As Industrial Cyber-Physical Systems (ICPS) become increasingly interconnected, they are exposed to a growing array of hybrid threats that target both digital and physical assets. A central challenge lies in identifying and implementing effective security countermeasures that mitigate such threats without disrupting critical operations. In this context, Decision Support Systems (DSS) offer a promising avenue for enhancing incident response. This can be done by assisting security operators in selecting optimal mitigation strategies. However, existing DSS solutions often face significant limitations, including poor scalability, high computational demands, and dependence on simulated attack scenarios that may not reflect real-world conditions. To overcome these challenges, we propose a novel hybrid knowledge-based DSS for intrusion response in ICPSs. Our approach integrates expert-driven evaluations with dynamic risk assessment to ensure both scalability and computational efficiency. Risk is continuously assessed using multiple Bayesian Networks. Moreover, expert knowledge is incorporated through an adapted Analytic Hierarchy Process (AHP) framework, capable of handling incomplete information, to evaluate the effectiveness and operational impact of available countermeasures. A cyber-physical detection module further enhances the system by providing detected events along with their associated detection probabilities. The optimal response strategy is selected by solving a bi-objective optimization problem. In particular, the problem amounts to minimizing both residual risk and the potential negative impact on ICPS functionality. The proposed DSS is validated through a proof-of-concept implementation based on a real-world laboratory case study. This demonstrates its practical applicability and robustness in complex industrial environments.

Digital twin development of industrial cyber-physical systems requires modeling, simulation, and monitoring to provide accurate digital replicas mimicking system dynamics. To this aim, modern solutions employ data-driven approaches to capture normal system dynamics using historical data, and anomaly detection using run-time data. However, these approaches are typically process-agnostic and have limited explainability, which negatively impacts trustworthiness. Hence, we propose a novel framework for the digital twin development of industrial cyber-physical systems based on process mining, which connects data-driven and process-based analyses. The framework implements an offline phase that systematically identifies the most suitable process model to capture normal dynamics and simulates faulty dynamics for what-if analysis. The subsequent online phase involves run-time monitoring for anomaly detection. We develop a proof-of-concept application of the framework addressing a water distribution case study that allows physical fault injection. Results highlight the importance of adopting high-quality process models to significantly improve anomaly detection and time performance.

In the context of multicriteria decision analysis , Pairwise Comparison Matrices (PCMs) represent a widely-used mathematical structure to capture comparisons about criteria or alternatives. When a confidence (or uncertainty) level is associated to the provided comparison measures, PCMs are naturally extended to the so-called Interval Pairwise Comparison Matrices (IPCM). Classical approaches, based on the eigenvector associated to the largest eigenvalue of the matrix (Analytic Hierarchy Process) or optimization problems (e.g. the Logarithmic Least Squares approach), are frequently adopted in order to estimate absolute utilities from relative judgements in absence of expert's uncertainty. Conversely, in the presence of uncertain measures, computationally intensive approaches based on Monte Carlo analysis have been adopted. In this paper, starting from a given PCM, we provide an approach able to find the smallest multiplicative perturbations of its elements able to perturb the obtained ranking from the ordinal perspective. On the basis of such approach, we provide theoretical results which can be adopted also in the case of uncertain measures (e.g., IPCMs) with the aim to characterize the stability of the obtained ranking on the basis of the given uncertainty. As testified by numerical examples that conclude the paper, the proposed framework can greatly simplify the classical approaches by providing the possibility to make direct assumptions on the final outcome of Monte Carlo analysis and reducing or avoiding its required computational effort.

In the last decade, many efforts have been devoted to indoor localization and positioning. In this paper, a hybrid indoor localization system has been developed within the European project REFIRE for emergency situations. The REFIRE solution estimates the user's pose according to a prediction-correction scheme. The user is equipped with a waist-mounted inertial measurement unit and a radio frequency identification (RFID) reader. In the correction phase, the estimation is updated by means of geo-referenced information fetched from passive RFID tags predeployed into the environment. Accurate position correction is obtained through a deep analysis of the RFID system radiation patterns. To this end, extensive experimental trials have been performed to assess the RFID system performance, both in static and dynamic operating conditions. Experimental validation in realistic environments shows the effectiveness of the proposed indoor localization system, even during long-last missions and/or using a limited number of tags.

In this paper we develop a novel approach to identify the best policy to allocate protection resources to raise the overall network robustness to node disruption. The proposed methodology is based on the identification of the most critical elements of the network in terms of their connectivity contribution to the entire system. The definition of the critical nodes is performed as a game-theoretic analysis based on Shapley Value theory. We validate the proposed approach with respect to a case study featuring a social network; by comparison with state of the art metrics, we experimentally show that the proposed protection strategy is particularly effective in preserving the residual network connectivity.

In this paper, we provide a novel framework to assess the vulnerability/robustness of a network with respect to pair-wise nodes' connectivity. In particular, we consider attackers that aim, at the same time, at dealing the maximum possible damage to the network in terms of the residual connectivity after the attack and at keeping the cost of the attack (e.g., the number of attacked nodes) at a minimum. Differently from the previous literature, we consider the attacker perspective using a multiobjective formulation and, rather than making hypotheses on the mindset of the attacker in terms of a particular tradeoff between the objectives, we consider the entire Pareto front of nondominated solutions. Based on that, we define novel global and local robustness/vulnerability indicators and we show that such indices can be the base for the implementation of effective protection strategies. Specifically, we propose two different problem formulations and we assess their performances. We conclude this paper by analyzing, as case studies, the IEEE118 power network and the U.S. Airline Network as it was in 1997, comparing the proposed approach against centrality measures.

The protection of Critical Infrastructures represents a fundamental topic of interest for the modern societies. The testing in real scenarios is hard to achieve due to the severe interdependence between these critical systems and the human well-being. The paper is devoted to introduce a low-cost testbed developed to emulate a Critical Infrastructure as complex cyber-physical system. Moreover, it proposes an approach to identify cyber threats exploiting both cyber and physical behavior of the system. Specifically, common tools from model based fault diagnosis and intrusion detection are applied to determine incipient threats and support for the operator in decision making. All the hardware and software developed are implemented in an open-source fashion in order to share investigation resources with the scientific community.

Due to their relevance, systems such as water distribution, power grids, and gas pipelines are studied in order to guarantee robustness and security. Control systems, fault detection algorithms, and intrusion detection systems represent the crucial systems for critical infrastructure protection development. Behind each of these tools, a human operator is called to be the last decision maker in case of emergency. In this paper, a decision support system, based on the Analytic Hierarchy Process, is proposed and tested in order to suggest to the security operator the best way to recover the safe and secure state of a critical infrastructure under attack. Supported by a laboratory testbed, the behavior of a water distribution system has been emulated. A specific cyber threat has been exploited and identified to highlight the methodology designed for the decision support.

Localization and tracking support is useful in many contexts and becomes crucial in emergency response scenarios: being aware of team location is one of the most important knowledge for incident commander. In this work both localization and tracking for rescuers are addressed in the framework of REFIRE project. The designed positioning system is based on the well-known prediction-correction schema adopted in field robotics. Proprioceptive sensors, i.e., inertial sensors and magnetometer, mounted on the waist of the rescuers, are used to form a coarse estimation of the locations. Due to the drift of inertial sensors, the position estimate needs to be updated by exteroceptive sensors, i.e., RFID system composed by tags embedded in the emergency signs as exteroceptive sensors and a wearable tag-reader. In long-lasting mission RFID tags reset the drift by providing a positioning having room-level accuracy.