Hi, so my name is Tim Yardley. I'm here to talk about some work that that I've done under DARPA radix program Whoa, I'm getting audio from somewhere. Oh, I'm sorry about that. I was getting feedback from the live channel So I am here to talk about building a cyber physical test bed And how we've used that to support black star rest black start restoration under cyber fire So this has been part of a of a DARPA radix program The radix program is rapid attack detection isolation and characterization systems and I'll talk a little bit about what that is here in a minute So just for sort of coverage and In statement the test bed work that I'm going to talk about was funded under the DARPA's Rapid attack detection isolation and characterization systems program. I work for the University of Illinois. I'm the principal investigator of the University of Illinois effort under there We also had some government's me support subject matter expert expert support from Idaho national lab and then The program evaluator is a company called provatech And all three of those organizations have been critical to To the work that i'm talking about in terms of enabling The black star restoration efforts and and the validation of the work itself So let's talk a little bit. Give you a little background on me. So my name is tim yardley I'm a principal research scientist at the information trust institute at the University of Illinois And I am also a father a husband and in broadly a researcher I've been doing Work in industrial control systems for about 14 years now And I've been doing work in security for She's probably almost 30 years now across the board My background came from sort of the think tank IRC eras back in the early days of f net groups that that let's say Like to explore and like to figure out things but also cause some havoc in the process One of the original members of woo woo and a variety of other security think tanks over the years And and I've sort of been in the in the realm of of computer security for for quite some time I've been working in academia for about the past 12 years And prior to that I worked in industry supporting a variety of different efforts So the DARPA radix effort itself Let's talk a little bit about what it is. So the program is designed to Build technologies that fill a gap and that gap really is the notion that That if we are attacked by nation states, we are ill prepared To be able to determine exactly what happened where it happened and how it happened and get rid of it as fast as possible So DARPA stood up this program to build technology that that advanced that state of of Let's say preparedness and then to evaluate that technology on a realistic Facility and so our role in that program was to build that realistic facility We'll talk in more detail about sort of the objectives of the program itself So these are all public slides from From DARPA that are here But but the key objective of the program itself is to enable black start recovery of the power grid Amidst a cyber attack on the energy sector's critical infrastructure in this particular case the critical infrastructure is the electric power grid so In a prevention Sort of state you would say okay. Well, let's defend and detect what's going on But this program starts from the adversary has been successful. So you have a complete blackout No power anywhere and you have to figure out exactly what happened how it happened et cetera so the Devices that are involved you have to figure out what devices can be trusted because you don't know what's compromised and what What is safe or what is operating? per norm and many of those Of the physical infrastructures are are effectively controlled by By intelligent devices. So these are the ics devices that you have to explore On let's say the cyber side of the equation that are controlling the physical aspects of the grid And these assets are spread throughout the country. So how can you do this in a scalable way? How can you deeply and forensically poke at these embedded devices? How can you figure out exactly? What is trustable? What is not trustable? What was attacked how it was attacked and then get rid of it as fast as possible? The goal is to do so across the entire united states within seven days And that's to isolate characterize and restore Any crank paths necessary to bringing the the grid for the united states back online? So Let's talk about the manifestation of this so in the first Year or so year and a half of the program We built exercise environments that were run at the University of Illinois That we're getting people's feet wet and getting the technology ready to to explore Let's say the beginning edges of the of the problem space And as we evolved both the technology and the program We had to turn the corner. So people will only believe What happens in a lab to the extent that it's Oh, that was in a lab environment. Oh, that's fine. If you do it just on science, but that's not the real world So we took it to a federal island, um, which is called plumb island. It's the home of the animal disease center controlled and owned by dhs s and t and uh, and is a former Citing of fort terry in the spanish-american war and a bunch of other stuff The size of the space that we're controlling there is roughly the size of central park And we have built electrical infrastructure on that island And so i'll talk about the most recent incarnation of it that that was completed in november of 2019 That was the sixth exercise of the program We have one more exercise still to do covet has As postponed that a little bit, but uh, but still pending so far has not been fully canceled And we uh, we look to sort of do that last uh last to rob the program and uh invalidate the advancements from From the last exercise till now So in the island infrastructure We basically have built uh, three full utilities and those utilities are represented by gear that we'll talk about here in a moment Uh, they have an emergency operation center for each utility And then there's a regional coordinator that's trying to coordinate the actions amongst the different utilities as it goes through We have, uh, the national guard involved. We have, uh, the radix performers involved And lots of other Entities that that help establish communications in a variety of way and really set up What is a a fairly austere environment from the beginning to enable the the capture and and execution of of these exercises So, um utility a has five low voltage substations and i'll talk about what low voltage means to us And one high voltage substation. It also had one generator which uh, which is the crank path in essence That's getting to the high value assets utility b had seven low voltage substations along with three high voltage substations And that uh crank path had a critical national asset on it that needed to be up and maintained No matter what uh utility c Was similar to utility a it had five low voltage substations and one high voltage substation as well as one generator And so each of these utilities differed in the physical topology and layout of the substations They also differed in the equipment that was deployed across each of those substations So the program is really broken into um into multiple different technical areas You could look at it as four or five depending on how you want to count The first area is situational awareness. And so when they deploy on this infrastructure that we've built They are trying to figure out what happened or what is currently happening On the infrastructure to get as much situational awareness as you can provide And the reason for that is you can't really trust the devices once they've been attacked to be telling you the right things Um, and you you are in a blackout scenario. So you may not have Visibility in much of of the grid environment network isolation is technical area two and technical area two is focused on taking the uh communications that are no longer necessarily trustworthy And expanding those into a realm of trustable or not. And so by that, I mean Point a to point b may have talked to each other before Uh, and it used to be a dedicated private link or or whatever it may be but now uh traffic that's going across there is not Um, uh, not reflecting what it did previously. So maybe somebody's man in the middle of it Maybe somebody is manipulating it. Maybe it's getting black hole in some other way Um, unknown operation, right? So how do you take the outputs from a and get it to be in a way that's trustworthy and secure And such that it cannot be Modified in the middle or that it is evident when it is modified in the middle So that's the area of technical or the the area of research for technical area two Technical area three is thread analysis. Um, and they really are intended to do the forensic response per se on the devices itself So how do you diagnose and remove cyber threats from the embedded devices from the different pieces? Uh that are involved, etc. Uh as you go through the the uh investigation part of of the environment So the environment itself is technical area four. Um, and that's conducted by us at the University of Illinois Uh, and that is the environment by which, uh, the exercise happens, which is on the on plum island But also the environment at the University of Illinois campus That uh, the performers remote into to build out their technology to extend their capabilities and to investigate The edge cases of of how the grid operates when certain things happen to these devices So that's part of our central facility and I'll talk a little bit about that And then the island is basically a distributed manifestation of that central central facility at Illinois The last technical area is technical area five and effectively that is the evaluators of the program. Um, and they build out how to run an exercise in this space and how to Determine whether or not progress is being made on the on the technology What the appropriate challenge levels are the let's say pain points or or how deep or how hard the red team pushes Etc as we go through the the environment and they technically grade technical areas one two three and four As they as they go through that Uh So, uh onto the next slide Radix exercise six was really a move from Strategic to the strategic notion early on in the program to operational notion With the utilities involved etc to a technical deployment on on top of that so If you look up in the upper left hand corner The strategic notion is is the concept that we talked about of you have a large-scale blackout and what you need to Accomplish the operational notion notion is the building and establishment of these crank paths And then the tactical is let's execute on those crank paths and figure out exactly what happened and how it happened So, uh, the picture on the bottom right at the moment Is a drone footage Sort of Zoomed in on one of the substations and you can see that they're built in shipping containers and those shipping containers have gear inside them that That i'll show you here in a moment And then these containers are arranged and linked together to build the the crank path and we do that with with basically above ground number two so cord That has connectors on the end that we plug into to the individual gear that we have Inside the boxes i'll show you what that looks like here in a moment um So you can see sort of a little bit of an edge here of of what is inside a container So this is standing inside a container looking out at the moment With the door open So on the left hand side there, you'll see what we call the relay box on the right hand side You'll see what we call the power box Which is a skid mounted Hoffman enclosure that the controls The flow in essence of the substation So that's the power grid aspect and the controls of those grid components are are in the The relay box on the left hand side There's also some sensors that are up on top that are providing Or that are performer technology providing some of the situational awareness and attempt to determine ground truth As we go through the environment and i'll zoom in on a lot of this as as we talk So i'm going to only talk about the test bed itself i'm not going to talk about any of the performer technology that specifically built but But i'll i'll dig quite deeply into the test bed, which