The rapid digitalization of industrial environments and the increasing convergence of Information Technology (IT) and Operational Technology (OT) have transformed traditional Industrial Control Systems (ICS) into complex Cyber-Physical Systems (CPS). While this evolution enables unprecedented levels of efficiency and automation, it exposes critical infrastructures to a sophisticated and heterogeneous threat landscape where attacks can propagate beyond digital assets to cause production disruptions. Despite the sector’s criticality, current literature suffers from methodological fragmentation; most studies rely on empirical enumeration or ad-hoc processes, lacking structured frameworks for threat identification. This paper addresses this gap by presenting a Systematic Literature Review (SLR) designed to establish a formalized knowledge base for ICS threat modeling. Through a rigorous search of 913 scientific publications, we identified the most relevant contributions to threat definition. The primary contribution of this work is the development of a comprehensive ICS Threat Catalogue, which systematically classifies 87 distinct threats. These threats are mapped to specific assets and communication protocols, aligned with the Purdue Enterprise Reference Architecture. By integrating these findings into a graph-based modeling approach, we leveraged an automated methodology for generating threat models and penetration testing plans. The effectiveness of the catalogue was validated through a Smart Manufacturing case study, where the approach successfully identified 481 potential threats and generated 319 attack plans, demonstrating the practical impact of threat analysis and operational security assessment.

Large Language Models (LLMs) have demonstrated advanced capabilities in code generation and manipulation, inspiring growing concerns about their potential to enhance malware obfuscation. Nevertheless, the cybersecurity literature still lacks wide experimental evidence comparing LLM-driven knowledge-based malware evasion to traditional metamorphic engines. This paper addresses this critical research void through three key contributions: (1) a structured methodology leveraging commercial LLMs (GPT, Claude, DeepSeek, Gemini) against traditional metamorphic engines (MetaMe) using YARA rule detection; (2) experimental evidence demonstrating that LLMs produce variants with significantly higher structural diversity and improved evasion against signature-based detection compared to traditional metamorphic engines, generating variants with substantially greater structural diversity and high evasion rates against signature-based detection; and (3) analysis of LLM-transformed real-world malware (Alina-POS) mutations that systematically evade YARA detection signatures while preserving malicious functionality. Our key insight reveals that LLMs leverage semantic understanding rather than syntactic transformations to achieve effective structural variation in code generation. These findings suggest an emerging trend towards knowledge-based evasion techniques, creating a computational asymmetry where generating sophisticated malware variants requires significantly less expertise and effort than detecting them. This emerging imbalance highlights potential challenges for current malware detection approaches and defensive strategies. • Large Language Models can generate malware variants with higher structural diversity than traditional metamorphic engines. • Empirical analysis shows LLM-based variants achieve improved evasion against signature-based detection. • Evaluation across syscall patterns and structural metrics characterizes transformation behavior and its impact on detection signatures.

The increasing complexity of multi-plant manufacturing systems demands architectural models able to support coordinated, scalable, and secure industrial operations. This paper introduces a five-layer architecture for distributed smart manufacturing environments to enhance interoperability, standardization, and cyber-physical integration across multiple facilities. The architecture leverages Digital Twin technology to synchronize physical operations with digital models, enabling coordinated control, monitoring, and decision support. Its layered structure supports modular deployment across plant-level and enterprise systems, while ensuring compatibility with heterogeneous technologies and legacy infrastructures. Specific emphasis is placed on cross-site data aggregation and external information sharing in compliance with data space principles. A prototype implementation validates the applicability of the architecture and its ability to support scalable and secure industrial operations, laying the groundwork for broader adoption in interconnected manufacturing ecosystems.

