Integrating physical and cyber realms, Cyber–Physical Systems (CPSs) expand the potential attack surface for intruders. Given their deployment in critical infrastructures like Industrial Control Systems (ICSs), ensuring robust security is imperative. Current research has developed various Intrusion Detection techniques to identify and counter malicious activities. However, traditional methods often encounter challenges in detecting several attack types due to reliance on a single data source such as time series data from sensors and actuators. In this study, we meticulously design advanced Deep Learning (DL) anomaly-based techniques trained on either sensor/actuator data or network traffic statistics in an unsupervised setting. We evaluate these techniques on network and physical data collected concurrently from a real-world CPS. Through meticulous hyperparameter tuning, we identify the optimal parameters for each model and compare their efficiency and effectiveness in detecting different types of attacks. In addition to demonstrating superior performance compared to various baselines, we showcase the best model for each data source. Eventually, we show how utilizing diverse data sources can enhance cyber-threat detection, recognizing different kinds of attacks. • We design DL anomaly-based techniques trained on either sensor or network data. • We evaluate techniques on different data sources collected from a real-world CPS. • After hyperparameter tuning, we compare the models’ attack detection ability. • We demonstrate superior performance compared to state-of-the-art base-lines. • We show how utilizing diverse data sources can enhance cyber-threat detection.

The protection of Cyber–Physical Systems (CPSs) from cybersecurity threats is essential to ensure the resilience and safety of critical infrastructures. Anomaly detection approaches for CPSs proposed in the literature use either network data or data from sensors/actuators as inputs, often failing to detect attacks that affect only specific components. In this paper, we propose a novel two-stage framework for threat detection in CPSs. This framework integrates anomaly detection models that operate on both network and physical data, by leveraging a decision fusion technique to combine the outputs into a coherent decision. To assess the effectiveness of the framework, we employ an unlabeled release of a real-world dataset, integrating network traffic with sensors/actuators data. Additionally, we offer explicit labeling rules to ensure reproducibility. The results demonstrate that our approach substantially improves CPSs security, efficiently identifying subtle attacks that can evade traditional methods relying on a single data source. In particular, we show that integrating both physical and network data improves the F1 score by approximately 10% compared to using just network data, and by nearly 30% compared to using just physical data. • We propose a framework for CPS threat detection using both network and physical data. • We integrate diverse deep learning models to analyze each data source independently. • We design a decision fusion technique to integrate network and sensor readings. • We achieve a 10% F1 improvement over network data and a 30% over sensor data. • Our method detects threats in 2–3 s, enabling quick response to CPS attacks.

Chronicles of the last few years show that industrial Cyber-Physical Systems are the target of dangerous cyber-attacks and face multiple threats. It is important to react as promptly as possible to such attacks and take proper countermeasures. Anomaly detection is a key activity in a Cyber-Physical System’s defense strategy. It involves analyzing sensor data, modeled as a Multivariate Time Series, to identify deviations from expected behavior, that may indicate potential cyber threats or attacks. In this paper, we design a novel framework integrating spatial and temporal modules to unveil spatio-temporal dependencies within sensor data in Cyber-Physical Systems to detect possible intrusions. We propose a novel strategy based on time series correlation to build a graph minimizing the number of sensors’ connections to unveil spatial dependencies between multimodal time series. The prediction and reconstruction losses are then leveraged to detect anomalies. The proposed framework has been evaluated on a real-world Cyber-Physical System, on which we evaluated both the efficacy and efficiency with respect to different competing approaches. The experimental analysis shows that the proposed framework outperforms eight state-of-the-art ones by increasing the precision of 0.59% while reducing both the training time (21.05%) for each epoch and memory occupation (77.8%) with respect to the best competitor in the literature. These characteristics make it particularly suitable for industrial environments that need periodic reconfigurations.

Software-Defined Wide Area Networks (SD-WANs) have emerged as a promising solution to address the connectivity demands of modern distributed enterprises. However, the effective application of the Software Defined Networking (SDN) paradigm in such broad and dynamic environments remains a significant challenge. In this paper, we present two novel contributions. First, we design a decentralized control plane for SD-WANs that leverages edge-based network monitoring and overlays’ configuration. Then we present a Reinforcement Learning-based orchestration plane that leverages local information for the enforcement of SD-WAN policies. Since traditional approaches suffer either a lack of scalability due to the problem’s complexity or suboptimal performance due to isolated decision-making, the proposed approach leverages a cooperative Multi-Agent Reinforcement Learning framework. Our novel cooperative approach is based on per-site agents that exchange a small amount of information to enhance performance while preserving scalability. To validate the efficacy of our proposed approach, we conducted an extensive experimental evaluation considering diverse SD-WAN scenarios. Results show that our framework is able to satisfy global network policies for a multi-site SD-WAN with different QoS requirements and cost constraints.