is my area of responsibility So the mission that we set out to do is to provide realistic environments that enable this cutting edge r&d That's not yet done by any commercial available product Or any existing research off the shelf And then we take and create this environment in a way that allows us to validate the effectiveness and And frankly the efficiency of those tools as as we go through So the goal of the program itself is really to take a generational leap forward in the capabilities of test beds so we've Been building cyber physical test beds And leveraging cyber physical test beds for about 13 14 years now at the University of Illinois By many accounts were sort of the gold standard in terms of capabilities across the the nation And and arguably the world But even so when we pitched our our capabilities for this program our our Proposal and the going in salvat of of our proposal was effectively We have assembled the right team to solve this problem But what technology exists today and where test beds are today across all of them that you will encounter in anyone that bids All of them are woefully inadequate to be able to actually go to the level of realism that will be necessary to validate these tools Um, and even with us, uh, it is an extreme long shot As to whether or not this will be achievable in in the time frame and advancing fast enough to be able to support this post attack analysis And so so let me riff on that for a second Cyber physical test beds before this program started were primarily focused on let's either build an environment where we're looking purely at a physical Phenomenon or let's build an environment that's proving out a hypothesis physical or cyber and look at Look at it from that particular angle sort of ignoring all of the other details But in this program everything is unknown coming in you don't know what the attackers did to you You don't know even what the attackers want to do to you Um on the environment So you have to have every piece of it as real as possible, but you can't possibly go build um, you know, uh three real crank paths and 24 27 real substations Uh out there because it just costs way too much money to do and it's a dangerous environment to be in So how can you minimize? The environment maximize the safety um and also maximize the realism without Running into problems of naysayers with uh simulation being involved or emulation of devices, etc So they need to be able to touch it. They need to be able to feel it. They need to be able to see it And uh, and they need to be able to trust that what it does and how it works is going to be Reflected or reflective of what happens in the real world so The outcomes of of the test bed work itself, uh, obviously we've created a lot of tools We've pioneered some new techniques and methodologies. We've combined existing solutions both that we've had and that others have had To to build an environment together and we combined that not just the academic knowledge that we had at the University of Illinois But in partnerships with key vendors and uh, and also with uh with asset owners and and operators and to build really an environment that That reflected not only the real world, but that that took a whole leap forward on on its ability to evaluate research So what is a test bed? so a test bed really is is somebody has a need let's call them the customer and And that need is to evaluate something and so a test bed is Assets the thing maybe that they want to evaluate on It's the people with the knowledge on how to build that environment in the way that That represents the scenario they need to look at etc What to capture how to capture where to capture it etc It's the science of how to do so in a realistic way while still enabling the necessary data capture that sometimes these systems Inherently don't support And then it's that data itself and that data itself is what is captured from the devices either willingly or not How the system was operating packet captures as an example of the communications that are going across Ground truth as to the physical telemetry of what was actually going across not just simply what the devices Our reporting is happening And then a manifestation of or configuration of all of those things together That is provisioned out into an environment that you then do the work on And so our capability we can provision locally the assets in in our central environment We can provision portable environments like what we've built on on plume island and deploy on plume island And we can also provision into the cloud in a variety of different ways So Why a test bed? What what's the value of a test bed? You've seen obviously the ics village and capture the flag stuff But this is a little bit different right And the reason for a test bed the reason for the work that we do is that this mission critical technology And why do why do I call this mission critical technology? So the technology being built under radix Is intended to be uh, let's say habits glass broken when We're in a blackout scenario effectively After we've been hit that's where the real value of this technology is And there's arguments and and I am one of the people that will argue this that that technology needs to be used even before we're hit but But in the end our grid is down That's what this technology is built to solve And so it is absolutely essential if this technology is called to practice That it works and that it Resolves the issue or that it can figure out what's going on in the issues, etc Before we need it because if we don't and we're in a national blackout a national disaster sort of scenario Attacked by an enemy or otherwise How do we how do we come back if we break the glass on this technology and it's not been proven to actually work? And so you run it and it's like I can't figure out what's going on I see nothing wrong. There's no problems here whatsoever, but the devices still won't turn on The grid still is down These devices aren't operating correctly And that's a bad scenario to be in so this is truly mission critical technology And we have to prove that it's effective before we need it But we have to go beyond the theoretical testing of it We have to put it in all sorts of scenarios across all sorts of different platforms to verify that it works even in edge cases that it wasn't expecting in Circumstances where it's missing data in circumstances where it's even being directly attacked or or attempted to be Let's say misled on what is going on so Our our solution for that is a realistic recomposable and well instrumented test bed Is essential to being able to prove that out because even the real grid environment Cannot be manipulated in the way that we can with the test bed environment And I'll talk a little bit about some of the innovation in that space Um and frankly everything as I started with my opening salvo and the proposal that existed including the illinois capabilities Wasn't good enough before this program started So our approach across it is to build real systems. Um, we also build models Looking at models on the cyber side and physical side That adapt to the exercise needs that help us build out behaviors and changes in the flows and the communications of systems To operate like the real world or to operate In a way that an adversary may be able to manipulate Everything is built in this modular way. It's adaptable and and let's say recomposable in a variety of different ways So we can take a piece and take a substation and how it's physically wired and physically set up at the moment Press a couple buttons push a different configuration And now it's a different substation same devices different configs Different network layout, uh, etc. And all of that Um adaptability or modularity allows us to recompose the system in any way necessary To present different challenges, etc as we go through There's also instrumentation. And so the instrumentation is key in that Many of these systems, let's say will cooperatively give you a certain amount of data But sometimes when you're doing forensic, uh, analysis, you need to be able to gather things that are deeper Or if you're trying to do experimental validation, you need to be able to look at things that the system inherently won't tell you Or you need to look at it with much more scrutiny than what you would typically look at in the real world So how do you do that and turn on an appropriate level of of data output data capture Etc. But that doesn't actually affect the behavior of the systems because sadly some of these systems as you may know Are underpowered and if you turn on let's say Full complete logging of the system or other things it can bog down the operation of the system And then it no longer participates or acts as it would in the real world So the last part is is really knowledge and um by that I mean We don't just say look as academics. We're bright people trust us. This works. We had to bring in real operators We had to bring in the the manufacturers the vendors across across many different platforms and talk through with them Their best practices. There are common misconfigurations that they see when uh when integrators are building their platforms The uh common ways that they configure their substations in the real world for the asset owners um Etc to both cause Let's say Human error to happen in ways that people accidentally misconfigure things But also to mimic as closely as possible how people are actually configuring these in practice And that is to get the right level of protection the right level of output of data And and even notions of like, okay, what does a SIP compliant? Substation look like in terms of what it is logging or not versus one that's not Um, so that all comes together in that knowledge area On the innovation side, um, we had to innovate quite a bit. Uh, and so the let's say orchestration or automation stuff that we had previously, uh was Good enough for research But it made a lot of assumptions And so by that I mean it would operate in a centralized environment But when it tells something to be reconfigured or tries to control something it expects that a the device is reachable B that that it has access To that device that it has the credentials to get on that device It assumes I guess c that that it Knows what the state of that device is And then lastly everything that it did before it also assumed that the device was trustworthy and in a known sort of condition so we had to let's say break down all of those assumptions and operate in a way that that let's say Didn't rely on any of those existing substations We applied a bunch of research as well, obviously, uh, we had uh, you know over a decade of of work in the prevention space and In the detection space and and remediation space at the University of Illinois And we had used that in the test bed in a variety of ways We had used it or proved it out in the test bed some of which is even in formal companies now Transitioned either to big vendors or as startups And we had to apply that in in sort of a different way as part of the test bed not to just Say, okay. Look, here's the test bed environment But for instance if we could reach deeper into a device Then we used some of that research that we had to dig deeper into those devices And pull out and extract information that supports the validation of the technology without affecting the performance of the device itself our team In particular myself and a few others have went really deep on some of these platforms over the years And so we brought a wide variety of Devices to the table that we already knew quite a bit about on the inside Sometimes even let's say one could argue more than what the vendors know about their own devices In in terms of the knowledge and ways that we could poke around inside of these these platforms We had to also build because we needed to deploy on on an austere environment If you don't have it Then you better bring it type notion And so we had to build these boxes in a way that were field serviceable We had to be able to quickly replace Components of the system if it were to break or if the intent of the cyber attack against it was literally to brick it So that it was no longer functional How did we restore that or replace that in as fast of a situation as possible? To move on and not basically