Protection of data-in-use is a key priority, for which Trusted Execution Environment (TEE) technology has unarguably emerged as a — possibly the most — promising solution. Multiple server-side TEE offerings have been released over the years, exhibiting substantial differences with respect to several aspects. The first comer was Intel SGX, which featured Process-based TEE protection, an efficient yet difficult to use approach. Some SGX limitations were (partially) overcome by runtimes, notably: Gramine , Scone , and Occlum . A major paradigm shift was later brought by AMD SEV, with VM-based TEE protection, which enabled ”lift-and-shift” deployment of legacy applications. This new paradigm has been implemented by Intel only recently, in TDX. While the threat model of the aforementioned TEE solutions has been widely discussed, a thorough performance comparison is still lacking in the literature. This paper provides a comparative evaluation of TDX , SEV , Gramine-SGX , and Occlum-SGX . We study computational overhead and resource usage, under different operational scenarios and using a diverse suite of legacy applications. By doing so, we provide a reliable performance assessment under realistic conditions. We explicitly emphasize that — at the time of writing — TDX was recently released to the public. Thus, the evaluation of TDX is a unique feature of this study.

The evolution from traditional power grids to modern smart grids marks a significant advancement in energy management and efficiency. This transition—driven by the implementation of bidirectional energy and information flows—results in a dramatic increase in infrastructure vulnerability since new entry points are introduced on the attack surface. In particular, prosumers represent a brand new—and, thus, largely unexplored—attack vector, for which a thorough re-evaluation of the existing security measures is very much needed. This article proposes a novel approach to security monitoring, which exploits business process knowledge to effectively identify and mitigate prosumer-specific advanced persistent threats in smart grids. To validate the approach, an experimental campaign is done in a real setup, specifically the power grid of the Berchidda municipality, in Italy. Impact evaluation covers technical as well as business aspects since the analysis includes potential economic consequences of the attacks.

The adoption of Digital Twin technology has witnessed significant growth in various domains, enabling continuous monitoring and testing in diverse applications. In the context of safeguarding critical infrastructures, particularly smart grids, Digital Twin has emerged as a viable solution to meet the requirements outlined in the NIS2 directive issued by the European Commission. Additionally, the increasing trend in Europe towards establishing shared dataspaces, and fostering collaborative environments through data sharing, necessitates a heightened focus on cybersecurity risks.

An important objective being pursued by the European Commission is the establishment of a unified data market where stakeholders can safely and confidently share and exchange data in standardized formats. This trend is supported by numerous initiatives, promoting the creation of European Common data spaces, and it is already in full swing in several sectors, such as energy and health. Among the many initiatives for building common data spaces, FIWARE appears to be one of the most promising. FIWARE promotes the use of Digital Twin technology to build distributed infrastructures for facilitating real-time data sharing in collaborative environments. By fostering an open and collaborative approach to software development and providing several building blocks of IT architectures for a number of domains (specifically: Smart AgriFood, Smart Cities, Smart Energy, Smart Industry, and Smart Water), FIWARE facilitates the creation of Digital Twins of real-world Industry 4.0 setups in a shared data space, which is typically hosted in the cloud. This paper addresses the security issues in a typical functional FIWARE architecture and provides a detailed description of a reference solution which ensures data confidentiality and integrity throughout the data life cycle, i.e. from the generation to the consumption phase. The proposed solution strongly relies on Commercial Off The Shelf Trusted Execution Environment technologies (namely: Intel SGX and Arm TrustZone) to provide effective protection of data-in-use. Protection of data-at-rest and data-in-transit is achieved by means of advanced cryptographic techniques and secure communication protocols, respectively.

IntelSGXhas started to be widely adopted. Cloud providers (Microsoft Azure, IBM Cloud, Alibaba Cloud) are offering new solutions, implementingdata-in-useprotection via SGX. A major challenge faced by both academia and industry is providing transparent SGX support to legacy applications. The approach with the highest consensus is linking the target software with SGX-extendedlibclibraries. Unfortunately, the increased security entails a dramatic performance penalty, which is mainly due to the intrinsic overhead of context switches, and the limited size of protected memory. Performance optimization is non-trivial since it depends on key parameters whose manual tuning is a very long process. We present the architecture of an automated tool, calledSGXTuner, which is able to find the best setting of SGX-extendedlibclibrary parameters, by iteratively adjusting such parameters based on continuous monitoring of performance data. The tool is — to a large extent — algorithm agnostic. We decided to base the current implementation on a particular type of stochastic optimization algorithm, specificallySimulated Annealing. A massive experimental campaign was conducted on a relevant case study. Three client-server applications —Memcached,Redis, andApache— were compiled with SCONE'ssgx-musland tuned for best performance. Results demonstrate the effectiveness ofSGXTuner.

