As Industrial Cyber-Physical Systems (ICPS) become increasingly interconnected, they are exposed to a growing array of hybrid threats that target both digital and physical assets. A central challenge lies in identifying and implementing effective security countermeasures that mitigate such threats without disrupting critical operations. In this context, Decision Support Systems (DSS) offer a promising avenue for enhancing incident response. This can be done by assisting security operators in selecting optimal mitigation strategies. However, existing DSS solutions often face significant limitations, including poor scalability, high computational demands, and dependence on simulated attack scenarios that may not reflect real-world conditions. To overcome these challenges, we propose a novel hybrid knowledge-based DSS for intrusion response in ICPSs. Our approach integrates expert-driven evaluations with dynamic risk assessment to ensure both scalability and computational efficiency. Risk is continuously assessed using multiple Bayesian Networks. Moreover, expert knowledge is incorporated through an adapted Analytic Hierarchy Process (AHP) framework, capable of handling incomplete information, to evaluate the effectiveness and operational impact of available countermeasures. A cyber-physical detection module further enhances the system by providing detected events along with their associated detection probabilities. The optimal response strategy is selected by solving a bi-objective optimization problem. In particular, the problem amounts to minimizing both residual risk and the potential negative impact on ICPS functionality. The proposed DSS is validated through a proof-of-concept implementation based on a real-world laboratory case study. This demonstrates its practical applicability and robustness in complex industrial environments.

In the context of multicriteria decision analysis , Pairwise Comparison Matrices (PCMs) represent a widely-used mathematical structure to capture comparisons about criteria or alternatives. When a confidence (or uncertainty) level is associated to the provided comparison measures, PCMs are naturally extended to the so-called Interval Pairwise Comparison Matrices (IPCM). Classical approaches, based on the eigenvector associated to the largest eigenvalue of the matrix (Analytic Hierarchy Process) or optimization problems (e.g. the Logarithmic Least Squares approach), are frequently adopted in order to estimate absolute utilities from relative judgements in absence of expert's uncertainty. Conversely, in the presence of uncertain measures, computationally intensive approaches based on Monte Carlo analysis have been adopted. In this paper, starting from a given PCM, we provide an approach able to find the smallest multiplicative perturbations of its elements able to perturb the obtained ranking from the ordinal perspective. On the basis of such approach, we provide theoretical results which can be adopted also in the case of uncertain measures (e.g., IPCMs) with the aim to characterize the stability of the obtained ranking on the basis of the given uncertainty. As testified by numerical examples that conclude the paper, the proposed framework can greatly simplify the classical approaches by providing the possibility to make direct assumptions on the final outcome of Monte Carlo analysis and reducing or avoiding its required computational effort.

In this paper we develop a novel approach to identify the best policy to allocate protection resources to raise the overall network robustness to node disruption. The proposed methodology is based on the identification of the most critical elements of the network in terms of their connectivity contribution to the entire system. The definition of the critical nodes is performed as a game-theoretic analysis based on Shapley Value theory. We validate the proposed approach with respect to a case study featuring a social network; by comparison with state of the art metrics, we experimentally show that the proposed protection strategy is particularly effective in preserving the residual network connectivity.

In this paper, we provide a novel framework to assess the vulnerability/robustness of a network with respect to pair-wise nodes' connectivity. In particular, we consider attackers that aim, at the same time, at dealing the maximum possible damage to the network in terms of the residual connectivity after the attack and at keeping the cost of the attack (e.g., the number of attacked nodes) at a minimum. Differently from the previous literature, we consider the attacker perspective using a multiobjective formulation and, rather than making hypotheses on the mindset of the attacker in terms of a particular tradeoff between the objectives, we consider the entire Pareto front of nondominated solutions. Based on that, we define novel global and local robustness/vulnerability indicators and we show that such indices can be the base for the implementation of effective protection strategies. Specifically, we propose two different problem formulations and we assess their performances. We conclude this paper by analyzing, as case studies, the IEEE118 power network and the U.S. Airline Network as it was in 1997, comparing the proposed approach against centrality measures.

Localization and tracking are fundamental features in emergency response operations, where the mission leader needs to be aware of the team location. This paper addresses the localization for rescuers by exploiting wireless sensor networks embedded in the environment. Specifically, a pre-deployed network is considered and a localization algorithm is designed to find the location of the node and to track the rescuers cooperatively. Nodes estimate their own positions, while rescuers improve and augment their location awareness during mission by navigating across via points suggested by the network, thus improving the overall localizability. Experimental results show the effectiveness of the approach.

Distance-based network localization is a very effective way to obtain the position of nodes in a network via range measuring; this, however, requires nodes with nontrivial sensing capabilities. Range-free techniques, conversely, use much simpler nodes but often provide just a rough estimate on the node's position. In this paper we develop a hybrid localization algorithm that combines range-free and distance-based sensors. A detailed simulation campaign aimed at corroborating the findings and at showing the potentialities of the approach concludes the paper.

In the field of reliability engineering, several approaches have been developed to identify those components that are important to the operation of the larger interconnected system. We extend the concept of component importance measures to the study of industry criticality in a larger system of economically interdependent industry sectors that are perturbed when underlying infrastructures are disrupted. We provide measures of (i) those industries that are most vulnerable to disruptions and (ii) those industries that are most influential to cause interdependent disruptions. However, difficulties arise in the identification of critical industries when uncertainties exist in describing the relationships among sectors. This work adopts fuzzy measures to develop criticality indices, and we offer an approach to rank industries according to these fuzzy indices. Much like decision makers with the knowledge of the most critical components in a physical system, the identification of these critical industries provides decision makers with priorities for resources. We illustrate our approach with an interdependency model driven by US Bureau of Economic Analysis data to describe industry interconnectedness.

In the last few years critical infrastructures have become more and more tightly interconnected and their protection is one of the major issues for the national and international security. In order to achieve that, many modeling techniques for the interdependencies existing among them have been proposed. Now, a crucial issue is how to use such models to develop tools able to estimate the status of key elements of CIs, quantify the possible threats and suggest adequate countermeasures to human operators and actors. Due to security, commercial and technological aspects, the only feasible approach is to provide distributed and interconnected state/interdependency estimators. In this paper the general problem of the state estimation of interconnected systems sharing the same model is introduced. A first step in the solution of such a challenging problem is then provided in the case of linear systems. The final objective of this research is to define an effective framework for the problem at hand, and then implement and validate an on-line distributed state/interdependency estimator within the EU IST MICIE project.