stop the whole exercise if something were to break We had to advance our automated configuration data extraction And and also the notion of the system and its observation when even the network links were no longer trustworthy or Reliable to be up or down Remember we're in a black start scenario So we don't even we're not even guaranteed that we'll have power On each of the substations to be able to communicate to them and when they're brought up we need to You know Maintain the state of everything we captured as they go up and down like uh like uh, you know, uh, see Seesaw As as they're being attacked and brought up and brought back down etc And then we also needed to have the environment in a way that could be recomposable change the structure of the crank paths Change the behavior of the substation itself without going through and recabling or rewiring everything that's in there on a hands-on nature So what are these environments? So, um combined I call them The substations in a box. It's two components. Um, this has been built on on the extensive facilities We have at the University of Illinois that I've sort of alluded to We have roughly a hundred million dollars worth of hardware and software at the University of Illinois that have been Built up over the past decade plus Much of which by donation That's enabled all sorts of research that we've done in the past With trustworthy cyber infrastructure for power, which was an NSF effort DOE DHS effort called Trustworthy cyber infrastructure for the power grid it had grid to the end Our most recent center That's wrapping up in the next year or two called the cyber resilient energy delivery consortium Which is also DOE and DHS funded Our critical infrastructure resiliency institute in a variety of other things that that Have have and leverage the test bed resources that went on So the substations in a box as I mentioned they're designed to support this black star crank path analysis and deployed in the field Real grid environments built etc. They're built in pelican style cases. So they're literally shiftable and deployable anywhere We need to stand them up. They're generally mostly ip 55 watertight, uh, when when they're, uh Shipped and and moved around When you physically deploy them, we take the case lids off and put them in enclosures The reason for that is is literally so the devices inside don't overheat But also because you do need some physical access to the devices to control breaker operations and other aspects We built an environment on an island. So the power infrastructure of what is in the overhead and underground stays But basically everything else gets torn down and built back up every six months in a different way There are currently 26 variants of substations deployed across Across that infrastructure those substations have relays rtu's substation network switches routers As well as an experimental fabric underneath. Uh, that's controlled by stn That allows us to do a lot of the capture and and let's say dynamic changes of of the substation itself All sorts of protocols are deployed. You can see a list of them up on on the screen There's both serial and ethernet communications. We have custom power connections on the power boxes that allow us to To link these systems together in a safe way And then we have a high voltage infrastructure that i'll talk about as well So, um, what's a power box and what's in a power box? So power boxes basically think of it like the physical infrastructure of Of the island or or of a real substation. So that's the breakers the bus bars The incoming and outgoing feeders on the system We have a local load feeder as well We have signalization lights that indicate what the status is of energization what the status is of breakers We have a dead bus sync light that that's Provided we have analog sync check relays contactors auxiliary contacts on the systems cts and pts Control circuitry behind that allows us to operate breakers and various other stuff We have different modes of operation sort of a safe mode where we can walk away from the system and the system can't possibly change which is a Sort of a unique scenario from the real differing from the real world And then we obviously have the ability to locally control Breakers as well. So what does that look like? So there are effectively two Types of power boxes inherently that we've built One is a 208 volt three phase system. One is a 480 volt three phase system They look basically identical from the front except for the size of them is a little bit different We also have these high voltage systems, which really are Hoffman enclosures that are wall mounted and act like let's say semi intelligent Uh breakout boards for for providing telemetry from the high voltage gear To the corresponding devices that are then operating and controlling that high voltage gear And so think of it sort of like a mapping board in a way And each each power box generally has an incoming circuit a load circuit and then two outgoing Circuits As it's built out. So basic electrical diagrams in the in the middle But nothing let's say Shocking about that and then there's the other side of it. And so Each of these devices have the number two SO cord coming in to these Hubble connectors on the edge But they also have billicle cords, which are Amphenol connectors mill spec amphenol connectors that basically take all of the telemetry of what is happening on inside the box And provide that telemetry to the devices that that need to control it So that includes the analog and digital signals that need to be sent back and forth between the devices to control them But but also the CTs and PT outputs, etc From the system itself so that all of the sensing is is detectable by the relay boxes And so what are the relay boxes? Well, the relay boxes are really the brains of the substation So here are a couple examples showing some of the different technology that that's in play Up in the upper left. Those are ABB relays along with an ABB RTU. This is sort of a legacy RTU Platform that ABB leverages or uses and has deployed around the world called the RTU 560 In the middle you'll see Some more ABB relays middle top And above that instead of an RTU 560 you see a Motorola device. This is a Motorola ace 3680 If you move to the next image a upper right hand corner That is an ABB comm 600 rack mount or a comm 600 r That is acting as the RTU over those ABB relays that are there Bottom left hand corner. You'll see some touch screen SEL 751 relays those are controlled the RTU in that particular case is an SEL R-TAC a 3505 In the middle you'll see touch screen relays and in that one there's an SEL R-TAC as well, but that's an SEL R-TAC it's a SEL 3530 instead of a 3505 And and then the far right you'll see more SEL relays. These ones are not touch screen These are another variant of the SEL 751 and those ones are being controlled as from an RTU perspective by a Novotek Orion LX So this shows just some of the diversity of of platforms that are there. There are much more obviously across 26 substations Every single substation is unique in some way shape or form So we have a lot of diversity across across the environment in terms of platforms Technologies and configurations and so diversity could be purely on the configuration side. For instance different protocols being being communicated different topologies being set up between Utility a utility c utility b etc It's and lots of other variation on top of that so Let's talk about some let's say lessons learned from the program more challenges that that we had to Tackle now that you understand some of the gear. So first off is safety When you can't trust anything in the system whatsoever Because it is compromised and it's compromised in a way that you may or may not No, may or may not be able to determine and you don't know what is trustable or not All of the systems that are there are effectively designed to protect you But if you can't trust the digital systems to protect you anymore then you need additional layers of protection So we had to layer protection throughout the system in both physical and cyber form And that included things like analog time Analog protections in the system like analog sink check relays time over current protections thermal protections On the digital side or on the cyber side the protective relays were configured with safe insane settings for Overvoltage and undervoltage conditions, etc. The boxes had arc flash analysis done on them to determine Potential exposure or safety measures from PPE perspective that needed to be done The cabinets were all either padlockable or direct key lockable We had on the high voltage side and telerupters that were acting as fail safes If there's anything that flows through the low voltage to the high voltage side An out of sync close or something like that that happened to happen Or a surge somewhere the telerupters or a fault on the line The telerupters were there to protect the the system at the high voltage side We also purposefully did not target the high voltage control That way we didn't run into into let's say big issues low voltage was something we We could cause a problem on and be okay with but on the high voltage side people could get hurt All of the connectors we used were screw-in locking style connectors We had all sorts of internal wiring protection, etc So the key is is that the environment itself was designed to be safe no matter what So people that knew nothing about power systems could still safely operate in this environment and not Not run a risk of being electrocuted or or whatever We always had power engineers and safety officers effectively on site that were making sure that people did safe operations and maintained The necessary perimeters even at a noise level from the generators and in various other aspects But really the system protected itself in every way shape and form Even when the system wasn't trustable So let's talk about some operational lessons that we learned in executing exercises for black star restoration, but also In austere environments under conditions of blackouts, etc And so let me talk a little bit about the mode of execution as we as we go through this So when I say that we're operating utility environments, we are actually operating the utility environments and by that I mean utility operators from real utilities come to the island and they run the infrastructure And they basically take control of it. We hand it over to them And then they tell everyone else what to do how to do it when to do it, etc On the system now, obviously we have some exercise control over that But the intent is to really make this as real as possible. So let's talk about that realism Many people don't believe what is possible until it really is let's say slapping them in the face and by that I mean A common view is look relays. They're embedded Devices you can't make them do things you can't disable their protection. You can't Um, uh change their mode of operation beyond their config Um, and until they saw us do that They didn't really believe it even when it was happening right in front of them They still didn't believe it until they dug deeper and started to look deeper at what was happening and how it was happening To realize that look bad things really are possible that Right now your mindset is that this isn't possible at all that no one can do that You had to you know physically modify the device in order to do that and it's like no we can actually do that via cyber means So let's talk about the people, right? one of the things that uh, that was uh, an operational lesson Is academia is really good about thinking outside the box But we needed to be extremely agile and think even further outside of the box and push through and build stuff that uh, frankly Was uh, let's say impossible to build at any given moment We took on building one utility then two then three All in six month iterations completely different architectures completely different devices building the physical boxes Uh and standing it up in a new realistic configuration Uh at each sort of interval Uh, that's pretty difficult to do it's multiple weeks to build the environment each time It's multiple weeks of testing. It's multiple weeks of evaluation to make sure that it is as real as possible That it doesn't have inherent