Publications
Showing 12 results for Author: Cory L. Watson
Aug, 2026
Conference Paper
OpenSAMPL: An Open Source Library for Timing and Synchronization Measurements and Analytics
Today's power grid operators are implementing timing and synchronization solutions that provide resilience to Global Navigation Satellite System (GNSS) vulnerabilities. These vendor-specific solutions often come with additional software applications that are designed to monitor that vendor's synchronization performance data. However, resilient timing architectures often re…
Mar, 2026
Conference Paper
On the Abuse and Detection of Polyglot Files
A polyglot is a file that is valid in two or more formats. Polyglot files pose a problem for file-upload and generative AI web interfaces that rely on format identification to determine how to securely handle incoming files. In this work we found that existing file-format and embedded-file detection tools, even those developed specifically for polyglot files, fail to relia…
Mar, 2026
Conference Paper
Towards a High Fidelity Training Environment for Autonomous Cyber Defense Agents
Cyber defenders are overwhelmed by the frequency and scale of attacks against their networks. This problem will only be exacerbated as attackers leverage AI to automate their workflows. Autonomous cyber defense capabilities could aid defenders by automating operations and adapting dynamically to novel threats. However, existing training environments fall short in areas suc…
Oct, 2025
Journal
The Path to Autonomous Cyberdefense
Defenders are overwhelmed by attacks against their networks, which will only be exacerbated as attackers leverage artificial intelligence to automate workflows. We propose a path to autonomous cyberagents able to augment defenders by automating critical steps in the cyberdefense lifecycle.
Jul, 2025
ORNL Report
Implementing a Terrestrial Timing Solution: Best Practices
This document is an overview and guide on the concept of precision time and how an alternative terrestrial timing solution to the Global Positioning System (GPS) can be implemented. A set of recommendations and best practices, derived from research at Oak Ridge National Laboratory, across industry, and within the US government are provided to enable implementation of a sys…
Oct, 2024
ORNL Report
CAST Technical Bulletin #002: Time Synchronization for Next Generation Power Delivery
This technical bulletin gives a description of the updated effort on Oak Ridge National Laboratory (ORNL) Center for Alternative Synchronization and Timing (CAST) project’s work investigating a terrestrial-based high precision timing infrastructure intended for time synchronization of the next generation power delivery infrastructures. We will provide a high-level descript…
Aug, 2024
ORNL Report
CAST Technical Bulletin #003
This CAST technical bulletin highlights the importance of GPS connectivity for Remote Timing Units. This bulletin will describe how GPS is currently used in a timing and synchronization architecture to validate the accuracy of a PTP signal. GPS provides an important link to an authoritative timing source and enables the calibration and validation of terrestrial timing syst…
Feb, 2024
Conference Paper
AI ATAC 1: An Evaluation of Prominent Commercial Malware Detectors
This work presents an evaluation of six prominent commercial endpoint malware detectors, a network malware detector, and a file-conviction algorithm from a cyber technology vendor. The evaluation was administered as the first of the Artificial I ntelligence Applications t o Autonomous Cybersecurity (AI ATAC) prize challenges, funded by / completed in service of the US Navy…
Dec, 2023
Conference Paper
Assembling a Cyber Range to Evaluate Artificial Intelligence / Machine Learning (AI/ML) Security Tools
In this case study, we will describe the design and assembly of a cyber security test range we have built at Oak Ridge National Laboratory in Oak Ridge, TN, USA. The range is designed to provide a flexible environment to evaluate cyber security tools—particularly those involving AI/ML—in a way that provides realistic environments and where we can control the experiments to…
Dec, 2023
Journal
Testing SOAR Tools in Use
Investigations within Security Operation Centers (SOCs) are tedious as they rely on manual efforts to query diverse data sources, overlay related logs, correlate the data into information, and then document results in a ticketing system. Security Orchestration, Automation, and Response (SOAR) tools are a relatively new technology that promise, with appropriate configuratio…