The rapid digitalization of industrial environments and the increasing convergence of Information Technology (IT) and Operational Technology (OT) have transformed traditional Industrial Control Systems (ICS) into complex Cyber-Physical Systems (CPS). While this evolution enables unprecedented levels of efficiency and automation, it exposes critical infrastructures to a sophisticated and heterogeneous threat landscape where attacks can propagate beyond digital assets to cause production disruptions. Despite the sector’s criticality, current literature suffers from methodological fragmentation; most studies rely on empirical enumeration or ad-hoc processes, lacking structured frameworks for threat identification. This paper addresses this gap by presenting a Systematic Literature Review (SLR) designed to establish a formalized knowledge base for ICS threat modeling. Through a rigorous search of 913 scientific publications, we identified the most relevant contributions to threat definition. The primary contribution of this work is the development of a comprehensive ICS Threat Catalogue, which systematically classifies 87 distinct threats. These threats are mapped to specific assets and communication protocols, aligned with the Purdue Enterprise Reference Architecture. By integrating these findings into a graph-based modeling approach, we leveraged an automated methodology for generating threat models and penetration testing plans. The effectiveness of the catalogue was validated through a Smart Manufacturing case study, where the approach successfully identified 481 potential threats and generated 319 attack plans, demonstrating the practical impact of threat analysis and operational security assessment.

Large Language Models (LLMs) have demonstrated advanced capabilities in code generation and manipulation, inspiring growing concerns about their potential to enhance malware obfuscation. Nevertheless, the cybersecurity literature still lacks wide experimental evidence comparing LLM-driven knowledge-based malware evasion to traditional metamorphic engines. This paper addresses this critical research void through three key contributions: (1) a structured methodology leveraging commercial LLMs (GPT, Claude, DeepSeek, Gemini) against traditional metamorphic engines (MetaMe) using YARA rule detection; (2) experimental evidence demonstrating that LLMs produce variants with significantly higher structural diversity and improved evasion against signature-based detection compared to traditional metamorphic engines, generating variants with substantially greater structural diversity and high evasion rates against signature-based detection; and (3) analysis of LLM-transformed real-world malware (Alina-POS) mutations that systematically evade YARA detection signatures while preserving malicious functionality. Our key insight reveals that LLMs leverage semantic understanding rather than syntactic transformations to achieve effective structural variation in code generation. These findings suggest an emerging trend towards knowledge-based evasion techniques, creating a computational asymmetry where generating sophisticated malware variants requires significantly less expertise and effort than detecting them. This emerging imbalance highlights potential challenges for current malware detection approaches and defensive strategies. • Large Language Models can generate malware variants with higher structural diversity than traditional metamorphic engines. • Empirical analysis shows LLM-based variants achieve improved evasion against signature-based detection. • Evaluation across syscall patterns and structural metrics characterizes transformation behavior and its impact on detection signatures.

Cyber-Physical Systems heavily rely on accurate and timely anomaly detection to ensure safety, security, and resilience, while maintaining low operational costs. However, traditional anomaly detection methods often depend on extensive datasets and heavy computational resources, limiting their practical implementation. This paper introduces a multilayer statistically based architecture designed specifically for real-time anomaly detection in CPS environments, without requiring large training datasets. Leveraging an edge-cloud paradigm, the approach combines lightweight statistical analysis performed locally at the edge with advanced centralised correlation analysis in the cloud. Our methodology dynamically adapts anomaly detection thresholds using Free Probability Theory (FPT), integrating real-time external data sources such as traffic information to significantly reduce false positives. A practical validation through a real-world structural health monitoring case study on a bridge in Caserta, Italy, demonstrates the effectiveness and robustness of our system in detecting anomalies, offering a scalable, adaptive, and efficient solution aligned with European data-sharing directives and standards.

The evolution from traditional power grids to modern smart grids marks a significant advancement in energy management and efficiency. This transition—driven by the implementation of bidirectional energy and information flows—results in a dramatic increase in infrastructure vulnerability since new entry points are introduced on the attack surface. In particular, prosumers represent a brand new—and, thus, largely unexplored—attack vector, for which a thorough re-evaluation of the existing security measures is very much needed. This article proposes a novel approach to security monitoring, which exploits business process knowledge to effectively identify and mitigate prosumer-specific advanced persistent threats in smart grids. To validate the approach, an experimental campaign is done in a real setup, specifically the power grid of the Berchidda municipality, in Italy. Impact evaluation covers technical as well as business aspects since the analysis includes potential economic consequences of the attacks.