artifacts itself that people may view as compromises, etc In the system that it is pristine blue sky trustable, uh, etc And built the way it should be built And that results in let's say extreme levels of stress at at times But as a team not just the University of Illinois, but broadly the entire program We all pulled together and found success in every exercise that we had There was no exercise that failed because the infrastructure or the people failed to deliver Um, and so that brings us to pace. So I mentioned every six months So DARPA programs move very fast and the expectations are very high of the technology of the evaluation of the test bed Etc. And so there were many times that we Were facing failure, but let's say by by pure blunt force and by pure blunt force. I mean uh, number of hours and long days and Um, and leveraging and leaning on on each other throughout the program We were able to pull through and pull off what seemed to be impossible Uh, when we started So those are some just operational aspects, uh, that we learned as as we built the environment Especially out on an island. And so when I say, you know, what are some challenges, right? So there were times when we were, you know, we took a ferry every day from the mainland to the island And there were times when, you know, northeasters were blowing in and other aspects where the waves were 12 14 feet high and the You know conditions were such that if you go to the island, you're going to be sleeping there because you're probably not going to make it off um, and that's kind of, you know, let's say A bit much But uh, but there were many days that happened like that. There were days we were out there executing the environment trying to restore after the cyber attack, uh, and uh, and you know, there was northeasters blowing through with 40 plus mile an hour winds And downpours and inches of rain falling an hour Etc. So not just hard from a technical perspective, but even harsh environments that we were out In as we were trying to restore these these devices And and as the teams and the utility operators were operating these devices Faced with those types of environmental conditions So we learned a whole bunch of other lessons too. So one of them, um, that was interesting to us was that uh, when when the systems are intended to break When you know that you can't trust anything anymore You have to think differently about what you can build And how you build it so that it works consistently and reliably Even when everything is intended to be broken So that goes back to some of the stuff we did with safety But also on on the cyber side. So as an example, we had no guarantee of power reliably or not At any point in time. So how do we guarantee we don't lose data as an example as we're going through or that We get let's say eventual consistency where if part of the network is up and being controlled by our orchestration And another part of it is down. How do we get it to catch back up and get in the right configuration? When it does come back up if it needed to be changed or to collect all of the data that That it had when it wasn't centrally Reachable when it was isolated and only let's say on backup power on its own So that presented some interesting challenges that we had to tackle which is basically Fault tolerant and distributed computing in a nutshell, right? The other issue that was somewhat interesting that we had to innovate on was The gear in the field typically isn't hot swappable. You can't just go grab a relay That's in a real substation and pull it out and pop another one in in most of the substations without having to do some rewiring without having to take circuits out of out of commission Deenergize them lockout tag out procedures, etc But if you're in a fast-paced exercise environment, we have seven days and if people Get stuck and we need to reverse out basically what the bad people did How do we reverse that out in as fast a way as possible? Without bringing the whole exercise down or the whole exercise to a halt for hours on end So we had to create sort of quick connects and all sorts of other things that allowed us to swap gear out very very quickly Further when we're testing bleeding edge technology things fail Because sometimes that technology doesn't work or the research Doesn't do what it's supposed to do and so you that's your primary plan is okay Look it's going to try this and if it works great Well, you have to have a backup plan right and in many cases we had to have another backup to the backup plan Because we couldn't fail and make everything stop working So if anyone in the program failed We had to have a backup plan for what would happen if they failed and then a backup plan for if our backup plan failed And then the last time the last one which Is a lesson learned is we thought we were prepared in many many many occasions But let's say, you know in between days of the exercise when we would pause and go back to our hotels to sleep, etc I would often make runs to home depot or loaves or Electrician stores or whatever because no matter how many spare parts we had no matter what tools we had on On us or available to us anything that can break Will break at some point when you're when you're running these environments And it's almost always in the way that you never thought of or that you couldn't have anticipated something that has You know a 10,000 hour meantime between failure or 100,000 hour meantime between failure fails in You know 10 hours instead so Lots of interesting challenges on on just keeping things up and operational And making sure that stuff was readily available if anything did break Um, so let's talk a little bit about some personal takeaways and i'll wrap these up really quickly here but uh Let's talk Let's say not as the University of Illinois, but let's talk about this from from my perspective. So vendors Be this ics cyber solutions or the vendors themselves. They often can claim capabilities that Uh, that let's say are much more limited in the real world application than what most people realize So a utility may say I go buy this platform and it's got me covered And it can do all of these things and I can check that box and i'm good um, the reality is is No matter what vendors claim, uh, there's Often still very large gaps there Um, and so even the commercial off the shelf ics cyber solutions that are out there They're missing huge amounts of surface area on what adversaries can do against these boxes Radix technology was designed to close some of those gaps But not all of them, right? So even as great as the radix technology is we still have a long way to go, right? um in building the environments that uh that we built and and helping to construct Uh, the the exercise evaluations and and the test effective payloads and all that in essence is How do you cause a condition from a cyber means to happen on these devices? Such that there are artifacts or or implementations that then people can forensically find, right? Um, so all of those in in doing that we found hundreds of issues on these devices And it's not like we've never looked at these devices before and by issues I don't necessarily mean security vulnerabilities, but in some cases it was security vulnerabilities But merely other items like look compatibility between host a and host b it doesn't work Even though they're supposed to interoperate it doesn't um, there's nuances differences There's differences in documentation on what is communicated on the actual wire versus what it says it's going to communicate as um another uh thing Which was a personal takeaway is you know being the adversary is fun, right? It's it's it's nice to be on the red team and hack these devices and and break them in a variety of ways But in the program The defense and recovery technology including the radix technology and commercial off the shelf stuff that that i've personally seen It's still way behind What uh, I was capable of or what others on the red team were capable of doing to these systems So if we're so far ahead, we could just obliterate any of that tech then What fun is there in that like it's not even a fair fight at that point So a lot of times we limited it um the the activities that we were doing to sort of poking the bear Rather than destroying it. So we didn't go out for you know the the throat kill We kept a pace with what the technology was capable of and designed something that was just a little bit ahead of that Pushing them each uh each iteration to improve um, and so uh one sort of broad takeaway is um, and I say this not just of technology in north america or whatever But the whole world what they have in this space in industrial control systems Detecting cyber attacks on these devices that detection that mitigation and that remediation technology for the electric power grid um and I'll stretch it a bit and say actually all critical infrastructure Still really has a long way to go There's still so much work that needs to be put on that on those platforms to really protect the systems From somebody who is truly focused and determined and understands these systems at a deep and inherent level So that's all of my technical content I will just flash a slide uh real quick, which is the testbed at illinois and and much of what we've built in the radix program Has been enabled by by lots of companies. These are some of the uh the companies that have donated gear to us software to us Etc that have helped enable uh the things that we've done But without them and and without uh the commercial support and the vendor support and the utility support broadly across this program We wouldn't be successful the DARPA radix program wouldn't have been successful So thank you to all of those companies and and what they did And then I think we still have a couple minutes for questions Uh, and so uh, I'll also leave a sort of bonus link down there at the bottom There's a github repo that I created a number years ago at the s4 conference And uh, and I've been maintaining it Sort of ad hoc ever since uh, and that's a bunch of ics security tools in a variety of different forms that are aggregated um and and categorized in in various ways and mirrored when when their original location is no longer available Um, so do check that out. It has a whole bunch of useful things in it Uh, and with that I uh, I will stop talking and I think we might have a little bit of time for a question and answer Uh, let's see. Hey, Tim. This is Bryson. How you doing? Wonderful. Hi Bryson. Thank you. Uh, thank you for the talk. Um, I I noticed that you are on our discord And I actually promoted you to a speaker during your talk Um, so you should now have that badge tied to you And uh, what we recommend is um, if you could post that github link in the speaker q and a Section of discord Okay, and then um reach out for folks to engage you there and for questions Okay, sounds good So really appreciate you jumping on and giving this talk um Having having been and seen this for myself. Uh, it is really impressive And uh, my favorite part for the sensors was of course the um inflatable guys like you see next to the huge car sales Um, I thought that was a really interesting way to show whether something's up or down at a physical distance Yeah, we affectionately call them the dancing men And sort of a a funny aside In the northeasters when you have torrential downpour those things get wet And then they turn into sort of like whip lashes So I was up there, you know untangling them on many occasion and getting sort of smacked by the uh dancing men as Because I was trained to untangle them so that they could fly Well, that's how you know it works Well, anyway tim, uh appreciate, uh, you uh joining us in supporting the village and uh, look forward to the commentary and the q and a on discord Awesome. Yeah, and everyone do check out what they've set up for, you know, the ctfs and other things in the village You know, they do uh, they do an awesome job of creating environments that you can play with Sadly, I can't offer my environment out to the world in in such an easy and inaccessible way But uh, and hopefully in the future, I'll get deeper engaged with the ics village and bring some of this tech And some of this capability to uh to the village so you guys can all play with it too Yeah, we look forward to that. Um, that's probably been the biggest innovation we've had is because of the pandemic The amount of effort we've had to spend on figuring out how to make these things virtually accessible Which is the typical limitation for concurrent access We kind of have solved it. So, um, we'd love to touch base with you afterward and talk about it Yeah, it's uh, uh, you know great to hear that you guys have had to tackle that We're currently tackling that for the DARPA radix effort as well With the last exercise it will be predominantly remote Um, and we went uh from the prior exercise being you know network isolated completely trusted everyone in In a specific zone to you know part of this is deployed in the cloud and everyone is distributed around the the country and all accessing this in a in a controlled and and uh crazy way including like streaming body cams that we'll have and all sorts of stuff So, um, we're on we're on that same roller coaster dita covet at the moment Well, we uh, we look forward to collaborating. So again, tim. Thank you very much and uh, we'll see you on discord Yeah, you guys have a great day. All right. Take care


