International Journal of Critical Infrastructure Protection最新文献

{"title":"SuPOR: A lightweight stream cipher for confidentiality and attack-resilient visual data security in IoT","authors":"Ifeoluwapo Aribilola ,&nbsp;Saeed Hamood Alsamhi ,&nbsp;John G. Breslin ,&nbsp;Mamoona Naveed Asghar","doi":"10.1016/j.ijcip.2025.100786","DOIUrl":"10.1016/j.ijcip.2025.100786","url":null,"abstract":"<div><div>The rapid growth of Internet of Things (IoT) technologies, particularly visual sensors such as cameras and drones, has resulted in increased transmission of sensitive visual data containing personally identifiable information (PII). Securing this data during storage and transmission (e.g., cloud or edge servers) is essential for maintaining privacy and security. However, existing encryption methods often face challenges due to computational overhead and vulnerability to attacks, especially on resource-limited IoT devices. To bridge this research gap, this paper presents <em>SuPOR</em>, a single-round lightweight cipher tailored for visual data protection in IoT environments. The <em>SuPOR</em> framework incorporates five fundamental cryptographic principles—<strong>Su</strong>bstitution, <strong>P</strong>ermutation, X<strong>OR</strong>, right circular shift, and swap—which are executed in sequential steps. These include: (1) constructing a secure S-box using Möbius linear transformations and Galois fields for pixel-level substitution, (2) permuting the substituted pixels to improve diffusion, (3) applying a cryptographically secure pseudo-random number generator (CSPRNG) to generate a 64-bit one-time key for <strong>XOR</strong>ing, (4) performing right circular shifts on pixel byte arrays, and (5) executing element swaps to further obfuscate the data. Comprehensive security and statistical assessments demonstrate that <em>SuPOR</em> offers strong resistance against various attack vectors while maintaining minimal computational overhead, with a linear time complexity of <span><math><mrow><mi>O</mi><mrow><mo>(</mo><mi>n</mi><mi>m</mi><mo>+</mo><mi>n</mi><mrow><mo>(</mo><mn>3</mn><mo>×</mo><mi>f</mi><mi>r</mi><mi>a</mi><mi>m</mi><mi>e</mi><mi>s</mi><mi>i</mi><mi>z</mi><mi>e</mi><mo>)</mo></mrow><mo>)</mo></mrow></mrow></math></span>. Experimental comparisons indicate that <em>SuPOR</em> surpasses several state-of-the-art stream ciphers designed for IoT visual data, making it highly suitable for real-time, resource-constrained environments. The findings provide a practical and efficient solution to enhance the privacy and security of visual data in IoT systems, effectively safeguarding sensitive information from threats.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"50 ","pages":"Article 100786"},"PeriodicalIF":5.3,"publicationDate":"2025-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144721505","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"From breach to bias: Measuring reputation value and trust recovery after cyber incidents in critical infrastructure","authors":"Bonnie Rushing ,&nbsp;Shouhuai Xu ,&nbsp;Ashley Fairman","doi":"10.1016/j.ijcip.2025.100787","DOIUrl":"10.1016/j.ijcip.2025.100787","url":null,"abstract":"<div><div>Cybersecurity incidents increasingly affect not only operational integrity but also business reputation, especially for companies managing critical infrastructure. This study introduces the Reputation Impact Score (RIS), a novel, repeatable metric that quantifies reputational damage using a combination of financial volatility, investor trust, and sentiment analysis from employees and customers. The RIS model is applied to real-world case studies of high-profile cybersecurity incidents affecting operational technology (OT) companies, including Equifax, SolarWinds, and American Water Works. By integrating open-source financial data and public sentiment ratings, the RIS enables organizations to assess recovery progress and predict potential reputational harm. This work introduces a practical framework to quantify reputational resilience in critical infrastructure firms.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"50 ","pages":"Article 100787"},"PeriodicalIF":5.3,"publicationDate":"2025-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144781015","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Transposing EU-legislation on critical infrastructure protection legal implementation performance in the Baltic Sea region","authors":"Marie Becker","doi":"10.1016/j.ijcip.2025.100781","DOIUrl":"10.1016/j.ijcip.2025.100781","url":null,"abstract":"<div><div>Both, in the Russian war of aggression against Ukraine and in the proliferation of hybrid attacks on EU territory, critical energy infrastructure has become a primary target. One EU- response to the ensuing need for transnational action consists in the CER-Directive of 2022 on the resilience of critical entities. Its effectiveness now hinges on national implementation, currently pervaded by delay despite the undisputable urgency. To begin to shed some light, this study analyses legal implementation of the directive’s predecessor (ECI-Directive of 2008) to assess explanatory approaches from the discipline of implementation studies in the particular field of critical infrastructure protection. Focusing on the hotspot Baltic Sea Region, it shows how country-specific generalized expectations do not hold and how fundamental misfit between pre-existing national frameworks and a directive can instead help predict deviation. For the ECI-Directive, the study shows significant delays and deviation for individual countries, as well as only limited harmonization across the region.