The interest in Self-Sovereign Identity (SSI) in research, industry, and governments is rapidly increasing. SSI is a paradigm where users hold their identity and credentials issued by authorized entities. SSI is revolutionizing the concept of digital identity enabling the definition of a trust framework wherein a service provider (verifier) validates the claims presented by a user (holder) for accessing services. However, current SSI solutions primarily focus on the presentation and verification of claims, overlooking a dual aspect: ensuring that the verifier is authorized to access the holder's claims. Addressing this gap, this paper introduces an innovative SSI-based solution that integrates decentralized wallets with Ciphertext-Policy Attribute-Based Proxy Re-Encryption (CP-ABPRE). This combination effectively addresses the challenge of verifier authorization. Our solution, implemented on the Ethereum platform, enhances accountability by notarizing key operations through a smart contract. The paper also offers a prototype demonstrating the practicality of the proposed approach. Furthermore, it provides an extensive evaluation of the solution's performance, emphasizing its feasibility and efficiency in real-world applications.

Abstract The facilitation of sharing and exchanging patients’ health records is a paramount opportunity in e-health, enabling healthcare providers to garner a comprehensive and clear perspective of patients’ medical histories without necessitating direct inquiries. Besides this great advantage, it introduces substantial issues on security and privacy, mainly related to unauthorized access to e-health records when different healthcare service providers maintain records. In this paper, we deal with this problem and propose using the blockchain technology (1) to obfuscate the linkage between patients’ identities and their e-health records and (2) to grant access to e-health records exclusively to entities authorized by patients themselves. Key outcomes include using a digital identity based on the Electronic Identification, Authentication, and Trust Services Regulation (eIDAS) to control access to these records, and a concrete implementation by adopting the Ethereum blockchain. Our solution relies on using a public blockchain, which is an improvement for the state of the art, in which only private or consortium blockchains have been proposed. The resulting solution has been analyzed, and the effectiveness and affordability of the proposal have been shown.

The adoption of Digital Twin technology has witnessed significant growth in various domains, enabling continuous monitoring and testing in diverse applications. In the context of safeguarding critical infrastructures, particularly smart grids, Digital Twin has emerged as a viable solution to meet the requirements outlined in the NIS2 directive issued by the European Commission. Additionally, the increasing trend in Europe towards establishing shared dataspaces, and fostering collaborative environments through data sharing, necessitates a heightened focus on cybersecurity risks.

In the past few years, the energy sector has been among the most targeted by cyber-criminals. Due to the strong reliance of Critical Infrastructures on energy distribution, and the strategic value of such systems, the impact of intrusions and data breaches cannot be underestimated. In this scenario, data constitutes a critical asset to protect, especially as the latest technological development has led to interconnected intelligent systems, named smart grids. The consequences of data tampering, exposure or loss can range from disruption of essential services, to serious risks for environment, economy and people safety. Data provenance, as the documentation of the origin of data and the processes and methodology that led to it, can bring support when facing the aforementioned attacks. The present work aims to address security issues in the energy domain, by proposing the Advanced Tamper-Resistant Storage (ATRS), a novel framework for data provenance based on blockchain technology. The ATRS allows for the creation and storage of provenance records, whose reliability is ensured by the tamper-resistance feature enabled through the combination of blockchain and TLS-based communication. The framework, tailored and tested for the smart grid domain, can easily be customized for different critical use cases.

An important objective being pursued by the European Commission is the establishment of a unified data market where stakeholders can safely and confidently share and exchange data in standardized formats. This trend is supported by numerous initiatives, promoting the creation of European Common data spaces, and it is already in full swing in several sectors, such as energy and health. Among the many initiatives for building common data spaces, FIWARE appears to be one of the most promising. FIWARE promotes the use of Digital Twin technology to build distributed infrastructures for facilitating real-time data sharing in collaborative environments. By fostering an open and collaborative approach to software development and providing several building blocks of IT architectures for a number of domains (specifically: Smart AgriFood, Smart Cities, Smart Energy, Smart Industry, and Smart Water), FIWARE facilitates the creation of Digital Twins of real-world Industry 4.0 setups in a shared data space, which is typically hosted in the cloud. This paper addresses the security issues in a typical functional FIWARE architecture and provides a detailed description of a reference solution which ensures data confidentiality and integrity throughout the data life cycle, i.e. from the generation to the consumption phase. The proposed solution strongly relies on Commercial Off The Shelf Trusted Execution Environment technologies (namely: Intel SGX and Arm TrustZone) to provide effective protection of data-in-use. Protection of data-at-rest and data-in-transit is achieved by means of advanced cryptographic techniques and secure communication protocols, respectively.

Level Crossings are among the most critical railway assets, concerning both the risk of accidents and their maintainability, due to intersections with promiscuous traffic and difficulties in remotely monitoring their health status. Failures can be originated from several factors, including malfunctions in the bar mechanisms and warning devices, such as light signals and bells. This paper focuses on the intelligent detection of anomalies in warning bells through non-intrusive acoustic monitoring by: (1) introducing a new concept for autonomous monitoring of level crossings; (2) generating and sharing a specific dataset collecting relevant audio signals from publicly available audio recordings; (3) implementing and evaluating a solution combining deep learning and transfer learning for warning bell detection. The results show a high accuracy in detecting anomalies and suggest viability of the approach in real-world applications, especially where network cameras with on-board microphones are installed for multi-purpose level crossing surveillance.