Let's explore the idea of balanced and unbalanced forces. To take an example, imagine you have a refrigerator which is being pushed by two people with exactly the same force but in the opposite direction. Let's say the force is five units each, don't worry about the unit of the force, we'll look at the units in a different video. But let's say we are putting five units of force in either direction. The question that I want to try and ask ourselves is does do these forces do anything to a refrigerator? Does it affect the refrigerator? Our answer will be no because you're pushing them in the two opposite direction, it's not going to do anything. If my refrigerator was at rest, to begin with, it's going to stay at rest. Since these two forces are not going to affect the refrigerator, we say these forces are balanced forces. The force on the left-hand side is literally balancing the force on the right-hand side. Another way to think about this is we would say that the total force must be zero. That's why the refrigerator is not getting affected. Yes, we are pushing on it, both the people are pushing on it, but if you push them with the same force in the opposite direction, they don't affect it. They cancel each other out. So the total force must be zero. And the way we write that is we basically say the total force F net, net means total in physics. We just like to write net force. So the net force is zero in this situation. This also means, interestingly, five plus five, when it comes to forces, need not be 10. If they are in the opposite direction, look, they become zero, which means if the forces are in the opposite direction, you subtract them. So whenever the net force is zero, we say they are balanced forces and they do not affect the refrigerator or their objects motion. But now let's consider the two of them are pushing the refrigerator in the same direction. What's going to happen? Well, if there is no friction and no other forces, let's say, you would agree that the refrigerator will start moving, right? But not just that. Imagine the refrigerator was already moving and it was coming towards the left. Now what would these forces do? Ha, now imagine somebody was somebody, somebody had thrown the refrigerator towards them. Now by pushing it against the direction of its motion, it will slow it down and it can make it stop. So see, these forces can start the motion. They can also stop the motion. And as a result, these forces now can affect the motion unlike over here. And so we will now say these are unbalanced forces because there's no force that's balancing it. And because it's unbalanced, it's affecting the motion. And what's the total force now? Well, see if the forces are in the same direction, we add them. So now the total force is 10, but in general, when it comes to unbalanced forces, the total force or the net force will not be zero. So if the net force is zero, it's balanced, doesn't affect the motion. If the net force is not zero, it's unbalanced. It does affect the motion. Now I want to be clear about one thing though, okay? We might think unbalanced forces will always make things move. That's not true. We just saw in this example, unbalanced forces can also make things stop moving. It all depends upon what that refrigerator was doing before we put the unbalanced force. So it's not very straightforward and we'll understand how unbalanced forces act on, you know, objects, how it affects the motion in more detail later on. We call them the Newton's laws, but it's not so straightforward. Don't think unbalanced forces cause motion. Okay. All right. Okay. So now that we understood what balanced unbalanced forces are, let's take a couple of examples. Okay. Consider this situation. We have a car with the forces like this. Can you pause and think about whether the forces are balanced or unbalanced and think about the total force? Is it zero? Not zero? What is it? Can you pause and try? Okay. Let's do this. Well, clearly, the force on the right is not balanced by the force on the left, right? It's 10 units and for the force on the left is only four units. You can see the force on the right wins. Therefore, what is the total force? Well, first of all, therefore it is unbalanced, right? The force towards the right is not balanced by the force towards the left. But what is the net force? Well, again, they're in the opposite direction, so you subtract them. So we do 10 minus four, you get six. So the answer is six. In which direction to the right? Because this is the bigger force. So the net force is to the six units to the right. As a result, what will the car do now? You might say, oh, the car will start moving. But no, remember, that again depends on what the car was initially doing. If the car was at rest to begin with, yes, then the car will start moving towards the right. But what if the car was already moving backwards, right? Then when you put the force, it'll slow it down and might make it stop, like just the refrigerator. So remember, the relationship between net force or unbalanced force and motion is not very straightforward. And we're going to learn about all of those things in future videos. But as of now, just think about balance and unbalanced force. Don't worry too much about the motion part of it. Okay. All right. One last. Consider this. Are the forces balanced or unbalanced? Pause and try. All right. The force towards the left, there are two of them. If they're in the same direction, we add these two forces, so seven plus five is 12. So there's a 12 force towards the left and yay, look at this. You have 12 force towards the right. The two perfectly balance each other out. And so we have balanced forces. What is the net force? That means zero. The total force on this rock is a zero.


Good morning traders Jay trader here Today we're gonna have analysis and price section read on Some of the big caps that we traded today We had Nvidia Amazon. We can also put it here at Tesla and we're gonna put the last one I would say definitely meta So for stocks you can see also we had another one H CTI Which is a small cap CPI data this morning. So there was some very good volatility Good liquidity in the market. I Expect a little bit more on Tesla, which now is bouncing back up But essentially this was the major counter trend on Tesla probably from Morning profit-taking from traders NVIDIA may be the best of the day. So good run Amazon sideways Not like Tesla, but still gave a good morning push and then Cy was action here Meta also another nice grinder together like Tesla So we're gonna look at few of the setup that we had this morning If you have questions or retail traders Was a was not a Hard day to trade. So we're gonna look at some of these together also Put in the in the chat or over here write down the stocks that you traded or the assets that you traded All right, so we can see over here. Good morning. My med some sort of traded Exile it so gold essentially change the gold with dollar Let's see how the trade over here in the chat This morning they traded a CTI a ULT Some traded took NVIDIA So we're gonna look at some of these stocks some traded traded over here Tesla from the pre-market CPI So overall a good day, so let's start first looking at the futures Let's give One second over here futures. So data came over here a 30 CPI in pre-market we had a bullish move and You can see Move right here from this demand all these all these level that you see are my level of demand and supply Okay, essentially, you don't read you don't need really months to trade the market as long as you have These levels and you just look for bounce or rejection The trend is up. So we start forming over here Higher lows are our highs and Then the only thing that I'm looking for is deep buys. Okay We're gonna look at some of these what we had this morning at least over here on yes so this is The break this morning of the liquidity area on yes And then we had a major pullback again to this level where I want looking looking to buy And then over here again on yes with a push into the 4515 and then with a major dip into this demand here So I'm looking at key areas of supply and demand and here's over here given from my strategy Now Yes was bullish made that was bullish. So long place for the morning We're gonna look right now into it in video In video of today Personally, I didn't trade in video. I've seen some good charts this morning This is in video and let me know traders do your opinion. What do you see over here? Any setup that we traded back in the days or we traded I believe this even two weeks ago You spoke about this pattern. Okay. All right. So I see over here some traders took and Vita this morning Main point that we seen the last weeks is that market opens and gives up wash. You can see over here Wash into the demand zone over here and then bounce to the upside so First point for me is looking for the dip This is the demand zone that we had this morning. We're looking at a possible wash over here And you can see that this is the first part Right when we open we start washing we got to this for 28 So in the last weeks months we spoke about This pattern which is a v pattern opening v pattern So we go right over here opening v pattern to start looking for these longs and Then once we have this this is the v pattern happening over here. This is the open level, right? So you see over here this liquidity opens Washes create a new low And then create the high low and then create over here a breakout So pushed upside Which is this push and then a bull flag and then pushes more So you can see over here This is The uptrend of this morning So when I'm looking at this is the reclaim of that open level Which is this reclaim over here and then we start forming in a base We start forming in a base over here I want to share over here one chart that a trade in the room took Actually two traders took over here on Tesla and This on Tesla this at midi. Okay, this is on Nvidia Let's look over here. I think this is a good job. Good work There we go, so I know that trader is still holding over here in this case, it's a an option trader, so good job and This is another one. So two trader over here this morning At least two trader farther. I know took the longer here and again You can see the dips they bought the dips over here. So they didn't buy the breakout But they simply got on the dips. This is buying options over here and selling to these pushes and Again entry level so only look for these v patterns once a reclaim you start taking long or Even after once we bounce on that support, then you start looking for the long The good part over here this morning is that we had a high liquidity So on a video here. We had a very good push move for about 10 points from the low to the high and Very very good over here any question traders with this setup Did you take it? So great move for the day on these two very very good Now what I'm expecting is a possible pullback to this level For 35 and we're gonna see if we're gonna have a little bit more bounce. Okay, so this is what I'm looking right now I have to be honest with you this market a back tested and tracked 2023 The best moves happen the first 