Abstract Critical infrastructure mainly performs its role through an industrial control system (ICS). Organizations conduct cyber exercises between red and blue teams, focusing on offense and defense. Practical exercises require explicit attack scenarios and corresponding defense strategies. However, systematic guides for deriving cyberattack scenarios or defense strategies still need to be improved. This paper proposes a guide for establishing realistic attack scenarios and defense strategies for cybersecurity exercises in ICS environments. Attack scenario generation is divided into four steps: generating attack references, deriving attack sequences, mapping threat information, and mapping vulnerable implementation patterns. Deriving a defensive strategy consists of two steps parallel to developing an attack scenario: deriving containment and eradication. The methodology we propose guides exercise planning based on a knowledge base, thereby assisting exercise planners in generating various scenarios and deriving clear defense strategies. We showed that a clear exercise plan could be established through a case study.

The Software Defined Networking (SDN) paradigm has shifted the network intelligence from the network devices to the centralized controller. The controllers are placed in a distributed manner in a network for reliability and load balancing. However, the placement of controllers considering the whole network is not an efficient approach because applying the objective function to the overall network is a challenging task. Therefore, the division of the network into clusters makes the assignment of the switches to the controller more efficient. The placement of the controller in a cluster not only reduces the latency between the switches and the controller but other objectives such as reliability, load balancing, robustness and energy saving can also be applied to the clusters. Therefore, in this poster, a multi-criteria-decision-making (MCDM) scheme known as the Analytical Network Process (ANP) is proposed for controller place selection using clustering.

Because disaster situations can cause damage to people and property, fast recognition and Countermeasure is important. IoT and MR, the technologies that have become popular nowadays, expected to play a key role in this domain. In this paper, we will introduce MR and IoT Convergence Platform with AI Support for Disaster Recognition This platform can recognize a disaster situation with sensors and AI system, and report to the user's MR devices. Also, we build a prototype using OneM2M-based Mobius Platform, Microsoft Hololens, and CNN-based AI Camera for proving feasibility.