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"50 ","pages":"Article 100781"},"PeriodicalIF":4.1,"publicationDate":"2025-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144366828","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"AI-enhanced intrusion detection in smart renewable energy grids: A novel industry 4.0 cyber threat management approach","authors":"Umar Islam ,&nbsp;Hanif Ullah ,&nbsp;Naveed Khan ,&nbsp;Kashif Saleem ,&nbsp;Iftikhar Ahmad","doi":"10.1016/j.ijcip.2025.100769","DOIUrl":"10.1016/j.ijcip.2025.100769","url":null,"abstract":"<div><div>The rapid adoption of Industry 4.0 technologies in renewable energy grids has significantly improved efficiency and scalability. However, this integration has also amplified cybersecurity risks, making conventional Intrusion Detection Systems (IDS) insufficient against evolving cyber threats. This study proposes a novel AI-enhanced Intrusion Detection System (IDS) tailored for smart renewable energy grids, leveraging a multi-stage detection framework that integrates both supervised and unsupervised learning techniques. The proposed IDS combines Random Forest for signature-based detection and Autoencoders for anomaly-based threat identification, enabling real-time detection of both known and zero-day cyber threats. A comprehensive evaluation using real-world cyberattack datasets demonstrates that the system achieves a detection accuracy of 97.8 %, significantly reducing false positives compared to traditional IDS solutions. This work not only enhances the security and resilience of smart grids but also offers a scalable and adaptable cybersecurity framework for Industry 4.0 applications. The findings contribute to the advancement of AI-driven security mechanisms, ensuring the reliability of critical energy infrastructure in the face of sophisticated cyber threats.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"50 ","pages":"Article 100769"},"PeriodicalIF":4.1,"publicationDate":"2025-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144139400","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Hardware security modules for sustainable energy systems: Targeted review","authors":"Yehia Ibrahim Alzoubi","doi":"10.1016/j.ijcip.2025.100791","DOIUrl":"10.1016/j.ijcip.2025.100791","url":null,"abstract":"<div><div>As the global transition toward green energy intensifies, the integration of Hardware Security Modules (HSMs) into sustainable energy systems is emerging as a critical component for ensuring cybersecurity and operational resilience. HSMs are essential for safeguarding sensitive data, enabling secure communication, and maintaining the integrity of operations within smart grids and renewable energy infrastructures, which are increasingly susceptible to cyber threats. Despite the growing relevance of HSMs in this domain, there remains a significant gap in the academic literature concerning their specific adoption and optimization in sustainable energy contexts. This paper addresses this gap by providing a comprehensive analysis of the role and integration of HSMs in sustainable energy systems. It examines how HSMs enhance system security through advanced cryptographic protections, operational robustness, and secure data exchange. The study further explores key optimization strategies, such as energy-efficient circuit design, advanced process technologies, and duty-cycling mechanisms that align HSM functionality with energy sustainability goals. Additionally, the paper identifies and discusses major challenges affecting HSM deployment, such as cost constraints, energy consumption, and interoperability with legacy infrastructure. By synthesizing these findings, the paper unveils the strategic implementation of HSMs in sustainable energy frameworks and lays a foundation for future empirical investigations aimed at validating and extending the discussed approaches.