Jul 2026· International Conference on Control, Decision and Information Technologies· pp. 1257-1262· 0 citations· 18 references
Abstract
The transition toward Industry 4.0 exposes SCADA systems to significant cyber-physical risks due to increased remote connectivity. The Industrial Cyber Shield (ICS) project, funded by the National Institute for Insurance against Accidents at Work (INAIL), responds to this challenge through an intrusion response system that is composed of two main modules: a centralized Orchestrator and multiple distributed Shield modules. The Shields are deployed inline to protect Programmable Logic Controllers (PLCs), employing Snort for real-time network analysis and recurrent neural networks for physical process anomaly monitoring. Detected events are transmitted via a Kafka broker to the Orchestrator, which provides automated response instructions in real-time. Experimental validation on a water distribution testbed demonstrates that the architecture introduces negligible latency (less than 1 ms) and maintains limited hardware resource consumption. The system successfully neutralizes simulated attacks while preserving the stringent timing requirements of industrial communications, ensuring both operational transparency and plant safety.
The NIS2 Directive strengthens governance and time-bound incident reporting obligations for cybersecurity in critical sectors, while Industrial Ethernet and IT/OT convergence expose deterministic shop-floor networks to broader threat propagation. This paper introduces an engineering approach to the application of the NIS2 Directive for reducing the detection latency at the OT level without excessively increasing the costs. The proposed architecture is based on an innovative complementary device, the Early Warning System (EWS), tailored for OT monitoring and designed for integration with enterprise monitoring (Security Information and Event Management—SIEM) and operational response (SOC/MDR—Security Operations Center/Managed Detection and Response). The EWS adopts a silent device paradigm: because the honeypot has no production role, any interaction becomes a high-confidence signal, minimizing false positives. The EWS is freely available open-source and, to fit heterogeneous plants, it offers two deployment modes, both with zero impact on network latency and timing: Full Mode combines passive monitoring via SPAN/port mirroring with a low-interaction honeypot, while Light Mode provides a pure decoy for resource-constrained edge hardware. The implementation is containerized (Docker) and forwards events to an external SIEM. Two validation steps are presented: the first, on a real PROFINET robotic cell using the Full-mode, demonstrates the zero false positives in normal operations, the detection of reconnaissance scans, baseline deviations, and ARP spoofing attempts; while the second, on three emulated industrial control systems using the ICS-NAD dataset, shows the effectiveness in realistic industrial applications.
Tommaso Bianchin, Dennis Brandão, E. Sisinni et al.· Applied Sciences· 0 citations
The System-on-Chip (SoC) strategies exemplifying the use of Physically Unclonable functions (PUF) in the generation of data provenance attributes to boost the cyber-physical security infrastructures in digital oil fields are highlighted.
Abdallah Abu-Saeed, E. Ayodele, Sani Salisu et al.· SPE Nigeria Annual Internati...· 0 citations
Industrial control systems (ICSs) are the operational technology that monitors and directs physical processes across critical infrastructure. They sit at the core of Industry 4.0. Once these systems are connected to digital platforms and service chains, a flaw in one component is no longer confined to that component. Conventional practice still treats disclosed vulnerabilities as isolated events to be patched, which leaves an open question: does the way vulnerabilities accumulate across ICS infrastructure amount to systemic risk, a property of the system rather than of any single flaw? We examine this using the ICS-CERT Vulnerability Dataset, analysing 60,378 vulnerability-product records that cover 2327 unique Common Vulnerabilities and Exposures (CVE) entries, 416 vendors and 14,577 affected products from 2012 to 2020. We construct a System Risk Index (SRI) that aggregates vulnerabilities to the vendor-year level, weighted by severity and exploitability. An ordinary least squares (OLS) model with heteroscedasticity-robust standard errors explains vulnerability severity (R2 = 0.99). A second model explains system-level risk (R2 = 0.91). Vulnerability-type diversity, measured through the Common Weakness Enumeration (CWE) taxonomy, is the strongest driver of SRI (β = 1.25, p < 0.001), ahead of mean exploitability (β = 0.29, p < 0.001) and product breadth (β = 0.06, p = 0.001). Annual ICS disclosures rose from 115 in 2012 to 503 in 2019, an increase of 337 per cent. Risk is concentrated: the five largest vendors account for 33.3 per cent of disclosed CVEs and more than 60 per cent of the cumulative SRI, with one vendor carrying over twice the cumulative SRI of the next. Quantile regression confirms the severity findings at the median. The pattern indicates that digital transformation redistributes risk into a connected, vendor-level property of the infrastructure beneath product–service delivery. Oversight should therefore track the diversity and exploitability of a vendor’s vulnerabilities rather than severity alone, concentrating scrutiny on the small set of vendors that carry most of the systemic exposure.