30 to 45 minutes. So all these Mid-morning moves that we may have on in video don't really work that much. So I'm gonna write over here some tips This is important. So over here putting some notes in the in the room NVIDIA best setups as members know happen First 30 to 45 minutes so reduce size when you trade Beyond 10 30. Okay Because a setup won't work as it open a lack of liquidity. I believe it's summer So this for in video this morning. We can look now at meta to here Okay the same setup that we've seen on NVIDIA we can see it also over here So what I like is the open Dipping to dust into this liquid area 300 I like this place Major demand zone. This was trace from the previous weeks We add over here a v pattern push the upside breakout Pull back over here. So essentially the same as NVIDIA and then move to the upside the two main points that I'm looking at is Where are the price? Holds and start making over here a major move and you can see this level over here 300 and then also the Reclaim in this case of the J lines. So this point over here and I started being strong The next Part is for me looking at higher lows in our highs and over here. We're forming these higher lows in our highs So we can see that we are in a bullish uptrend So how to buy these I Want to check over here for some charts that Membership this morning. So this is a tar from member. I think is a It's a pretty good example of how to trade it. So it is a very good job. Okay, so You should be able to see it good So the dip over here the gate is this right and I Think he had a very good feel over here. So three zero one You can see dipping to the G lines push selling to the side liquidity Right, this is a perfect example that it they took and then the second dip over here You can see bought the dip into the 300 huge bounce Now this point you can have over here the tarantula level sign because the whole rondo number and these number will behave as a major liquidity area will demand our concentrate and Then you start seeing when we have buyers. So you start seeing that bounce. We are still in a bullish move And in this case he bought he started selling into those key levels so Very good move over here anybody else traders took this morning Meta Okay, I see over here majority traders took only Tesla Nvidia not too many took a meta. Let's see But I believe it's pretty Easy to understand over here the play again v pattern the gates are washed into the demand zone bounce and then seeing these High liquid ears right now that are holding Now when I say that it looks easy is always look easy when you know something happened The structure is there But over here the trader be I would say show some very good skills in risk management Especially with the cut that he did over here and then with a timing to enter Exactly on this point why this level? So I see over here DM Why this level 300 Too many reasons. Let's look to let's look with the hourly chart first of all What we have over here is a previous resistance So this level is a previous resistance.  So we get to this area boom rejection fine then what reject this area and We have again a rejection. So it behaves like a resistance and Then over here instead what it breaks this area and A star curling over here above and having this played upside So over here we see a shift First we have supply Supply and that supply once we're holding in balance it becomes a demand So we're gonna write over here Supply supply demand now what I'm looking over here traders is not Any kind of entry if you're long in you long the dips. That's good. The Y simply Don't don't look to enter over here. Okay, I don't look to enter over here We're too extended from this demand area. We're too extended from the J lines. So you don't want to enter right here Let's see Hide over here Hide indicators. Okay, we don't really need that right now So we have supply supply demand Is it this clear? So watching over here looking to see if we can break this 308 put over here this So again, remember first, we have a supply once we have a rejection. Okay, and then the supply We have a second time over here is rejecting so twice and This is the third time over here Where we have demand So supply sorry shift to demand. Okay, so we have a bounce over here structure of bounce This is meta also. I see names some good job over here I Will share this one second. So this is another trader this morning that Let me zoom out a little bit so we can see the full picture I will be a little bit small, but you can see through that He got long and so and then it got long over here in this demand Also him at 300 start selling partial And then add a little bit more add a little bit more and then selling to this push Add a little more selling to this push So overall good very good job over here like very nice run Starting here and then recycling. Okay all this Looking with book map at the trend Looking every single time to buy these dips here Here here here and what I like about this is a structure that we have right now on meta Okay, I'm gonna zoom out a little bit so I can Show you better, but do like this put over here demand and demand. I Love the structure. This is a typical strong bullish structure That you can see on book map and it tells you High liquid in this case Okay, so bullish confirmation. Let's also run this on a one-minute chart we can Put these demands exactly where they are We start from this one over here 305s This one first one And then we have a second one and then we have a third one. Okay, so you can see those demand zones over here We're gonna put this so we have demand And this to make understand How book map moves.  Okay So these zones over here. This is where you have to buy the dip. Okay, so let's pass the next one Any question traders? Okay. Good morning. Good. I'm I'm not looking, you know, I let over here my friend Scott Pulsini to follow Goals so I know that tomorrow will be with you guys on the goal. I mean, this is the goal that we have today Dc or x a u and then uasd This is the gold But over here. We're totally bullish Okay Uptrend, but again over here. I let him talk And go over this So good job over here trading. Good job. Okay, let's go to the second one tesla So let's see What happened this morning on tesla? I'm gonna focus on a few things over here We're gonna go over The chart I mean the chart is still bullish If you're looking at Long medium in short term, this is still bullish Okay, let's look at tesla together So at the open traders I was looking for a dip What I did this morning was not taking a short what I was looking this morning was to look for a long play reason why I am read on this for the day, but 30 cents loss I'm going to explain why what I did So in primary we had a very good move a 30, you know, the data came up We traded like long on yes and in queue data cpi Move over here from the 230 273. So this demand zone up to the 277 50 At the gate. So this is 930 We start having this push You can see that they break this previous high and it cannot break this level of resistance And I was looking on book map and book map over here Didn't give me any Major supply area, but we saw that it was starting to fail We knew this I waited this area So I got long in this area around 275 and 50s was 47 entry Once it got to this level. I was risking this level of support and we got this bounce this bounce almost for 70 80 cents So over here I was in profit, but then you can see that we couldn't break this high And this high is exactly This level. Okay, so we bounce over here And we got to the 276. So we got to this level And then once we got to this level, we started to reject and reject reject. So I essentially got along over here to 75 and 47s got out to 75 and 20s Once it pushed a rejected reason to get out And you can see over here on book map What I was looking for I was looking again for the v pattern, right same that we had on NVIDIA and META was looking for the v pattern So META and Vita worked, but Tesla over here didn't work. So I'm going to make over here A tip This is important. So even for you that you're listening for the first time How we use book map. So META and Vita we had the same pattern But confirmed the pattern. Okay, the v pattern Tesla instead Was looking for the v pattern But never confirmed Equal small loss And this exactly the old the only thing you have to look for is Once it gets to this 275. So this was my major level of support. You can see over here We had to use the manual support I was looking for this bounce never came. Okay reason to step out So be always very disciplined And then this morning we're dipping to this Demand area over here 273 Which actually held one time second time third time fourth fifth time over here If we break this we're gonna have 270 potential 270 over here Let's see if we can have a double bottom and pushed upside for now. No play. I'm not gonna Enter at 11 o'clock mid morning for any kind of Long play. Okay traders. So I'm gonna be a little bit conservative Let me know if this is clear Next one we're gonna look at Amazon Amazon again, these are my levels. Let's look at hourly chart So this morning I share this chart over here for me. This is a bullish chart chart We can see what I'm gonna what amazon does and let's look at the price section. Okay Let's focus On the zone over here So what we see is that every single time that Amazon pushes It then has like This kind of price section makes lower highs higher lows always in contraction It pushes over here again. It makes these higher lows in our highs. It pushes over here again It makes all these so it doesn't it's not that fluent trend following consistent But instead we have breakouts And then pulls back We have breakouts and then pull back This morning I was looking for this breakout and break of this Supplier, you see this supplier I was looking for the break over here and push to the 134 never came Again, what do we have? We had the breakout And then right away push to that. Sorry pushed upside and then right away rejection And fail over here A little bit boring trading amazon lately I really prefer amazon when it was 2,500 bucks I don't really like this 130 moves is not that Hmm Interesting for me to trade this. Okay, unless you trade some options about otherwise not really interesting Looking at book map And looking at the one-minute chart This morning we had several dips So The strategy I would say behave pretty good because we had the dip over here, which is this level and it bounced, right? And then we had a secondary dip And it bounced again And then we had a third dip And it bounced up again And then a fourth dip over here and it bounced up again But rather than that No trend you see every single time that was getting to the 131 We are having Rejection of the 131 now on wine and we're going to weigh this To this major demand zone 129 I'm gonna see how it reacts This 129 Let's double check the demand area So the reason why I put this here is because we had A lot of dips over here And these were bought up There we go. I will use definitely this area And why this because We had over here a rejection. So again supply Demand Demand Demand Supply so you can see how it bounced over here And then how rejected how bounced up again Bounced again. So there's a possibility over here that we dip into this 129 128 and 70 and push it upside again Or if we fail We're going to weigh this at 127 So the market is just doing this is ranging in this case on amazon Between 127 131 Really range plays, okay We're looking to buy We're looking to buy We're looking to sell. That's the reason why we don't buy breakouts Reason why we want we want to enter dips all right Nvidia we already covered so I believe our trader are still in Came to this major demand area Actually supply area are done We're going to cancel over here some some levels remove drawings Now we're going to use only this level here There we go. I think the pattern over here is Pretty clear with this pattern, right? Nice ascending triangle And I love to trade stocks because we have these big moves like today 425 This went to the 439 so 14 points move Really perfect move this morning on nvidia Perfect move The two major dips you can see over here with the j-lines Early at eight o'clock Then an open 930 I wouldn't really look too much in the one of now Mid-morning