Combined cyber and physical attacks on Critical Infrastructures have disastrous consequences on economies and in social well-being. Protection and resilience of CIs under combined attacks is challenging due to their complexity, reliance on ICT systems and the interdependences between different types of CIs. The PRAETORIAN framework was designed to address these challenges, by integrating components responsible for detecting both cyber and physical threats. Additionally, it forecasts how the combined attacks will evolve and their cascading effects on interdependent CIs. The PRAETORIAN framework was demonstrated based on a realistic scenario in the Zagreb airport, combining both physical and cyber attacks.

In this paper, we describe the functioning of the PRAETORIAN Framework, an integrated platform to identify complex threats across the physical and cyber domains of Critical Infrastructures (CIs). Therefore, the framework combines a physical and a cyber situation awareness solution into an innovative Hybrid Situation Awareness tool to detect the different stages of a complex threat. Further, the framework supports the decision makers and emergency organizations with a Coordinated Response tool to align and plan the activities for reducing or preventing the effects of an attack. All aspects are described according to a real-life use case that has been tested at the Zagreb airport.

Cyberattacks, which consist of exploiting security vulnerabilities of computer networks and systems for any kind of malicious purpose (e.g., extortion, data steal, assets hijacking), have been continuously increasing worldwide in recent years. Cyberspace appears today as a new battlefield, along with physical world scenarios (land, sea, air, and space), for the organizations defence and security. Besides, by the fact that attacks from the physical world may have significant implications in the cyber world and vice versa, these dimensions cannot be understood independently. However, the most common intelligence systems offer an insufficient situational awareness exclusively focused on one of these decision spaces. This article introduces HYBINT, an enhanced intelligence system that provides the necessary decision-making support for an efficient critical infrastructures protection by combining the real-time situation of the physical and cyber domains in a single visualization space. HYBINT is a real cross-platform solution which supplies, through Big Data analytical methods and advanced representation techniques, hybrid intelligence information from significant data of both physical and cyber data sources in order to bring an adequate hybrid situational awareness (HSA) of the cyber-physical environment. The proposal will be validated in a detailed scenario in which HYBINT system will be evaluated.