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"50 ","pages":"Article 100791"},"PeriodicalIF":5.3,"publicationDate":"2025-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144841154","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Developing a performance assessment tool for building critical infrastructure resilience through Public-Private Partnership in Ghana","authors":"Godslove Ampratwum,&nbsp;Robert Osei-Kyei,&nbsp;Vivian W.Y. Tam","doi":"10.1016/j.ijcip.2025.100784","DOIUrl":"10.1016/j.ijcip.2025.100784","url":null,"abstract":"<div><div>In recent years, public-private partnership (PPP) has been advocated for as a medium to build critical infrastructure resilience. PPPs provides an added value achieved from greater co-operation among public-private sector entities. Performance measurement is critical to identify the difficulties and challenges that affects the PPP in executing their role in building critical infrastructure resilience. While the PPP concept is not novel, the precise performance measurement of a PPP in critical infrastructure resilience has not been explored yet. Key performance resilience indicators provide an assessment to measure the performance of a PPP set up to build critical infrastructure resilience. Since the area of performance assessment of PPP in critical infrastructure resilience has not been examined yet, this study used quantitative approach to develop a performance index to help quantify the performance of the PPP in critical infrastructure resilience using fuzzy synthetic evaluation method. The performance index developed consists of four major critical performance criteria groupings: these include, Hazard Detection, Continuity plans, Disruptive event detection, Functional Performance. The evaluation model can be used to objectively determine the performance of a PPP in building critical infrastructure resilience.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"50 ","pages":"Article 100784"},"PeriodicalIF":4.1,"publicationDate":"2025-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144571862","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Digital twin application in lifecycle security of critical infrastructures: A systematic literature review","authors":"Taru Itäpelto,&nbsp;Mohammed Elhajj,&nbsp;Marten van Sinderen","doi":"10.1016/j.ijcip.2025.100783","DOIUrl":"10.1016/j.ijcip.2025.100783","url":null,"abstract":"<div><div>Critical infrastructures are essential for the functioning of society. However, their increasing connectivity makes them vulnerable to growing cybersecurity threats. Traditional testing methods, such as testbeds, often struggle to accurately replicate real-world complexities and can be expensive to maintain. Although digital twins are gaining attention as a potential solution, providing high-fidelity virtual replicas with simulation, prediction, and control capabilities, their specific role in enhancing cybersecurity for critical infrastructures throughout their lifecycles has not been thoroughly explored. To address this gap, our study conducts a systematic literature review of 43 peer-reviewed papers published between 2013 and 2024 to investigate how digital twins can tackle cybersecurity challenges throughout critical infrastructures’ lifecycles. Our analysis offers a detailed classification of cybersecurity use cases enabled by digital twins, maps these use cases to the lifecycle phases of critical infrastructures, and evaluates the feasibility and justifications of both proposed and implemented solutions as long-term cybersecurity enhancers. Our findings underscore the potential of digital twins to foster a sustainable, long-term partnership with critical infrastructures, leading to improved cybersecurity. Additionally, we propose four future research directions to guide the development of robust digital twin solutions supporting the evolution of these vital systems, their operating contexts, and threat landscapes. To the best of our knowledge, this is the first study investigating digital twins’ role as a lifelong cybersecurity enhancer for critical infrastructures.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"50 ","pages":"Article 100783"},"PeriodicalIF":5.3,"publicationDate":"2025-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144721504","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Using Kolmogorov–Arnold network for cyber–physical system security: A fast and efficient approach","authors":"Mohammadmahdi Ghorbani ,&nbsp;Alimohammad Ghassemi ,&nbsp;Mohammad Alikhani,&nbsp;Hamid Khaloozadeh,&nbsp;Amirhossein Nikoofard","doi":"10.1016/j.ijcip.2025.100768","DOIUrl":"10.1016/j.ijcip.2025.100768","url":null,"abstract":"<div><div>A cyber–physical system (CPS) is the foundation of modern industrial infrastructures but is vulnerable to cyber attacks due to its connectivity. Detecting these attacks is crucial, driving research into machine learning and deep learning-based models for intrusion detection systems. Many of these models, though effective, suffer from high computational complexity and large parameter counts, limiting their practicality for real-time deployment. Additionally, extensive data preprocessing, commonly used in attack detection, can introduce drawbacks such as loss of critical information, reduced interpretability, and increased latency. This paper employs the Kolmogorov–Arnold network (KAN) as a lightweight and efficient alternative to conventional models for attack detection in CPSs. With a compact architecture and significantly fewer parameters, KAN achieves high classification accuracy while minimizing computational overhead. It eliminates the need for complex feature extraction and preprocessing, preserving data integrity and enabling faster decision-making. Evaluated on the SWaT, WADI, and ICS-Flow datasets, KAN demonstrates superior performance in detecting cyber attacks across binary and multi-class tasks on both physical and network data. Its low inference time and minimal resource requirements make it a practical solution for real-time CPS security.