Protecting data-in-use from privileged attackers is challenging. New CPU extensions (notably: Intel SGX) and cryptographic techniques (specifically: Homomorphic Encryption) can guarantee privacy even in untrusted third-party systems. HE allows sensitive processing on ciphered data. However, it is affected by i) a dramatic ciphertext expansion making HE unusable when bandwidth is narrow, ii) unverifiable conditional variables requiring off-premises support. Intel SGX allows sensitive processing in a secure enclave. Unfortunately, it is i) strictly bonded to the hosting server making SGX unusable when the live migration of cloud VMs/Containers is desirable, ii) limited in terms of usable memory, which is in contrast with resource-consuming data processing. In this article, we propose the VIrtual Secure Enclave (VISE), an approach that effectively combines the two aforementioned techniques, to overcome their limitations and ultimately make them usable in a typical cloud setup. VISE moves the execution of sensitive HE primitives (e.g., encryption) to the cloud in a remotely attested SGX enclave, and then performs sensitive processing on HE data-outside the enclave-leveraging all the memory resources available. We demonstrate that VISE meets the challenging security and performance requirements of a substantial application in the Industrial Control Systems domain. Our experiments prove the practicability of the proposed solution.

In the recent years, we are assisting to an undiminished, and unlikely to stop number of cyber threats, that have increased the organizations/companies interest about security concerns. Further, the rising costs of an efficient IT security staff and environment is posing a significant challenge. These have created a new fast growing trend named Managed Security Services (MSS). Often customers turn to MSS providers to alleviate the pressures they face daily related to information security. One of the most critical aspect, related to the outsourcing of security issues, is privacy. Security monitoring and in general security services require access to as much data as possible, in order to provide an effective and reliable service. It is the well known conflict between privacy and security, a particularly evident problem in security monitoring solutions. This paper analyzes a scenario of MSS in order to provide a privacy preserving solution that allows the security monitoring without violating the privacy requirements. The basic idea relies on the usage of the Homomorphic Encryption technology. Encrypting data using homomorphic schemes, cloud computing and MSS providers can perform different computations on encrypted data without ever having access to their decryption. This solution keeps data confidential and secured, not only during exchange and storage, but also during processing. We provide an ad-hoc Intrusion Detection System architecture for privacy preserving security monitoring, considering as counter threats Code Injection attacks on homomorphically encrypted fields.

A consolidated trend in designing cloud-based applications is to make use of a reactive microservice architecture, which allows to divide an application in several well-partitioned software units with specific responsibilities. Such an architecture perfectly fits in cloud environments, ensuring a number of advantages (i.e., high availability and scalability, ease of deployment and development). However, the new way of designing cloud applications introduces challenging security threats. Besides the difficulty in monitoring security of the overall distributed application, an important aspect of concern relates to the risk of break the chain of trust established among the different microservices belonging to the application. That is, a compromised single microservice may bring down the other related ones.

During the last decade, we witnessed a constantly increasing digitalization in the health-care domain that, while from the one hand, has increased the average life expectancy representing one of the crowning achievements of the last years, from the other hand, has introduced extra challenges due to the simultaneous increasing of the proliferation of cyber-crime and the creation of malicious applications which try to access health sensitive data. This created the need for increased security implementations, leading to improved user acceptance of such applications and thus to large-scale adoption of these technologies and to full exploitation of their advantages. We here propose the use of a SIEM-based framework specifically tailored for a healthcare portal developed within the context of the Italian National Project eHealthNet, which allows real time monitoring of portal accesses with the aim of detecting potential threats and anomalies that could cause major security issues.

Freedom of movement in the European Union (EU) requires the possibility to exchange healthcare - related information across borders. Such an interchange must face legal, technical and security issues. In this work, we provide a technical analysis of the state - of - the - art software for cross - border eHealth data exchange in the EU, namely OpenNCP, from the security point of view. Moreover, we present a number of solutions that will be developed during the 36 - months, EU - funded KONFIDO project to improve the security of healthcare - related data exchange and to add support for smart IoT sensors.