Software Defined Wide Area Network (SD-WAN) is rapidly becoming an attractive solution for enterprise networks as it offers several benefits such as cost efficiency, increased bandwidth, and improved application performance. However, SDWAN also brings new challenges that must be addressed for effective deployment (i.e. openness, interoperability, network automation, monitoring, QoS guarantees, scalability and security). In this paper, we highlight the criticalities of this technology and analyze the solutions proposed by the state of the art. We then present a scalable framework based on distributed Reinforcement Learning agents for guaranteeing availability and QoS to business applications. We believe that our work provides valuable insights into the opportunities and challenges of SD-WAN technology and offers new perspectives for future research in this area.

Ubiquitous utilization of Information and Communication Technologies in modern manufacturing plants has transformed them into Cyber-Physical Systems (CPSs), making them susceptible to cyber-attacks, which can have huge economic and social impact. In this paper, we focus on the security issues that may affect the Industrial Control System (ICS) supervising an industrial establishment. The purpose of this work is to provide readers with an up-to-date view of the methodologies that current literature suggests as the most appropriate to defend an ICS against cyber-attacks. We firstly provide a classification of existing attacks according to the methodology used by the attacker. Subsequently, we propose a classification of defensive countermeasures in Model and Artificial Intelligence-based approaches by analyzing most recent research contributions. Furthermore, we describe the most used datasets in literature that are available to researchers and practitioners. We conclude the paper by discussing today's open issues, which need to be addressed to cope with the increasing complexity of ICS security.

Abstract The emergence of 5G technologies opens up new opportunities for railway communications. One of the foundational aspects of 5G architecture is its control-plane programmability, which can be achieved through Software Defined Networking (SDN). In railway scenarios, this can be used to dynamically reconfigure the network for a more effective and efficient management of communication flows produced by moving trains. The paper presents a framework for integrating modelling and analysis tools into a programmable control plane specifically tailored to railway communications. We introduce the concept of domain-awareness in the network control plane as an SDN-enabled feature that allows achieving application-specific advantages besides those purely expressed in terms of key performance indicators such as the quality of service. We propose a reference architecture in which domain-awareness in the control plane is obtained by considering information gathered by network devices and ad-hoc communication gateways that are able to detect relevant signalling events. In the architecture, the actual behaviour of the SDN controller is governed by applications that are able to react to specific triggers and re-configure network devices accordingly. We also provide a methodological framework based on model-driven engineering and formal methods, including dynamic state machines, for the automatic generation of SDN control plane logic.

In the last few years, there has been a remarkable growth in the number of data centers, which represent one of the leading sources of increased business data traffic on the Internet. An effect of the growing scale and the wide use of data centers is the dramatic increase of power consumption, with significant consequences both in terms of environmental and operational costs. Hence, energy awareness has become one of the major design constraints for Cloud infrastructures. In order to face these challenges, a new generation of energy-efficient and ecosustainable network infrastructures is needed. In this work, a novel energy-aware resource orchestration framework for distributed Cloud infrastructures is introduced, in order to manage both network and IT resources in a typical optical backbone. A high-level overview of the system architecture is provided by focusing on the definition of the different layers of the whole infrastructure, and introducing the Path Computation Element, which is the key component of the proposed architecture. The aim is to explain how both network and IT resources can be managed while, at the same time, the overall power consumption is being minimized and QoS requirements are satisfied. Finally, a green migration plan that is obtained by applying Virtual Machine relocation algorithms is discussed, in order to dynamically react to the fluctuating resource requirements of the VMs.

Cloud Computing has risen a great interest over the last years as it represents an enabling technology for flexible and ubiquitous access over the network to a set of shared computing resources. This work comes from an industrial experience aiming at exploiting the cloud potential for virtualizing complex infrastructures such as an entire Air Traffic Center (ATC), a clear example of complex SoS (System of Systems). The use of virtualization is convenient because industry can leverage in-house test-beds to perform distributed testing campaigns in pre-operational phases or to design new automatic fail-over mechanisms for fully distributed systems. In order to realize such mitigation and recovery techniques in the ATC field, indeed, a cloud platform is required to guarantee a low VM provisioning time with the objective of minimizing the service disruption. In this perspective, after having introduced the principal concepts and factors of the provisioning time, we propose a deep analysis and comparison for two different Infrastructure-as-a-Service (IaaS) platforms, namely Open Stack and Open Nebula (using KVM as hypervisor), that were selected through a preliminary scouting phase.