Abstract The emergence of 5G technologies opens up new opportunities for railway communications. One of the foundational aspects of 5G architecture is its control-plane programmability, which can be achieved through Software Defined Networking (SDN). In railway scenarios, this can be used to dynamically reconfigure the network for a more effective and efficient management of communication flows produced by moving trains. The paper presents a framework for integrating modelling and analysis tools into a programmable control plane specifically tailored to railway communications. We introduce the concept of domain-awareness in the network control plane as an SDN-enabled feature that allows achieving application-specific advantages besides those purely expressed in terms of key performance indicators such as the quality of service. We propose a reference architecture in which domain-awareness in the control plane is obtained by considering information gathered by network devices and ad-hoc communication gateways that are able to detect relevant signalling events. In the architecture, the actual behaviour of the SDN controller is governed by applications that are able to react to specific triggers and re-configure network devices accordingly. We also provide a methodological framework based on model-driven engineering and formal methods, including dynamic state machines, for the automatic generation of SDN control plane logic.

Artificial Intelligence (AI) is becoming pervasive in most engineering domains, and railway transport is no exception. However, due to the plethora of different new terms and meanings associated with them, there is a risk that railway practitioners, as several other categories, will get lost in those ambiguities and fuzzy boundaries, and hence fail to catch the real opportunities and potential of machine learning, artificial vision, and big data analytics, just to name a few of the most promising approaches connected to AI. The scope of this paper is to introduce the basic concepts and possible applications of AI to railway academics and practitioners. To that aim, this paper presents a structured taxonomy to guide researchers and practitioners to understand AI techniques, research fields, disciplines, and applications, both in general terms and in close connection with railway applications such as autonomous driving, maintenance, and traffic management. The important aspects of ethics and explainability of AI in railways are also introduced. The connection between AI concepts and railway subdomains has been supported by relevant research addressing existing and planned applications in order to provide some pointers to promising directions.

Abstract The current travel demand in railways requires the adoption of novel approaches and technologies in order to increase network capacity. Virtual Coupling is considered one of the most innovative solutions to increase railway capacity by drastically reducing train headway. The aim of this paper is to provide an approach to investigate the potential of Virtual Coupling in railways by composing stochastic activity networks model templates. The paper starts describing the Virtual Coupling paradigm with a focus on standard European railway traffic controllers. Based on stochastic activity network model templates, we provide an approach to perform quantitative evaluation of capacity increase in reference Virtual Coupling scenarios. The approach can be used to estimate system capacity over a modelled track portion, accounting for the scheduled service as well as possible failures. Due to its modularity, the approach can be extended towards the inclusion of safety model components. The contribution of this paper is a preliminary result of the PERFORMINGRAIL (PERformance-based Formal modelling and Optimal tRaffic Management for movING-block RAILway signalling) project funded by the European Shift2Rail Joint Undertaking.

The use of pervasive IoT devices in Smart Cities, have increased the Volume of data produced in many and many field. Interesting and very useful applications grow up in number in E-health domain, where smart devices are used in order to manage huge amount of data, in highly distributed environments, in order to provide smart services able to collect data to fill medical records of patients. The problem here is to gather data, to produce records and to analyze medical records depending on their contents. Since data gathering involve very different devices (not only wearable medical sensors, but also environmental smart devices, like weather, pollution and other sensors) it is very difficult to classify data depending their contents, in order to enable better management of patients. Data from smart devices couple with medical records written in natural language: we describe here an architecture that is able to determine best features for classification, depending on existent medical records. The architecture is based on pre-filtering phase based on Natural Language Processing, that is able to enhance Machine learning classification based on Random Forests. We carried on experiments on about 5000 medical records from real (anonymized) case studies from various health-care organizations in Italy. We show accuracy of the presented approach in terms of Accuracy-Rejection curves.

Modern cars include a huge number of sensors and actuators, which continuously exchange data and control commands. The most used protocol for communication of different components in automotive system is the Controller Area Network (CAN). According to CAN, components communicate by broadcasting messages on a bus. In addition, the standard definition of the protocol does not provide information for authentication, so exposing it to attacks. This paper proposes a method based on deep learning aiming at discovering attacks towards the CAN-bus. In particular, Neural Networks and MultiLayer Perceptrons are the class of networks employed in our approach. We also validate our approach by analysing a real-world dataset with the injection of messages from different types of attacks: denial of service, fuzzy pattern attacks, and attacks against specific components. The obtained results are encouraging and demonstrate the effectiveness of the approach.