Imo Enang, Iniobong Enang, I. Akpan· Systems· 0 citations
Modern power systems rely on real-time substation communication protocols, such as the Routable Generic Object-Oriented Substation Event (R-GOOSE), for critical control and protection functions. However, these protocols often lack built-in security features and prioritize availability over confidentiality and integrity, making them susceptible to false data injection and denial-of-service attacks. This vulnerability is exacerbated when communications are transmitted over wide-area or public networks. Addressing these cyber threats is essential to comply with current security mandates, including the DOE's defense-in-depth and zero-trust guidelines. This paper introduces QUIC-TRIP, a transparent security methodology for low-latency IP-based industrial communications. By operating at the Open Systems Interconnection (OSI) Transport Layer (Layer 4), the solution encapsulates and protects data flows without affecting the operation of existing protocol endpoints. Baseline echo Round-Trip Time (RTT) results over a Frankfurt-Amsterdam communication path show that the underlying transport-layer proxy used by QUIC-TRIP achieves a lower average RTT than OpenVPN and only 2.88% higher average RTT than integrated DTLS 1.2, even with DTLS session reuse. We evaluate the resilience of QUIC-TRIP multipath communication under DoS flooding by securing R-GOOSE communications. In these tests, traffic is transparently delivered through three different paths, and QUIC-TRIP forwards the earliest-arriving duplicate while discarding later copies. The framework provides a triple-redundant defense scheme with a measured communication overhead of 32.18% per enabled proxied path, offering a bounded trade-off between resilience and bandwidth cost for time-critical grid operations.
Jorge David de Hoz Diego, Ioannis Zografopoulos, A. Jurcut· 2 citations
Critical National Infrastructures (CNIs) have evolved over the last years through the digitization of their services, which simultaneously led to an increase of their threat surface. Meanwhile, the exponential rise of Artificial Intelligence (AI) technologies has given the means to adversaries to perform targeted attacks against high impact systems as the ones found in CNIs. Current regulation directives as the NIS2 or the Cyber Resilience Act (CRA) focus on the presence of Security Operation Centers (SOCs), which include different security technologies for the detection and response to cyber-attacks. Nevertheless, such baseline SOCs do not provide the ability to perform a coordinated and orchestrated detection and response cycle for existing cyber threats, but also do not provide proactive measures for zero-day threats. To this end, this paper presents a new approach for automating the orchestration of the incident lifecycle through next-generation SOC services able to detect/mitigate sophisticated attacks against CNIs, but also implement proactive detection and mitigation measures against zero-day threats. The approach is presented through a reference model for intelligent SOC components that additionally allow tackling the challenges in traditional SOC environments, such as fatigue for the multiple alerts for the SOC analysts and the time required for investigating triaging and investigating incidents.
A. Lekidis, Yagmur Yigit, Leandros A. Maglaras et al.· Electronics· 0 citations
The increasing digitization and interconnection of substations, driven by networked intelligent electronic devices (IEDs) that function as mission-critical Industrial IoT (IIoT) endpoints, exposes time-critical IEC 61850 communications, particularly Sampled Values (SV) and Generic Object Oriented Substation Events (GOOSE), to cyber threats while also imposing stringent latency constraints on any security enhancement. This paper presents an IEC 61850-aligned hybrid digital twin (HDT) testbed that enables end-to-end cyber–physical evaluation of authenticated SV and GOOSE messaging in a close-to-realistic substation environment. The proposed HDT couples a MATLAB/Simulink power-system model (process layer) with a hardware-based communication layer comprising heterogeneous IED emulation using industrial single-board computers, Node-RED application logic, and managed Ethernet switching to reproduce station, bay, and process level interactions using SV, GOOSE, and MMS. Building on the secure SV concept, the work implements extended protocol data units to realize both Secure Sampled Values (SeSV) and Secure GOOSE (SeGOOSE) using symmetric message authentication mechanisms, specifically HMAC (SHA-256/SHA-512 variants) and AES-GMAC (128/192/256). Performance is evaluated through per-stage processing time (publisher/subscriber MAC generation and verification) and end-to-end round-trip travel time (RTTT) spanning SV publication, IED decision processing, and GOOSE actuation signaling. Results demonstrate that authenticated SV/GOOSE operation remains within IEC 61850 timing expectations under the tested configurations, with measured RTTT of approximately 1.3 ms without authentication and up to 10 ms with authentication depending on algorithm choice and platform. The testbed provides a scalable, hardware-validated methodology for quantifying the practical latency cost of IEC 61850 message authentication and supports systematic cybersecurity experimentation for digital substations and smart-grid cyber–physical systems.
V. Ayyalusamy, B. Sivaneasan, Jianfang Xiao et al.· IEEE Access· 0 citations
