{"title":"Dynamic protection of human-cyber-physical systems based on CPN and multi-agent reinforcement learning: Evidence from smart coal mines","authors":"Yufeng Jiang","doi":"10.1016/j.ijcip.2026.100831","DOIUrl":"10.1016/j.ijcip.2026.100831","url":null,"abstract":"<div><div>Smart coal mines increasingly function as Human-Cyber-Physical Systems (HCPS), in which tightly coupled interactions generate dynamic risks that traditional static safeguards fail to address. This study develops a dynamic protection framework that integrates Colored Petri Nets (CPN) with Multi-Agent Reinforcement Learning (MARL) to model and mitigate cross-layer failures. A three-layer HCPS model is constructed to quantify interdependencies through a cross-layer propagation coefficient, and risk evolution is described using a simplified two-term time-evolution equation separating endogenous growth and external shocks. Gradual degradation and sudden disturbances are modeled via Gamma-Poisson hybrid processes, while CPN enables visualization of cascading faults across layers. MARL is used to optimize defense strategies under a joint-reward mechanism, facilitating coordinated interventions among human, cyber, and physical agents. Simulation results indicate that the cyber layer is particularly sensitive to external shocks, highlighting the necessity of enhanced real-time monitoring and cyber-attack resilience. MARL-enhanced strategies effectively slow risk accumulation and reduce cascading propagation. The contributions are refined into concise, parallel statements to improve clarity. The proposed framework provides a reproducible and adaptive approach for dynamic safety management in intelligent mining environments.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"52 ","pages":"Article 100831"},"PeriodicalIF":5.3,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145977822","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Critical thinking: exploring the expansion of critical infrastructure","authors":"Russell Lundberg","doi":"10.1016/j.ijcip.2025.100814","DOIUrl":"10.1016/j.ijcip.2025.100814","url":null,"abstract":"<div><div>The concept of critical infrastructure (CI) has evolved significantly across developed nations since the early 2000s, with the United States providing a particularly illustrative example of this global trend. Initially focused on assets whose incapacitation would cause debilitating national impacts, the U.S. framework expanded after September 11th, 2001 to encompass a broader array of sectors and assets, diluting the meaning of criticality. Even among the most vital lifeline sectors— energy, communications, water, and transportation—analysis reveals that the resilience of these systems often precludes national-level consequences from isolated failures. To address these issues, CI policy should transition from viewing assets as inherently critical to evaluating their criticality in relation to systemic risks posed by specific threats. This shift would enable more effective prioritization, focusing resources on protecting assets most vulnerable to realistic, high-impact scenarios while reducing the inefficiencies of over-inclusiveness. By re-centering the concept of criticality, CI policy can better align with its original intent of safeguarding national security and resilience.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"52 ","pages":"Article 100814"},"PeriodicalIF":5.3,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145791448","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Mubashir Murshed , Nujitha Wickramasurendra , Afrin Jubaida , Robson E. De Grande , Glaucio H.S. Carvalho
{"title":"Novel RF-jamming IDS for vehicular networks: LSTM, XGBoost, and meta-models approaches","authors":"Mubashir Murshed , Nujitha Wickramasurendra , Afrin Jubaida , Robson E. De Grande , Glaucio H.S. Carvalho","doi":"10.1016/j.ijcip.2026.100830","DOIUrl":"10.1016/j.ijcip.2026.100830","url":null,"abstract":"<div><div>The rapid advancement of Intelligent Transportation Systems (ITS) has facilitated diverse safety and comfort services via vehicular networks. However, despite these technological improvements, vehicular networks remain exposed to Radio Frequency (RF) jamming attacks, which continue to challenge the effectiveness of Intrusion Detection Systems (IDS). This paper addresses this topic by proposing novel IDS architectures based on Long Short-Term Memory (LSTM) and eXtreme Gradient Boosting (XGBoost), as well as meta-models that integrate these methods to enhance detection and classification. Through a comprehensive analysis of several models, this research demonstrates that the best LSTM model, LSTM_RELU_IO-L1, achieves an accuracy of <strong>95.67%</strong> and <strong>85.17%</strong> for vehicles traveling at <span><math><mrow><mn>25</mn><mspace></mspace><mtext>m/s</mtext></mrow></math></span> and <span><math><mrow><mn>15</mn><mspace></mspace><mtext>m/s</mtext></mrow></math></span>, respectively. These results confirm its superior performance compared to baseline and recent models: K-Nearest Neighbors (94.46%/82.27%), Random Forest (94.61%/80.04%), and a previous LSTM work (95.17%/84.83%). Furthermore, the proposed RFV-LG meta-model, which combines LSTM and XGBoost, shows substantial improvements. Particularly, the RFV-LG-H6 model reaches 96.46% accuracy for low-speed vehicles, which is the most critical scenario for IDS, and nearly 100% accuracy for high-speed vehicles. These proposals advance the state-of-the-art RF jamming IDS for vehicular networks while establishing the RF jamming IDS meta-models as cutting-edge solutions with strong potential for real-world deployment.