Recent contributions on energy-aware management, aimed at improving the energy efficiency of network infrastructures are based on a combined use of two levers: power consumption optimization obtained by (wholly or partially) switching off a single network device and traffic engineering strategies (with related algorithms) that, given the traffic model on a daily time period, minimize the global energy consumption avoiding traffic congestion. Switches, routers and links of the actual Internet are often represented by simple power consumption models, based on just a few states (typically, on and off). Time for off-to-on switching is often ignored. We claim that complex large-scale network infrastructures need an energy-conscious control plane, which is able of quickly configuring the network by taking into account both energy efficiency goals and QoS constraints. In this paper we present a green extension to the GMPLS network control plane, that is able of minimizing the global power consumption under QoS constraints. Time for fully activating components that were initially in stand-by or off is considered as a QoS requirement.

Network virtualization is gaining a lot of interest from the research community thanks to its ability to support new networking paradigms and experimental scenarios. Virtual network embedding (VNE) is a key step for enabling network virtualization and its efficiency allows to maximize the profits of the physical network (also called substrate network) provider. In this paper we focus on the cases where the substrate network consists of a multi-radio IEEE 802.11 wireless mesh network. In such kind of network, bandwidth of a wireless link depends on the rate used to transmit but also on the number of wireless links that use the same channel, because of interference. Exploiting such a property, we propose a heuristic for the online, i.e. requests are not known in advance, VNE problem that is able to increase the profit of the substrate network provider by fictitiously augmenting the network resources and then reconfiguring the channels to avoid congestion.

Cloud-enabled datacenters need advanced support for an integrated management of platform virtualization technologies. The networking infrastructure of large-scale datacenters is implemented according to redundant multi-tiered architectures whose layers operate at Layer 3 of the networking stack. Splitting the network infrastructure of a datacenter in a number of IP subnets, however, creates limits to the migration of Virtual Machines, reducing the possibility for administrators to efficiently balance the load and reduce the energy consumption of the whole infrastructure. In this paper we propose an innovative solution that allows transparent migration of Virtual Machines across the whole datacenter, based on the coordinated use of NAT rules that need to be consistently managed across the layers of the datacenter networking infrastructure. We describe in details how our approach can be easily implemented with current network devices without any modification to their hardware and present an experimental evaluation of an early prototype of our solution.

The ultimate success of the Wireless Mesh Network paradigm (WMN) in large scale deployments depends on the ability to test it in real world scenarios. A typical application scenario which is worth to be investigated in such a context is peer-to-peer traffic management. The creation of large scale testbeds for evaluating wireless mesh technologies and protocols, and for testing their ability to support real world applications in realistic environments, is then a crucial step. OMF (cOntrol and Management Framework) is a well-established control, measurement, and management framework for wireless testbeds. In this paper we present how we integrated an OMF-based wireless testbed in the planetary-scale PlanetLab testbed, making it possible for PlanetLab users to run experiments spanning on both PlanetLab and an OMF-based wireless testbed. In order to demonstrate the usefulness of such an integrated scenario, we tested on it an innovative peer-to-peer traffic optimization technique for the BitTorrent file sharing application. The possibility of running this kind of experiments highlighted several real-world issues which could be investigated thanks to our hybrid experimental scenario.

Wireless Mesh Networks (WMNs) have recently gained wide attention as a way to provide Internet connectivity in hard-to-reach areas as well as in big cities. The main problem of such networks is their limited bandwidth availability compared to wired networks. Hence, efficient usage of available communication resources is of crucial importance for WMNs. Peer-to-peer applications, these days, produce a considerable amount of traffic over the Internet. Such applications build their own overlay network by not taking into account the topology and the status of the underlying infrastructure, so causing an inefficient utilization of physical communication resources. This problem is particularly severe for Wireless Mesh Networks. In this paper we propose a cross-layer solution for P2P Bittorrent traffic optimization in WMNs, based on the ALTO (Application Layer Traffic Optimization) Service recently defined by the IETF. Our solution is able to significantly optimize Bittorrent traffic and it does not require any modification to the Bittorrent application. The tests we performed show a reduction of about 27% of download time and a reduction of about 66% of traffic crossing the WMN borders.