A lack of liquidity Let's see also Netflix this morning So trying to curl Let's look at microsoft Microsoft another one that this morning trying to pretty good Nice dips over here today Let's go back over here to nvidia So nvidia over here is dipping to this 435 But as I said before I'm not looking at this time over the day to buy Market tends to chop out From now until 230 So generally what I see over here is a little bit of lack of liquidity So j-line is perfect over here buying the dips So for who's long If you are swing long, I see some traders too long in the morning in the room And they got in around as we said before 429 430 I would really consider over here Using this 435 as a guide Because right now we're possibly curling down and Having this If you're swinging instead you can give a little bit more wiggle room Let's look also traders over here again ACTI I know it's a small cap and a lot of you are big cap traders We also trade small caps This morning we Are short this around 10 15 The reason why is that we had a set up short This is a hald setup I don't know if a lot of you trade small caps, but this was a very good play That we had today Let's stay On mate again You know some nice play for this morning So possibly 306 Higher low and push 306 higher low and push But again, this is only if you're in right now as I said 11 o'clock this market Is not generally giving us very good mid-morning setups The best setups happen the first 10 15 minutes out of the gate the quittery here slowed down So remember before we had three Major demand zones over here now They simply Cancel in the way We have one form over here 305 this level A dip over here you can see washout. So when I look at these washouts here This possibly is going to push some but again no setup for me, right? You can see the perfect dip 306 and 40 So only if you're long over here, this tells you to hold the position This is the setup right fake washout It's essentially An under over on the same bar So look over here d-lines holding in over here again Not a setup that in this market. I'm trading mid-morning. Okay. I want to trade these at the gate thank you bus Exactly what I was looking at So i'm going to answer some questions If you have questions for you, please reach out No major sellers. You can see higher lows are highs I'm zooming in But a lot of people ask me how you keep bookmark if I keep it like one hour 30 minutes five minutes And I can tell you this I like to see first of all the overall picture So I need to know and that's the reason why i'm zooming out I need to know where we have the major liquidity stack when I talk about liquidity means volume And the reason why resistance Works is because we have volume over there Otherwise if we have no volume That's not really important So here we can see that we have three ten and three zero nine and fifty Why three ten big caps often will have like whole round dollar numbers Also for small caps but small caps you'll have also many half dollar numbers like Two to fifty three three fifty and so on so when I see these areas over here Okay, those are the areas where I want us to look to sell if I'm long Or to possibly short if I'm looking for a short position So If I have to answer I prefer to zoom out and see which areas Have volume only those areas of volume are interesting for me. Okay, so write this down only The areas of volume are important key levels Of support and resistance If I don't have that I don't really care about trading it. Okay Confirmation comes from volume remember Now the next thing to look at is the Confluence In this case of what? Of a previous technical resistance. Let's say we tossed Three ten ten points in the last two years and just make an example like that. Okay So we toss let's say multiple times and bounce or reject from there the three ten in the let's say past two years now It's not an example rail right now, but It's just to make you understand If today I have Also the price getting to three ten and three ten. I have volume now. We have one book map Two we have the technical resistance from let's say previous months or years or weeks or whatever That will give you a confluence of signals So one signal will be that we have a liquidity So if we have over here sellers that are placed, okay, so over here we have sellers placed at three ten So the price can get to this three ten and reject and at the same time we have an important year We're in the previous let's say weeks months or years We had the rejection or bounce That level becomes very important for me Because I can expect from that level A pullback a rejection or maybe even a breakout dip and then a bounce Okay, so always start looking for those errors confluence Okay, make sense Now let's go back on invida This is what I was saying before Now metha worked, but as I was telling you I don't really like to trade mid-morning Because the market tends to jump out. So if you go back in the last four weeks Six weeks eight weeks in the market You'll see that the best setup More than 70 percent of the time happened in the first 30 45 minutes Now That means that in the first 30 45 minutes of the gate in this basin statistic, okay I'm looking to take that entry then of course the entry can you know go even up for four days in a row But the major entry Happens in my case When we have the open, uh, let's go back and see tesla So tesla is appointing for today When we see this range Check a higher time frame. Okay. This is my higher time frame over here Tesla one hour Let's put this a little bit better There we go So we had a breakout this morning and fail But all these demand areas they held pretty good Now the one that I'm looking at Right now is a 273 So this year over here 273 If we can hold this and confirm Then we can have a push to a possible 277 280 next target and then 283 Tesla has a lot of supply above Okay, but the strength line break seems very very good What I need is this this is the setup that I'm looking for So higher lows in our highs and push to 85 my target for the swing is 300 So I'm still holding 300 Okay, through the last few minutes if you have question over here reach out We're gonna continue to look for the rest of the day Meta, of course It reset Meta runner personally traders. I believe this can go even 350 So meta will be one of those that is going to be in my wall service every single day Second one tesla Third Amazon for NVIDIA. I also would put Microsoft Google which are stocks that I often play Uh So good morning, Dario. So uh with small caps. Have you followed today? So today, uh, buddy, we had two main setups We had over here Some small caps acti In this case, you can see the trade over here taking the long but The trade that we actually alerted was short. So we actually Work on acti We work on a ult These were all a ult Faders for the day So a major dose two those two Okay guys, so five 11 20 If you have no more setups, we're gonna update to the next week I would invite you to watch again the session of last week Because was very interesting and we spoke about with With bruce About setups entries Maybe a little bit more in depth than today, but we've seen also that v pattern I wouldn't really look into that if I was you Was very very spot on authority last week episode with Bruce Pringle I want to check also here ptpi because it just halted right now We have a stock with the micro float low institutional ownership This stock has a baby shelf restriction Can still like raise a little bit of money has lack of money So ptpi Could be interesting. Let's see on a daily chart Major levels over here So we could see this at 370 Or into the five so i'm looking ptpi 370 Or into the five level for a possible short All right traders, so we're gonna update next week. Thank you in the meantime for the good morning Uh cpi day review what we talk about. Uh, see you next week and if you need reach out Uh, jtor.co. Thank you and see you next time


So, just to give you some example of what type of R&D has been done until now, we started working on activation of soils and fly ashes, I think I cited this example sometime back that when contaminant geomaterial interaction occurs at elevated temperature in the presence of some chemicals, the geomaterials get altered, alright. So, what we did is whatever happens in nature, we tried to simulate in the laboratory. So, I took sodium hydroxide and I boiled it in a pressure cooker to start with my research because I am sure you can realize why pressure cooker because autoclaving which is going on at a very high pressure due to the steam and I am achieving very high temperatures. So, what I have done is I have ripped off the external surface of the quarts by applying very high temperatures and very high pressures with sodium hydroxide. Sodium hydroxide is a cheerleading agent, you will learn about this once you are into this industry, it basically scrubs the surface of the quarts. This type of activity is also going on in the reservoirs and the ponds where the fly ash is being dumped. So, this was my PhD students thesis in 2001, 2002, everybody was talking about utilization of fly ash for making embankments and we were thinking in a different direction and I said look wait a minute and let us try to analyze the samples of the fly ash from the pond and we published interesting papers showing that this material should not be utilized for making the embankments and the reason is about to follow. So, if you take the original ash, you will find that we have quarts mullite and these are what known as zeolites, activated state of the minerals where sodium alumina ratio is in some order alright. So, this original material gets, you need not to write, these are all R and D ideas, you can read the enough publications on this. We have written a book by the way on this whole thing, I will talk about that. And so, once you boil it with sodium hydroxide, this is what happens, this is what is known activated fly ash, activated fly ash is a catalyst. So, this is the, this is what the after effect of activation of sodium hydroxide is of the fly ash. So, this processes keep on happening in nature or as that. So, most of the rocks to my surprise, which I was dealing with as a consultant for creating the buildings and the bridges, particularly one in Bombay, huge bridge. There was a bug in the mind and let us see microscopically what type of minerals these rocks have and what would be their bearing capacity, because bearing capacity is a macro term. Now, when you look into the mineralogy, you realize that these type of minerals are not fit as a load bearing mineral because they are hyperactive and they will be sucking lot of moisture either from the atmosphere or when they come in contact with the water bodies, this is how it looks like. So, from this point onwards, I always tell my student that I am venturing into Sukshma, Sukshma you understand? What is Sukshma? Micro, nano. So, this is where the R and D is because until now, the conventional theories have been talking about the macro systems. You never went into the microscopic scales and the nano scales to understand what causes strength to the matrix of the soil and that is where these tools, you know, SEM and XRD become very, very powerful tools.  