{"title":"Developing security metrics for space systems: A study considering the NIST Cybersecurity Framework 2.0 and the NIS2","authors":"Francesco Casaril, Letterio Galletta","doi":"10.1016/j.ijcip.2025.100805","DOIUrl":"10.1016/j.ijcip.2025.100805","url":null,"abstract":"<div><div>Space-based assets are essential for critical societal functions across sectors like energy, transportation, communication, agriculture, and government. As these services become more integrated into daily life and reliance on cyber–physical systems grows, the interconnectivity and commercialization of space assets increases the attack surface and cybersecurity risks. Recent incidents affecting space infrastructure underscore the urgent need for robust cybersecurity measures. Legislators in the EU and other countries are addressing cyber risks to space and ground assets by developing minimum protection requirements. To support these measures, this paper evaluates whether existing security metrics in the literature cover all NIST functions, categories, and subcategories in the Cybersecurity Framework 2.0 (CSF 2.0). This framework provides a strong foundation for industry sectors and can serve as a baseline to ensure compliance with directives like NIS2. Our analysis reveals imbalances in academic discourse, with certain CSF 2.0 functions underrepresented. Then, we propose new metrics to address unaddressed NIST categories and adapt existing metrics to better suit the space domain. Considering practical challenges in implementing and monitoring these metrics, we propose a tool to facilitate their calculation and visualize security status. We also present a case study resembling real-world space infrastructure that demonstrates our tool’s applicability and the value of the designed metrics. Our research has managerial implications, supporting managers, CIOs, and CISOs in making informed decisions, helping companies understand their security levels, and complying with existing and forthcoming space sector regulations. We advocate for using security metrics to assess compliance with regulations like NIS2, CER, or upcoming space laws, demonstrating to policymakers that metrics can be integrated into policies to enhance their effectiveness.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"51 ","pages":"Article 100805"},"PeriodicalIF":5.3,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145266573","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Operational technologies is the blend spot of the critical Infrastrutcturte","authors":"Roberto Setola","doi":"10.1016/S1874-5482(25)00082-4","DOIUrl":"10.1016/S1874-5482(25)00082-4","url":null,"abstract":"","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"51 ","pages":"Article 100821"},"PeriodicalIF":5.3,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145736575","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Li Guo , Jianing Hu , Mengjuan Luo , Shihao Ren , Xiaobin Dong , Pengcheng Li
{"title":"How interdependent coupling affects the resilience of urban critical infrastructure(UCI)","authors":"Li Guo , Jianing Hu , Mengjuan Luo , Shihao Ren , Xiaobin Dong , Pengcheng Li","doi":"10.1016/j.ijcip.2025.100790","DOIUrl":"10.1016/j.ijcip.2025.100790","url":null,"abstract":"<div><div>Urban critical infrastructure systems do not exist in isolation. They are interdependent and interact with each other, constructing a multilayer network model can effectively and accurately simulate the relationship between these systems, to better understand and analyze their interactions and impact on the overall resilience of the system. This study constructs eight different coupling-type multilayer cascading failure models to explore the robustness patterns of interdependent coupling networks under two different coupling patterns (chain and triangle) and different coupling ratios. The research results indicate that (1) both chain and triangle coupling networks exhibit optimal adjustable capacity parameter values, but the optimal adjustable capacity values for these two coupling patterns are not the same; (2) the robustness of the triangle coupling network is superior to that of the chain coupling network, although, under degree-matching coupling types, the robustness of the two coupling patterns is similar; (3) under the same coupling pattern, different coupling types of multilayer networks exhibit differences in robustness, and the optimal inter-layer coupling types vary within different coupling ratio ranges; (4) under different coupling patterns, for the same coupling ratio range, the optimal inter-layer coupling types also differ. These findings provide a foundation for more precise modeling, thereby enabling the development of more effective strategies to enhance the resilience and reliability of interdependent urban critical infrastructure systems under varying coupling conditions.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"51 ","pages":"Article 100790"},"PeriodicalIF":5.3,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144912267","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Hayelom Gebrye , Yong Wang , Fagen Li , Birhanu Kahsay