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"52 ","pages":"Article 100830"},"PeriodicalIF":5.3,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145926419","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Securing smart city Internet of Vehicles via transformer integrated consensus ensemble learning and bio-inspired metaheuristics","authors":"Hamad Naeem , Farhan Ullah , Faheem Mazhar , Muhammad Aasim Rafique","doi":"10.1016/j.ijcip.2026.100829","DOIUrl":"10.1016/j.ijcip.2026.100829","url":null,"abstract":"<div><div>The Internet of Vehicles (IoV), an extension of the Internet of Things (IoT) concept, facilitates online communication and connectivity among smart vehicles. The advanced features of smart vehicles have drawn customer interest in electric vehicle technology. The rapid development of the Internet of Vehicles (IoV) raises important privacy and security issues that could lead to dangerous events. Many researchers have developed deep learning based systems for IoT network intrusion detection. These models aim to reduce smart vehicle accidents and identify compromising network attacks. In this paper, a consensus-driven ensemble of classifiers, Ant Colony Optimization (ACO) for feature selection, and vision transformer-based feature extraction are all included in the proposed system. Initially, the CLIP vision transformer model is used to extract semantic features from vehicle network data. After that, ACO selects the best feature subset to increase accuracy and decrease complexity. Predictions are integrated using a consensus ensemble of Support Vector Machine (SVM), K Nearest Neighbor (KNN), and Logistic Regression (LR), which selectively applies stacking to improve multiclass intrusion detection. The evaluations were conducted using two data sets: the CICEVSE dataset, which contains 22,086 samples from eight different intrusion categories, and the publicly available Car Hacking dataset, which contains 29,228 samples from five different intrusion categories. The experimental results demonstrate that the proposed approach achieved a maximum score of 100% on the Car Hacking dataset and 99.29% on the CICEVSE dataset, reflecting optimum accuracy.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"52 ","pages":"Article 100829"},"PeriodicalIF":5.3,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145926418","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"An integrated intuitionistic fuzzy framework for emergency response center location planning in industrial areas","authors":"Ertugrul Ayyildiz , Melike Erdogan , Muhammet Gul","doi":"10.1016/j.ijcip.2025.100813","DOIUrl":"10.1016/j.ijcip.2025.100813","url":null,"abstract":"<div><div>Emergency response centers are critical facilities for managing emergencies caused by both natural and man-made disasters, particularly in industrial zones where risks such as fires, toxic substance exposure, and explosions are prevalent. The selection of an appropriate location for emergency response centers is vital to ensuring rapid and effective emergency responses while addressing the inherent uncertainties and complexities of multi-criteria decision-making (MCDM) processes. This study presents a comprehensive location selection analysis for emergency response centers in industrial zones, leveraging intuitionistic fuzzy sets to incorporate uncertainty and expert hesitation in the decision-making process. Using Intuitionistic Fuzzy SWARA (Step-by-Step Weight Assessment Ratio Analysis) to determine criteria weights and Intuitionistic Fuzzy EDAS (Evaluation Based on Distance from Average Solution) to evaluate alternative locations, the study identifies the optimal site for establishing emergency response centers under conflicting criteria. The proposed approach effectively integrates linguistic expert judgments and quantitative assessments, offering a robust framework for addressing the challenges of emergency response center selection. The results provide actionable insights for emergency management and urban planning while contributing to the growing body of research on fuzzy MCDM techniques for critical facility location problems. This methodology ensures a realistic and practical solution to the emergency response center location selection problem.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"52 ","pages":"Article 100813"},"PeriodicalIF":5.3,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145791432","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
János Csatár , Tamás Holczer , Roland Nádor , Máté Rózsa
{"title":"A structured approach to cyber–physical attacks on digital substations","authors":"János Csatár , Tamás Holczer , Roland Nádor , Máté Rózsa","doi":"10.1016/j.ijcip.2025.100827","DOIUrl":"10.1016/j.ijcip.2025.100827","url":null,"abstract":"<div><div>The electric power grid constitutes a foundational component of critical infrastructure; a sustained disruption in electrical supply could cause severe societal consequences. Among the various threats to grid reliability, cybersecurity has become increasingly prominent due to the ongoing digitalization of grid operations. As substations incorporate more digital and networked systems, forming digital substations, the potential impact of cyberattacks on grid stability grows significantly. This paper investigates the cybersecurity threat landscape from the perspective of a potential adversary. We present a novel structured methodology for identifying and formulating