Now, this is a very different world. You will realize that more you focus on the particles, the more knowledge you get about it. Remember, this material is getting created because of firing in furnaces at the power plant. So, the coal which you bring to the power plants, you pulverize it and as a pulverized coal, it is injected into the furnace. It is not the coal which is used because you want to enhance the surface area by pulverizing it and once the surface area of the each particle of the coal increases calorific value increases. Now, these are techniques whenever you get time to go and visit a power plant and try to understand how the power is produced. So, all these flash particles which remain in the boiler units or they could be the bottom ash also. They tell different stories. So, you have carbonates from the color you can make out. Beautiful thing which I wanted to show you. It is a sort of a cup inside a cup. You take a football and cut it. So, you have the inner surface and you have the outer surface alright. So, it is something of that sort. You keep two cups one over each other. So, what happens? A cup is sitting inside in the cup. One ball is sitting inside the other ball. We call them as pleurospheres. They have very special utility in today's chemical engineering processes. I mean if you check on net, you will find that these type of entities are used for making bulletproof vehicles bulletproof you know clothes and so on because their tensile strength is extremely high. These are perfect quartz balls. In sports most of the gadgets they use senospheres and pleurospheres. You know if you go into the chemistry of these type of particles you will realize that during very high temperature when the firing was done these particles the silica got melted and then in the stack from where the emissions take place these particles could not go outside and they have to drop down. We were talking about hydrometer test today morning. It is something like hydrometer test which you are doing in a stack of a power plant with all fumes at very high temperature and the particle is dropping down. What type of alternations the system undergoes. So, in the process what happens is a lot of air gets stabbed in these particles clear. So, when the air gets stabbed in the particles and they recrystallize they become pleurospheres or senospheres and as I said they have a lot of applications. Then I started growing different types of minerals on the particles of quartz or the fly ash particles. So, what you are observing here is the this is the culturing different types of minerals on the surface of the quartz to make it more hyperactive. So, this was the work which was done by my student Dr. Hohle, Dr. Nevin and Dr. Jha. These are the guys who have published at least 50-60 papers on zero-digestion potential of fly ash and their applications and environmental cleanup. So, remember when you are dealing with the quartz ball is inert but I have used quartz ball to create different type of protrusions on the surface which act as a sort of a filter sieve, molecular sieve we call them which will have a very high affinity towards cations. So, any cation when it comes in contact with these materials gets strapped over there because of very high cation exchange capacity and surface. So, these type of systems are quite required in modern day industry particularly when you valorize the fly ash. Fly ash which was lying as a unused unattended material has been converted into a catalyst and I can use this as a bio fertilizer also because tomorrow micronutrients and the bacteria and microbes will come in contact with these protrusions and they will live over there. So, imagine a soil which was earlier barren, I have rejuvenated it. So, these are the concepts which people are trying to work on in the industry. So, this is where the interesting ideas are in R and D and applications. Read the papers by Bhagwan Jeeja, the book also on zeolites and their industrial applications and if you go through his papers you will realize how the whole process is done. The bug in our mind was that interaction of contaminants with soils is not inert and many a time this interaction might alter the fundamental characteristics of the soils also. So, this is what actually we wanted to show. Particularly in case of nuclear industry this type of concepts are very, very useful where you are dealing with the atomic waste of high toxicity. You know it is a big challenge to dispose of the waste and isolate it from the geo environment. So, check the thesis which have been done by Dr. Ravi Ranjan Rakesh, one Dr. Guru Murthy. These are the guys who are sponsored by atomic energy regulatory board of India and DARC and they have done wonderful work on nuclear waste disposal of you know from different atomic power plants and how to isolate them from the environment. Hope you are getting, I do not expect you to remember and learn everything. I am just trying to give you exposure of what is being done and what has been done already and where we are heading to that is more important. This is correct. It is not that you should mug up and remember all these things. This is just maybe a different domain of activities of a geotechnical engineering profession. Sir, in which way the activated ash sample is different, property wise. First thing is the mineralogy. So, if you remember this itself is different. Here you do not have any zeolites in the original flash and once you have activated is you can create zeolites of your liking. So, only thing is you have to just regulate the process. So, if a agriculture industry is contacting you, you know what type of zeolites you should produce. Engineering properties wise. Yeah. So, engineering properties if you read the paper which is written by Dr. Koleh in Canadian Geotechnical Journal 2001 ASTM. There we have talked about these type of systems have tendency to retain water and they become very fluffy. So, specific gravity decreases because what you are doing is you are digesting silica because by using sodium hydroxide alright. So, they become different material which cannot be utilized for load bearing. But it becomes an interesting material for application in environmental issues and giving a solution to the environmental problems, cleanup programs. When you have mercury vapors, dioxins, very high concentration of cations, their take up capacity is going to be more. So, if you put them in the soil, they will not allow anything to go out of them even if flooding takes place. So, when you construct a dam, the biggest problem is soils become barren. I think we discussed this. The biggest issue is why people are against construction of dams. It is not only the dislocation of the people, the seepage lines, what do they do? They take out all the minerals from the soil as an except gradient. So, and water logging downstream. So, when water logging occurs, a fluorescence takes place and all the minerals get washed out from the soils and soils become barren. So, if you want to rejuvenate all these type of things, you should have a material which is hyperactive, you would not let things go out easily. There are several applications of this material in the modern day medicine. So, I was dealing with some of the business of the other country where they are trying to create control drug delivery systems where these things become the basic component. Most of the diarrheal, you know medicines, antidiarrheal medicines, you use these type of systems where you inject a mineral in your intestine which has a very high capacity to swap water. Now, there are two ways of interpreting the how. One is to read and get how it has been done. Second is answer yourself if you have a question, that if tomorrow somebody comes to you to create a technology, you take this question as a challenge and give them a solution. So, Indian industry right now wants a solution, are you realizing this? Here is another example of how scanning electron microscopy can be utilized to understand the surface features of the soils, all right. You have these pictures taken up at different magnifications, it is written over here 5000 times, 5000 times, 10,000 times, 15,000 times and what we are trying to show is that the sand which is supposed to be very passive contains a lot of bacteria on this and hence one of the applications could be in designing the water filters. So, if you look at another industrial process which is known as dual flue gas conditioning, DFGC is known as dual flue gas conditioning. This is normally done to trap the fine particles which are going out of the stacks at the thermal power plants. You know earlier days these bag filters are not designed or they were not available in the market. So, bag filters are the ones which are installed at the exit of the chimneys so that they will collect dust particles and the dust particles will not get emitted into the environment. When you say the size of the particle which goes into the environment less than 1 ppm, 2 ppm and there is an index also which most of the time people talk about when case of Delhi is discussed, you must be aware of that, particulate matter ppm index. So, at power plants because a lot of fine particles might go into the environment, they nowadays install dust collectors, these are bag filters.  So, what we have shown is that the fly ash particles which have been collected by giving a treatment with the flue gas can be utilized as a good fertilizer. And this was also a project which was sponsored by one of the consulting groups and one of my PhD scholars Dr. Shanta Kovar worked on this. So, what you are observing is this also answers your questions Rikan that you are trying to grow different types of deposits on the particles. And what you observe is something which is very decorational and tells a lot of value in the ornaments. If you create this type of structure, they shine in light because of their efflorescence, it is all calcium deposits or it could be sodium sulphate which is coming out of the soil. So, what I am trying to show you here is that depending upon the requirement you can create a solution. So, here the objective was how to create a situation where the fine dust particles which are going out of the stacks of the thermal power plants can be collected, number one, without back filters. Number two, whatever gets collected, what to do with that? Can this be used as a resource material? The answer was yes, this material can be utilized as a good manure. So, we created a celebility for this material, celebility in the market. These slides also show the importance of scanning electron microscopy in advanced geotechnical engineering and environmental geomechanics. There are some more examples of how agglomeration of the ash particles can be done. In conventional geomechanics, we use the deflaculating agent as sodium meta hexa phosphate to deflaculate the system. Here I want to create flocs so that the emissions in the environment reduce. So, now you can see by injecting ammonia gas, I can create deposition of ammonium sulphate on the particles and this is how the agglomeration looks like. So, they inject ammonia, sometimes they inject sulphur trioxide, sometimes they inject carbon dioxide, sometimes they inject water fumes, sometimes they inject they scrub the particles with water. So, there are a lot of techniques which are being used. I mean you should realize the you know boundary less approach in geotechnical engineering, that is what I always say. All of you have studied this Stokes law and suspension you know depositing in a water column and my mind used to say that why cannot we do this in a column of flue gas in which the particles are settling down. So, this abstract thinking makes your research more interesting and then you create a requirement in the market by doing R and D and showing to the rest of the world that what you are thinking is correct. So, most of our projects are like this where we create a value out of a material and then we create a situation where industries get attracted toward research and they fund us and then this is how the whole system thrives. Sir, you mentioned that we use those fine particles as manure for does that affect the percolation of water and percolation of groundwater. Yes, so imagine when the surface area has increased, detonation capacity has increased in case of extreme desert conditions also you can grow the plants. Because as I said that these materials have high affinity towards moisture, they will not let moisture go out. So, that means throughout the year you can have melting point maintained which plants can use to survive themselves. So, this was a very revolutionary thinking otherwise sands alone cannot sustain the plants in extreme climatic conditions in deserts. And then comes of course, first thing is creating a material and then mechanics of this material suppose if I have to create a filter bed out of this as she was asking you wanted to do some experiments to show how plants growth can be controlled by using this type of concepts. I mean you will be surprised to know that all these type of systems are very much useful for poultry where you have a lot of foul spell. In poultry and aquaculture and pesy culture these things are becoming a pool because they have a tendency to solve foul gases as to us particularly. And hence the you know animals and birds do not fall sick. There are a lot of applications.