{"title":"Feature extraction and selection for flooding-based multi-class DDoS attacks detection in IoT network","authors":"Hayelom Gebrye , Yong Wang , Fagen Li , Birhanu Kahsay","doi":"10.1016/j.ijcip.2025.100815","DOIUrl":"10.1016/j.ijcip.2025.100815","url":null,"abstract":"<div><div>In the realm of IoT network security, feature selection and machine learning driven DDoS detection acquired appeal due to their capacity for tracking traffic and recognize threats. Nevertheless, recent studies have demonstrated that these attacks can be identified using outdated datasets, which could not appropriately reflect modern network threats and degrade the accuracy of detection. Few ML applications employed over 40 features in the past; today, there are tens or even hundreds of features available. This makes processing the information complex and requires more resources and time. In order to facilitate the multi-class detection of DDoS flooding attacks, we made available the PCAP extractor, which allows for the extraction and processing of raw network data into a ML suitable format. Next, we generated flooding-based DDoS attack dataset specifically intended for classification into multiple classes, and we assessed the efficacy of adaptable ML models. We conducted three systematic experimental analysis. The flooding-based DDoS multi-class dataset that was produced for the study was used in the preliminary experiment. To evaluate the effectiveness of our efforts, we conducted the second and third experiments using the IoTID20 and CIC-IoT23, which are the most modern, up-to-date and incorporates variety DDoS attack datasets. Finally, Boruta outperforms RFE in terms of choosing important features and time to complete the task in all datasets. We showed that across all experiment groups, the random forest model exhibited an accuracy of greater than 90%.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"51 ","pages":"Article 100815"},"PeriodicalIF":5.3,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145693246","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Dynamic optimization of multi-layered defenses inspired by Chakravyuh","authors":"Kishore Dutta","doi":"10.1016/j.ijcip.2025.100794","DOIUrl":"10.1016/j.ijcip.2025.100794","url":null,"abstract":"<div><div>As adversaries grow more sophisticated, critical infrastructure demands defense systems that not only react but also learn and adapt dynamically. This work introduces a novel reinforcement learning framework inspired by the ancient Indian <em>Chakravyuh</em> formation, integrating Q-learning, Markov decision processes, and network optimization to model multi-layered security under uncertainty. The system enables attackers to attempt sequential node breaches while defenders deploy adaptive traps and allocate resources through quantifiable metrics including ROI-driven investment and critical node vulnerability analysis. Results demonstrate both vulnerabilities and strengths: universal Layer 0 breaches occur (Mean Time to Breach = 52 episodes) due to uneven resource allocation quantified by a high Gini coefficient of 0.712. Despite this vulnerability, deeper layers remain highly resilient — with over 90% of attacks halted by Layer 1 and fewer than 5% of episodes resulting in breaches beyond Layer 2. Trap deployment achieves high efficiency, with approximately 82% of traps being triggered, especially during early episodes. However, efficiency declines over time as attackers adapt and avoid traps. Resource allocation patterns scale linearly, ensuring sustainable defense operations. These findings validate how the fusion of <em>Chakravyuh</em> strategy with modern reinforcement learning creates an adaptive defense system, simultaneously exposing perimeter vulnerabilities for targeted reinforcement and demonstrating effective deeper-layer security through optimized stochastic policies.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"51 ","pages":"Article 100794"},"PeriodicalIF":5.3,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144919755","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Vulnerability assessment of interdependent road-power networks with probability-based coupling strategies","authors":"Qiaojun Guo , Xin Gao , Damin Dong , Guangtai Zhang","doi":"10.1016/j.ijcip.2025.100792","DOIUrl":"10.1016/j.ijcip.2025.100792","url":null,"abstract":"<div><div>The road network and power grid are vital components of urban infrastructures, but their interdependence significantly amplifies vulnerability. Thus, this paper studies the vulnerability of the interdependent road-power network constructed by a probability-based coupling strategies. First, the road network and the power grid are abstracted as two single networks, respectively, where user equilibrium and the Kirchhoff’s law are used to construct the cascading failure model. Then, to establish an effective interdependent relationship