effective cyberattacks on digital substations, with the objective of advancing defensive capabilities through a deeper understanding of offensive techniques. Key elements of the methodology include a holistic cyber–physical approach that leverages multi-domain knowledge and utilizes iterative, simulation-based steps. To evaluate the proposed methodology, we designed and implemented three representative cyberattacks using it against a notional substation architecture (leveraging IEC 61850 sampled value (SV), and generic object oriented substation event (GOOSE); and IEEE 1588 precision time protocol (PTP)). We also proposed and developed a dedicated, real-time co-simulation testbed with hardware-in-the-loop capability, specifically designed to emulate realistic substation environments, including detailed protection functions, and subsequently tested these attacks on it. The results demonstrated specific weaknesses in digital substations; for example, a sophisticated cyberattack against PTP might result in a phase-shifted measurement as seen by the protection algorithm.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"52 ","pages":"Article 100827"},"PeriodicalIF":5.3,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145791447","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Wenjing Tong , Hong Xian Li , Farnad Nasirzadeh , Fuyi Yao , Yingbo Ji
{"title":"Resilience of interdependent infrastructure networks: Review and future directions","authors":"Wenjing Tong , Hong Xian Li , Farnad Nasirzadeh , Fuyi Yao , Yingbo Ji","doi":"10.1016/j.ijcip.2025.100793","DOIUrl":"10.1016/j.ijcip.2025.100793","url":null,"abstract":"<div><div>Interdependent infrastructure systems are instrumental for facility operations. Existing research has emphasised the resilience of infrastructure networks from theoretical to methodological perspectives. This paper aims to identify the current trends and future directions using a mixed method combining bibliometric analysis and systematic review. 101 highly relevant articles are selected for analysis, and scientific literature maps are constructed to analyse co-authorship, co-citation, and keywords. In addition, systematic review is conducted to identify the main research themes, including characteristics analysis of interdependent infrastructure resilience, resilience assessment, and improvement strategies. The potential avenues for future research are also identified, including developing data-driven, interpretable resilience models using advanced algorithms; analysing performance evolution mechanisms integrating temporal and geographic perspectives, assessing resilience emphasising dynamic equilibrium states; improving the holistic resilience considering the trade-off of different targets. This research contributes to the body of knowledge of interdependent infrastructure resilience and exposes the research needs in this area.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"51 ","pages":"Article 100793"},"PeriodicalIF":5.3,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144892319","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Developing security metrics for space systems: A study considering the NIST Cybersecurity Framework 2.0 and the NIS2","authors":"Francesco Casaril, Letterio Galletta","doi":"10.1016/j.ijcip.2025.100805","DOIUrl":"10.1016/j.ijcip.2025.100805","url":null,"abstract":"<div><div>Space-based assets are essential for critical societal functions across sectors like energy, transportation, communication, agriculture, and government. As these services become more integrated into daily life and reliance on cyber–physical systems grows, the interconnectivity and commercialization of space assets increases the attack surface and cybersecurity risks. Recent incidents affecting space infrastructure underscore the urgent need for robust cybersecurity measures. Legislators in the EU and other countries are addressing cyber risks to space and ground assets by developing minimum protection requirements. To support these measures, this paper evaluates whether existing security metrics in the literature cover all NIST functions, categories, and subcategories in the Cybersecurity Framework 2.0 (CSF 2.0). This framework provides a strong foundation for industry sectors and can serve as a baseline to ensure compliance with directives like NIS2. Our analysis reveals imbalances in academic discourse, with certain CSF 2.0 functions underrepresented. Then, we propose new metrics to address unaddressed NIST categories and adapt existing metrics to better suit the space domain. Considering practical challenges in implementing and monitoring these metrics, we propose a tool to facilitate their calculation and visualize security status. We also present a case study resembling real-world space infrastructure that demonstrates our tool’s applicability and the value of the designed metrics. Our research has managerial implications, supporting managers, CIOs, and CISOs in making informed decisions, helping companies understand their security levels, and complying with existing and forthcoming space sector regulations. We advocate for using security metrics to assess compliance with regulations like NIS2, CER, or upcoming space laws, demonstrating to policymakers that metrics can be integrated into policies to enhance their effectiveness.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"51 ","pages":"Article 100805"},"PeriodicalIF":5.3,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145266573","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}