The success of the Cloud Computing paradigm may be jeopardized by concerns about the risk of misuse of this model aimed at conducting illegal activities. In this paper we address the issue of detecting Denial of Service attacks performed by means of resources acquired on-demand on a Cloud Computing platform. To this purpose, we propose to investigate the consequences of the use of a distributed strategy to detect and block attacks, or other malicious activities, originated by misbehaving customers of a Cloud Computing provider. In order to check the viability of our approach, we also evaluate the impact on performance of our proposed solution. This paper presents the installation and deployment experience of a distributed defence strategy and illustrates the preliminary results of the performance evaluation.

Planetlab is widely recognized as being one of the most important Internet-scale testbeds. However, while allowing experimentations involving hundreds of hosts spread all over the world, PlanetLab still suffers of a few significant limitations. One of these limitations is the lack of heterogeneity, in particular in terms of access technologies. In this paper we describe the efforts we made, in the context of the OneLab European project, in order to mitigate this problem. In particular, we describe how we managed to integrate UMTS connectivity into a PlanetLab-based testbed. We illustrate the technical challenges we had to face, the final result we obtained, and present a case study meant to show the utility of having UMTS connectivity available in Planetlab.

This paper presents a work in progress which deals with the important and unresolved problem of node misbehavior. A realistic approach is used to determine the impact of contention window manipulation on IEEE 802.11e ad-hoc networks. It is explained why such networks are more prone to misbehavior. Novel results pertaining to the 802.11e standard are presented. Simulation analysis is done for several scenarios with a distinction made for uplink and downlink traffic. It is shown that a misbehaving node can jeopardize network performance, therefore, countermeasures to this problem need to be developed.

Simulation of large scale network scenarios is a challenging task and requires a great amount of computational power. Hence, realizing Web-accessible simulation servers is a key step for the success of network simulation as a useful instrument in the context of network administration and capacity planning. This paper presents an XML-based description language for describing network simulation scenarios. For the proposed language, we also present an XSL translation process that can be used to automatically translate a simulation scenario into a simulation script for a well known network simulator. This work is part of a larger project, aimed at implementing a cluster-based network simulation server to be integrated in a distributed system for QoS monitoring, SLA validation and measurement-based modeling in an inter-domain environment.

Abstract A number of distributed applications require communication services with quality of service (QoS) guarantees. Building global‐scale distributed systems with predictable properties is one of the great challenges for computer systems engineering in the new century. Work undertaken within the Internet Engineering Task Force has led to the definition of novel architectural models for the Internet with QoS support. According to these models, the network has to be appropriately configured in order to provide applications with the required performance guarantees. In next‐generation networks, enabling applications to interact with the underlying QoS services is of primary importance. Hence, several special‐purpose application programming interfaces (APIs) have been defined to let applications negotiate QoS parameters across QoS‐capable networks. However, so far, none of these APIs are available in different operating environments. We believe that such features should be embedded in programming environments for distributed applications. In this work we present how we included QoS control features in Tcl, a programming language that has been widely adopted for the development of distributed multimedia applications. Our work has led to the implementation of QTcl, an extended Tcl interpreter that provides programmers with a new set of primitives, in full compliance with the standard SCRAPI programming interface for the RSVP protocol. QTcl in highly portable, in that it enables standard QoS negotiation to be performed in a seamless fashion on the most common operating systems. Copyright © 2003 John Wiley & Sons, Ltd.

A number of distributed applications require communication services with Quality of Service (QoS) guarantees. Work undertaken within the Internet Engineering Task Force (IETF) has led to the definition of novel architectural models for the Internet with QoS support. According to these models, the network has to be appropriately configured in order to provide applications with the needed performance guarantees. In a first proposal, called Integrated Services, applications need to explicitly interact with network routers by means of a signaling protocol (such as RSVP), in order to enforce QoS on a per-flow basis. The Differentiated Services architecture, on the other hand, looks after scalability, thus providing performance guarantees to aggregates of flows. In the case of real-time applications, a hybrid model capable of putting together micro-flow guarantees in the access network and aggregate management in the backbone seems to represent the ideal tradeoff between strict performance and scalability. In this scenario, giving applications a means to interact with the underlying QoS services is of primary importance. Hence, several special-purpose APIs have been defined to let applications negotiate QoS parameters across QoS-capable networks. However, so far, none of these APIs is available for the use of programmers in different operating environments. We believe that such features should be embedded in programming environments for distributed applications. In this work we present how we included QoS control features in a programming language that since years has been adopted for the development of network-based applications: Tcl. We present QTcl, an extension of Tcl, which provides program- mers with a new set of primitives fully compliant with the standard SCRAPI programming interface for the RSVP protocol. We gave QTcl a high portability, in that it enables standard QoS negotiation to be performed in a seamless fashion on the most common operating systems.