between them, we propose ranking proportion reflecting the ranking of a node in the single network and construct the interdependent link between networks through the probability determined by the difference of ranking proportion, thereby developing a probability-based framework for generating coupling strategies. This can produce coupling strategies with a specific assortativity coefficient based on various kinds of metrics. Finally, we use the real-world Shanghai road network and the IEEE 118-node power grid to conduct a case study on the vulnerability of the interdependent network with sixteen assortative and disassortative coupling strategies obtained by the proposed framework with four topological and functional metrics. Experimental results show that under intentional attacks, the interdependent network with disassortative coupling strategies regarding fluctuations of power loads exhibits slight vulnerability; under random failures, disassortative coupling strategies regarding the power load mitigate its vulnerability. In addition, there is little difference in the vulnerability of the interdependent network with assortative coupling strategies regardless of attack strategies. Besides, its vulnerability is more significant while adopting coupling strategies regarding classic topological metrics.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"51 ","pages":"Article 100792"},"PeriodicalIF":5.3,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144887265","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Marta Contreras , Alondra Chamorro , Trinidad Gómez , Tomás Echaveguren , María Molinos-Senante
{"title":"Bridging technical and social dimensions in critical infrastructure accessibility assessment: A case study from Chile","authors":"Marta Contreras , Alondra Chamorro , Trinidad Gómez , Tomás Echaveguren , María Molinos-Senante","doi":"10.1016/j.ijcip.2025.100811","DOIUrl":"10.1016/j.ijcip.2025.100811","url":null,"abstract":"<div><div>Assessing accessibility to critical infrastructure (CI), e.g., drinking water supply and transportation network, during extreme natural events is fundamental for improving the resilience of urban and rural systems. This study introduces a novel methodology to evaluate the criticality of road network links for accessing CI, integrating both technical assessments and societal preferences. A Critical Accessibility Index (CAI) was developed and applied to a case study in the Metropolitan Region of Chile, using a goal programming framework to quantify the relative importance of seven CI types as perceived by 750 survey respondents. Drinking water supply was assigned the highest weight (59.7 %), followed by healthcare (15.9 %) and electricity (8.5 %), reflecting priorities during an earthquake scenario. The CAI was estimated under two scenarios: one assuming equal CI importance and another incorporating community preferences. Results showed that in scenario (a), 69.3 % of links had very low criticality, while in scenario (b), this decreased to 47.5 %, with a notable increase in medium and high criticality links. Spatial analysis underscored the heightened criticality of drinking water access, especially in rural areas with low redundancy. Policy implications emphasize the need for dual-focused investment planning that balances technical criticality with social priorities. This approach supports inclusive and robust disaster risk management, offering a replicable framework for diverse regional applications.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"51 ","pages":"Article 100811"},"PeriodicalIF":5.3,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145528333","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Securing the future: Integrating quantum computing and digital twin technologies into modern power & transportation systems for resilient smart cities against false data injection cyberattacks","authors":"Ehsan Naderi","doi":"10.1016/j.ijcip.2025.100807","DOIUrl":"10.1016/j.ijcip.2025.100807","url":null,"abstract":"<div><div>The rapid evolution of smart cities relies on the integration of advanced technologies to enhance urban infrastructure, ensure system resilience, and address growing cybersecurity challenges. Toward that end, this paper scrutinizes the convergence of quantum computing (QC) and digital twin (DT) technologies as a novel solution to mitigate false data injection (FDI) cyberattacks, an escalating threat to the integrity of data-driven power and transportation systems. By combining the computational advantages of quantum algorithms with the real-time monitoring and simulation capabilities of DTs, this paper proposes an integrated framework along with a novel optimization algorithm for early detection, prevention, and mitigation of FDI attacks. The effectiveness of the proposed approach is demonstrated through a modified IEEE 39-bus power system coupled with an urban transportation network, highlighting improved system security, operational efficiency, and sustainability. This work contributes a forward-looking pathway for securing interconnected smart city infrastructures against evolving cyber threats.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"51 ","pages":"Article 100807"},"PeriodicalIF":5.3,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145319495","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Verena Zimmermann , Linda Fanconi , Hannah Sievers , Yanis Isenring , Lisa Zankel , Marita Unden
