (slowly decrease) in mass over time Incorrect or falsified logs leading to a safety issue or to allow for a diversion of materials 12
Anomaly Detection Algorithms Compared to rule-based, statistical methods have Advantage: Can identify novel types of anomalies that are previously unknown to domain expert Disadvantage: Sometimes the anomalies, while statistically rare, are not interesting to the domain expert Proposed Method: Detect high-utility anomalies of interest to the domain expert by exploiting the idea that all high-utility points are statistically rare 13
Misuse Computer Simulations Synthetic data generated to mimic counts from a neutron detector in a lab (Poisson generated data) Nominal: Days with no lab activity Anomalous: Low Utility: Course Days High Utility: Experiments After Work 14
Misuse Dataset Properties Samples: 10 years of data, each day is a sample Features: total counts during the work day (7am 7pm) and total counts over 24 hours Approximately 1 course per month (3.5% of samples) and two experiments per month (6.5% of samples) Partial labels on days that have experiments/courses (20%) Not all courses are publically announced Scientists doing experiments do not always log their activity 15
Misuse Simulation Results 16
Misuse Simulation Results Increased Experiment Activity 17
Safety Computer Simulations Synthetic data generated to mimic counts from 8 neutron detectors in a facility (Poisson generated data) Failure of HVAC system causes background radiation to increase Want to detect when the HVAC system fails and where the failure is located 1 Data: 8 sensors collecting 1140 time samples 7 8 2 3 Algorithm: Generalized CuSUM Sensor Array 6 4 5 18
Safety Simulation Results HVAC fails near sensor 5 at t=360 Sensor Est. CP 1 900 2 840 3 720 4 720 5 420 6 660 7 840 8 900 19
Conclusion In collaboration with LANL, we present a testbed facility to generate real data for the study of safeguards scenarios We demonstrate with computer simulated data that we can detect potential misuse scenarios using our proposed algorithm In the future, we plan on working with real data from the testbed facility We plan to couple our algorithm with ones that can incorporate multiple modes of data (e.g. both neutron data and text logs) 20
CVT Impact This work was done in collaboration with Karen Miller during a summer internship at LANL In the next year, we plan to return to LANL to test our models on the real data collected at the TA-66 facility I have participated in summer internships for the last 4 summers with CSS-6 at LANL I attended Conference on Data Analysis (CoDA) 2018 21
Acknowledgements The (CVT) would like to thank the NNSA and DOE for the continued support of these research activities. This work was funded by the under Department of Energy National Nuclear Security Administration award number DE-NA0002534