The cloud computing paradigm is gaining more and more momentum, to the extent that it is no more confined to its initial application domains, i.e. use by enterprises and businesses that are simply willing to lower costs or to increase computing capacity in a flexible manner. In particular, increasing interest is recently being paid to the dramatic potentials that the use of cloud computing technology by critical infrastructure (CI) operators might bring about, in terms of benefits for the society at large. Since accidental or deliberate damage to a CI may result in devastating consequences, this mandates for dependable and trustworthy security mechanisms in cloud platforms. In this paper, we present a distributed application for real-Time monitoring of a Power Grid. The application, which is called PoGriMon, is deployed on top of the SecureCloud platform, a security-enhanced IaaS solution that exploits the Intel Software Guard eXtension (SGX) technology. PoGriMon has been designed based on the requirements of the SCADA network of the Israeli Electric Corporation (IEC), and it is currently being validated in a realistic setup also provided by IEC.

Internet traffic has increased dramatically in recent years due to the popularization of the Internet and the appearance of wireless Internet mobile devices such as smart-phones and tablets. The explosive growth of Internet traffic has introduced a practical example that demonstrates the concept of Big Data. Accurate identification and classification of large network traffic data plays an important role in network management including capacity planning, network forensics, QoS and intrusion detection. However, the state-of-the-art solutions, which rely on a dedicated server, are not scalable for analyzing high volume network traffic data. In this paper, we implement a distributed Support Vector Machines (SVMs) framework for classifying network traffic using Hadoop, an open-source distributed computing framework for Big Data processing. We design a global parameter store that maintains the global shared parameters between SVM training nodes. The distributed SVMs have been deployed on a 20 node cluster to analyze real network traffic trace. The results demonstrate that with 19 Mapper nodes the system is around 30% faster than Cloud SVM solution and outperforms the standalone SVM with nearly 9 times faster in training process and 15 times in the classifying process. In addition, the distributed SVMs architecture is designed to analyze large scale datasets. Therefore, it can be used not only for processing network traffic dataset, but also other large scale datasets such as Web data.

This paper describes how a software tool supports tutors in assessing collaborative activities by students, who work on an E-Learning platform and in presence. The methodological approach, and the current experience, performed in two Italian high schools, is presented.

In the era of the global economy the container shipping represents a fundamental link of the logistic chain of the multimodal transport. The optimization of the cargo handling and, generally, of the port operations becomes a challenge for improving the performance of the whole supply chain. The adoption of Information and Communication Technologies can largely support operations management in a container terminal. On the other hand, the terroristic threats have dramatically increased the need for protecting critical infrastructures like ports, railway stations, airports. In this paper we describe the case study of the SIS-TEMA project which aims at designing a secure integrated framework for management of port operations. An architecture which guarantees both the efficiency of terminal operations and the security of the overall critical infrastructure is presented.

Fast Abstracts are brief two page presentations of a research idea, an opinion, or a project update. They cover a wide variety of issues within the field of dependable systems and networks. They are also designed to offer an opportunity for late-breaking results, partial results, or work in progress to be reported in a timely fashion. As such, they are lightly screened by the Fast Abstracts Program Committee and are not subject to the rigorous referee process of regular DSN papers. The late submission deadline and expedited screening, along with the corresponding 5-minute talk during DSN, allow for very rapid dissemination and timely feedback from the community.

Today's business processes are rarely accomplished inside the companies domains. More often they involve entities geographically distributed which interact in a loosely coupled cooperation. While cooperating, these entities generate transactional data streams, such as sequences of stock-market buy/sell orders, credit-card purchase records, Web server entries, and electronic fund transfer orders. Such streams are often collections of events stored and processed locally, and they thus have typically ad-hoc, heterogeneous formats. On the other hand, elements in such data streams usually share a common semantics and indeed they can be profitably mined in order to obtain combined global events. In this paper, we present an approach to the parsing of heterogeneous data streams based on the definition of format-dependent grammars and automatic production of ad-hoc parsers. The stream-dependent parsers can be obtained dynamically in a totally automatic way, provided that the appropriate grammar, written in a common format, is fed into the system. We also present a fully working implementation, that has been successfully integrated into a telecommunication environment for real-time processing of billing information flows