{"title":"From antagonisms to synergies: A systematic review of safety-security interrelations","authors":"Verena Zimmermann , Linda Fanconi , Hannah Sievers , Yanis Isenring , Lisa Zankel , Marita Unden","doi":"10.1016/j.ijcip.2025.100808","DOIUrl":"10.1016/j.ijcip.2025.100808","url":null,"abstract":"<div><div>As today’s critical infrastructures become increasingly digitalized and interconnected, the previously separated concepts of safety and security become increasingly intertwined. Researchers across domains thus call for joint consideration, e.g., in risk models and related standards. While this research field is emerging, the interrelations between safety and security are not yet well understood. However, a better understanding is highly relevant for anticipating, preventing, and handling incidents resulting from them. To shine light on these interrelations and their implications, we conducted a systematic literature review with a final data set of 213 publications. We not only systematized and quantified uncovered types of safety-security interrelations but also explored how different interrelations and related models impact on what is analyzed. From the systematization, we outline current trends and research gaps. Among others, we find a growing interest in safety-security interrelations as attested by sharp rise of publications and a growing diversification of models for co-analysis and co-engineering in the last years. The influence of security on safety is studied much more frequently as compared to an influence of safety aspects on security. Furthermore, we reveal an emphasis on studying the ”negative” types of interrelations, i.e., impairment and antagonism whereas potential synergies are scarcely analyzed. The findings can inform the more holistic development of truly combined as compared to previous sequential models for co-analysis and the design of processes and standards to support safety- and security-related stakeholders to anticipate and jointly cope with safety-security interrelations.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"51 ","pages":"Article 100808"},"PeriodicalIF":5.3,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145465191","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Mihael Marović , Ante Đerek , Stjepan Groš , Ivan Kovačević
{"title":"Threat model for IEC 61850 based substation automation system","authors":"Mihael Marović , Ante Đerek , Stjepan Groš , Ivan Kovačević","doi":"10.1016/j.ijcip.2025.100789","DOIUrl":"10.1016/j.ijcip.2025.100789","url":null,"abstract":"<div><div>Threat models have major importance in the area of computer systems security, as they can help identify oversights in the security requirements of a system and influence the design of protection mechanisms. The objective of this paper is to improve the understanding of threats specific to the substation automation system based on the IEC 61850 standard. This would make the discussion and understanding of the protection mechanisms for IEC 61850 more fruitful. So, in this paper, we have developed a detailed threat model for a substation automation system based on the IEC 61850 standard. The developed threat model is based on attack trees and provides a visual and comprehensive overview of potential attack scenarios. The construction of the attack tree follows a top-down approach, starting with the attacker’s goal and encompassing all potential sequences of steps to achieve this goal. When considering possible ways to achieve a goal, we utilise the MITRE ATT&CK framework and take the specifics of the IEC 61850 substation automation system model into account. We used the threat model to discuss the effect of applying communication protection mechanisms to protect IEC 61850 substation automation system (SAS). While a few other threat models exist for IEC 61850 substation automation system, the model we presented here is significantly more comprehensive, it is adaptable and based on a novel threat modelling method that incorporates the MITRE attack pattern in the process of constructing an attack tree. One of the key findings of this article is the identification of the four fundamentally different ways to sabotage an IEC 61850 SAS. Other findings are related to the adaptivity of the attack tree, limitations of the attack tree, and mapping of known attacks on IEC 61850 SAS onto the attack tree.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"51 ","pages":"Article 100789"},"PeriodicalIF":5.3,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144922855","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}