Railway infrastructure operators need to push their network capacity up to their limits in high-traffic corridors. Virtual coupling is considered among the most relevant innovations to be studied within the European Horizon 2020 Shift2Rail Joint Undertaking as it can drastically reduce headways and thus increase the line capacity by allowing to dynamically connect two or more trains in a single convoy. This paper provides a proof of concept of Virtual coupling by introducing a specific operating mode within the European rail traffic management system/European train control system (ERTMS/ETCS) standard specification, and by defining a coupling control algorithm accounting for time-varying delays affecting the communication links. To that aim, we define one ploy to enrich the ERTMS/ETCS with Virtual coupling without changing its working principles and we borrow a numerical analysis methodology used to study platooning in the automotive field. The numerical analysis is also provided to support the proof of concept with quantitative results in a case-study simulation scenario.

Web of Trust offers a way to bind identities with the corresponding public keys. It relies on a distributed architecture, where each user could play the role of certificate signer. With the widespread diffusion of social networks, the trust propagation is a matter of growing interest. This paper proposes an approach enabling the propagation in Web of Trust by means of Ethereum. The usage of Ethereum eliminates the necessity of single-organization trusted services, which is, in general, not realistic. Although the information stored on Ethereum is public, the privacy of users is protected because trust chains involve only Ethereum addresses and strong measures are implemented to contrast their malicious de-anonymization. The approach relies on the usage of a smart contract for storing the status of certificate signatures and to manage revocations. When a user u wants to trust another user v, the smart contract checks the presence of trust chains originating from root nodes of u.

Online Social Networks (OSNs) represent an important source of information since they manage a huge amount of data that can be used in many different contexts. Moreover, many people create and manage more than one social profile in the different available OSNs. The combination and the extraction of the set of data from contained in OSNs can produce a huge amount of additional information regarding both a single person and the overall society. Consequently, the data extraction from multiple social networks is a topic of growing interest. There are many techniques and technologies for data extraction from a single OSN, but there is a lack of simple query languages which can be used by programmers to retrieve data, correlate resources and integrate results from multiple OSNs. This work describes a novel query language for data extraction from multiple OSNs and the related supporting tool to edit and validate queries. With respect to existing languages, the designed language is general enough to include the variety of resources managed by the different OSNs. Moreover, thanks to the support of the editing environment, the language syntax can be customised by programmers to express searching criteria that are specific for a social network.

Model-driven techniques can be used to automatically produce formal models from different views of a system realised by using several modelling languages and notations. Specifications are transformed into formal models so facilitating the analysis of complex system for design, validation or verification purposes. However, no single formalism suits for representing all system’s views. In particular, the assessment of non-functional properties often requires integrated modelling approaches. The ultimate goal of the research work described in this paper is to develop a comprehensive, theoretical and practical framework able to support the development and the integration of new or existing model-driven approaches for the automatic generation of multi-formalism models. This paper defines the core theoretical ideas on which the framework is based and demonstrates their concrete applicability to the development of a multi-formalism approach for performability assessment.

This paper aims at defining a model-driven approach for the diagnosability analysis of discrete event systems (DES). The proposed approach can be adopted during the design of modern control systems, in which many sensors and actuators are employed and the diagnosability of faults within a certain delay could be an issue. The proposal represents a first step towards an automatic model-driven process which derive formal models from a complete high-level specification of DESs. The specification activity of our approach relies on the Dynamic STate Machine (DSTM) formalism, a new language that extends state machines with dynamic instantiation, interrupts and asynchronous communication. The paper will describe how we can automatically derive Petri net and Promela models from the high-level DSTM specification. The former model can be used to apply diagnosability analysis approaches proposed in the DES community, while the latter can be used to apply model checking techniques. An application of the proposed model-driven approach is described by deriving both a PN and a Promela model for the well-known railway level crossing benchmark.

The huge amount of data collected everyday for different purposes by a multitude of smart devices enables the delivery of added-value services to end-users by means of smart applications. Among them, the applications devoted to optimizing the energy consumption through smart power grids are gaining more and more attention due to their impact on both the environment and the costs for the users. The design and evaluation of Smart Energy systems is very complex due to the heterogeneity of involved devices and technologies, and to the high variability of energy production and consumption profiles. In this regard, in this paper we propose a model-based methodology for the evaluation of Smart Energy systems, which merges system modeling and cognitive computing techniques to obtain a representation of the systems' behavior that takes into account a data-driven characterization of the workload and of the overall context. Such a representation allows to estimate properties of interest in different operative conditions, and can be profitably used to make design choices and to tune the application behavior during operation based on collected data. In order to demonstrate the effectiveness of our proposal, we present an example Smart Energy system modeled by means of the Stochastic Activity Network (SAN) formalism, and we show how it is possible to perform several analyses on the system configuration by means of model simulations.