Information security is a key requirement in emerging networked scenarios, which typically involve a large variety of heterogeneous, often resource-constrained devices. Providing security to this emerging class of distributed applications raises a number of new challenges. This paper discusses such challenges with respect to two key security services, namely public key certification and digital timestamping, and presents a multi-tier architecture which combines a hardware-accelerated back-end and a Web Services based Web tier to for achieving interoperability while boosting performance. The paper describes the organization of the multi-tier architecture, provides a detailed description of individual components, and presents the results of a thorough experimental campaign

Recent advances in wireless technologies have enabled pervasive connectivity to Internet scale systems which include heterogeneous mobile devices, such as mobile phones and personal digital assistants, a trend which is generally referred to as ubiquitous computing. This leads to the need for providing security functions to applications which are partially deployed over wireless devices. Delivering security services to mobile devices raises a number of challenging issues, mostly related to the limited amount of computing power which is typically available on the target plat-forms. Some promising solutions rely on multi-tier architectures, which are based on the emerging Web services technology. In this scenario, understanding the impact of architectural characteristics of specific platforms is a key issue for practitioners who have to develop and deploy efficient security-enabled applications on mobile devices. This paper provides an experimental study of the impact that specific characteristics of individual mobile device platforms have on the final performance of security applications. Focus is on performance and resource utilization, which are key aspects when one develops applications on mobile devices. The case study is a Web services based solution for delivering public key infrastructure (PKI) services to mobile devices. Experiments have been conducted on three different mobile terminals, which span a large range of characteristics in the class of resource-constrained devices. Results show that: i) performance figures are not uniform in spite of similar underlying hardware characteristics, and ii) security and performance are often conflicting requirements

In recent years, elliptic curve cryptography (ECC) has gained widespread exposure and acceptance, and has already been included in many security standards. Engineering of ECC is a complex, interdisciplinary research field encompassing such fields as mathematics, computer science, and electrical engineering. In this paper, we survey ECC implementation issues as a prominent case study for the relatively new discipline of cryptographic engineering. In particular,we show that the requirements of efficiency and security considered at the implementation stage affect not only mere low-level, technological aspects but also, significantly, higher level choices, ranging from finite field arithmetic up to curve mathematics and protocols.

We propose a fully-parallel, bit-sliced unified architecture designed to perform modular multiplication/exponentiation and GF(2/sup M/) multiplication as the core operations of RSA and EC cryptography. The architecture uses a radix-2 Montgomery technique for modular arithmetic, and a radix-4 MSD-first approach for GF(2/sup M/) multiplication. To the best of our knowledge, it is the first unified proposal based on such a hybrid approach. The architecture structure is bit-sliced and is highly regular, modular, and scalable, as virtually any datapath length can be obtained at a linear cost in terms of hardware resources and no costs in terms of critical path. Our proposal outperforms all similar unified architectures found in the technical literature in terms of clock count and critical path. The architecture has been implemented on a field-programmable gate array (FPGA) device. A highly compact and efficient design was obtained taking advantage of the architectural characteristics.

In this paper we present a hardware implementation of the RSA algorithm for public-key cryptography. Basically, the RSA algorithm entails a modular exponentiation operation on large integers, which is considerably time-consuming to implement. To this end, we adopted a novel algorithm combining the Montgomery's technique and the carry-save representation of numbers. A highly modular, bit-slice based architecture has been designed for executing the algorithm in hardware. We also propose an FPGA-based implementation of the architecture developed. The characteristics of the algorithm, the regularity of the architecture, and the data-flow aware placement of the FPGA resources resulted in a considerable performance improvement, as compared to other implementations presented in the literature.

The paper proposes a combined hardware/software approach for realizing high performance, intrusion- and fault-tolerant services. The approach is demonstrated for (yet not limited to) an attribute authority server, which provides a compelling application due to its stringent performance and security requirements. The key element of the proposed architecture is an FPGA-based, parallel crypto-engine providing (1) optimally dimensioned RSA Processors for efficient execution of computationally intensive RSA signatures and (2) a KeyStore facility used as tamper-resistant storage for preserving secret keys. To achieve linear speed-up (with the number of RSA Processors) and deadlock-free execution in spite of resource-sharing and scheduling/synchronization issues, we have resorted to a number of performance enhancing techniques (e.g., use of different clock domains, optimal balance between internal and external parallelism) and have formally modeled and mechanically proved our crypto-engine with the Spin model checker. At the software level, the architecture combines active replication and threshold cryptography, but in contrast with previous work, the code of our replicas is multithreaded so it can efficiently use an attached parallel crypto-engine to compute an attribute authority partial signature (as required by threshold cryptography). Resulting replicated systems that exhibit nondeterministic behavior, which cannot be handled with conventional replication approaches. Our architecture is based on a preemptive deterministic scheduling algorithm to govern scheduling of replica threads and guarantee strong replica consistency.

This paper proposes a novel methodology and an architectural framework for handling multiple classes of faults (namely, hardware-induced software errors in the application, process and/or host crashes or hangs, and errors in the persistent system stable storage) in a COTS and legacy-based application. The basic idea is to use an evidence-accruing fault tolerance manager to choose and carry out one of multiple fault recovery strategies, depending upon the perceived severity of the fault. The methodology and the framework have been applied to a case study system consisting of a legacy system, which makes use of a COTS DBMS for persistent storage facilities. A thorough performability analysis has also been conducted via combined use of direct measurements and analytical modeling. Experimental results demonstrate that effective fault treatment, consisting of careful diagnosis and damage assessment, plays a key role in leveraging the dependability of COTS and legacy-based applications.

This work investigates feasibility issues that must be addressed when threshold-based mechanisms are to be used for diagnostic purposes in COTS-based distributed systems. Threshold based mechanisms have typically been used for such purposes in embedded systems. A variety of solutions exist, with different characteristics of completeness, accuracy, and induced overhead. We first discuss the challenges related to applying such mechanisms to COTS-based distributed applications. We then identify alternative strategies for diagnosis, which use run-time data on COTS component service failures to trigger alarms to reconfiguration and fault treatment mechanisms. We implement those strategies in a system prototype, which is based on a substantial application, i.e. a real world (as opposed to a toy) application. We discuss the relationships between the sensitivity of the quality of service (QoS) provided by the diagnostic mechanisms and the accuracy of the available failure data. Our considerations and preliminary experiments on the prototype suggest that a careful evaluation of tradeoffs must be conducted, in order to achieve the best compromise between accuracy and cost, which depends on application characteristics, and service deployment requirements.

In the recent years, Web systems have undergone dramatic changes, since they evolved from plain publishing-oriented facilities to sophisticated service providers. The article describes a practical experience in the provision of limited exposure services on the Web. In particular, the paper illustrates functions and procedures for requesting, issuing, and installing digital certificates, which are used to access the services provided by a Web portal. Digital certificates are an effective means for authenticating users in a networked environment. Users who participate in the experiments can install their personal certificate on their favourite browser and enter personalized service areas.

This paper presents some redundancy-based transmission strategies, suitable for MPEG (Moving Picture Experts Group) coded multimedia streams. We focus on version 2 of the standard, which is a major compression scheme for distributed VoD (Video on Demand) systems. In such systems, multimedia data transmitted from a server to a client, is to be delivered and rendered within pre-defined time constraints. Typical values range between 100 to 200 ms. Due to these constraints, developing effective redundancy and transmission mechanisms is not a simple task. The effectiveness of the suggested schemes is evaluated, under varying fault rates and network load conditions. The evaluation is done via simulated fault-injection, i.e. by simulating the behavior of the system while faults are injected to its individual components. In particular, we concentrated on the impact-on the quality of the delivered service-of transient faults in the communication infrastructure.

This work presents a simulation-based tool for dependability-oriented design of Video on Demand (VoD) applications. The tool is organized in a layered architecture, so that simulation models can be built and detailed according to a hierarchical and modular approach. The higher layer, namely the Application Level, provides a variety of objects to rapidly model fundamental components typically found in most VoD systems. The lower level, namely the Network Level, consists of the basic building blocks needed to represent the communication infrastructure of a distributed system. The paper illustrates how to combine the tool's built-in objects, in order to construct a simulated model of a generic multimedia application. Some of the potentialities of the tool are then demonstrated by performing dependability evaluation of a real VoD system prototype. Fault injection experiments are conducted on a simulated model of DiVA, a distributed architecture for VoD applications, currently under development at the University of Naples.