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"50 ","pages":"Article 100768"},"PeriodicalIF":4.1,"publicationDate":"2025-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144240246","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Semi-asynchronous federated learning-based privacy-preserving intrusion detection for advanced metering infrastructure","authors":"Zhuoqun Xia ,&nbsp;Hongmei Zhou ,&nbsp;Zhenzhen Hu ,&nbsp;Qisheng Jiang ,&nbsp;Kaixin Zhou","doi":"10.1016/j.ijcip.2025.100742","DOIUrl":"10.1016/j.ijcip.2025.100742","url":null,"abstract":"<div><div>The emergence of smart grid brings great convenience to users and power companies, but also brings many new problems, among which the most prominent one is network attack security. Although federated learning works well in dealing with smart grid network attacks, it suffers from gradient leakage, client node failure and a single type of training model. Therefore, this paper proposes a semi-asynchronous federated learning-based privacy-preserving intrusion detection for advanced metering infrastructure (AMI). First, we design a hierarchical federated learning framework based on chained secure multiparty computing, which allows concentrators to collaboratively train models to protect local gradients. Second, we adapt the framework to the AMI network structure characteristics, and design a semi-asynchronous model distribution protocol. Finally, we build an ensemble model based on temporal convolutional network and gated recurrent unit (TCN-GRU) to detect AMI network attacks. The experimental results show that the proposed method can achieve 99.23% accuracy than existing methods.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"49 ","pages":"Article 100742"},"PeriodicalIF":4.1,"publicationDate":"2025-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143464781","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"IPSMInfer: Industrial proprietary protocol state machine inference from network traces","authors":"Yahui Yang,&nbsp;Yangyang Geng,&nbsp;Qiang Wei,&nbsp;Rongkuan Ma,&nbsp;Zihan Wei","doi":"10.1016/j.ijcip.2025.100765","DOIUrl":"10.1016/j.ijcip.2025.100765","url":null,"abstract":"<div><div>Industrial protocols are ubiquitous in industrial control systems (ICS), and their security is intimately tied to the entire industrial infrastructure. Analyzing industrial protocol state machines can assist researchers in understanding the protocol’s state transition rules, event-triggering conditions, and behavioral characteristics. However, the proprietary nature of many industrial protocols and the lack of knowledge about their state machines significantly impede the implementation of related protection measures in ICS. While several protocol state machine inference methods have been proposed, few are practically and widely applicable to industrial protocols. This is primarily attributed to the unique structure of industrial protocols, which poses challenges for protocol state machine inference.</div><div>This paper introduces IPSMInfer, a framework that automatically infers industrial proprietary protocol state machines from network traffic. IPSMInfer labels message types based on the length of preprocessed request–response messages, which eliminates the need to identify key protocol fields and restore the original protocol formats. Subsequently, a directed graph is created using the message type labeling results along with their timing relationships to generate a protocol state machine. Finally, the generated protocol state machine is optimized by replaying captured protocol messages and actively interacting with protocol entities to ensure its accuracy and efficiency. We evaluated IPSMInfer using seven programmable logic controllers (PLCs) from five different industrial manufacturers, applying five distinct industrial proprietary protocols. The experimental results clearly demonstrate that IPSMInfer can accurately infer the state machines of these industrial proprietary protocols. It outperforms open-source tools such as ReverX and Netzob by an average of 19.8% and 8.8%, respectively, in terms of protocol state labeling perfection.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"49 ","pages":"Article 100765"},"PeriodicalIF":4.1,"publicationDate":"2025-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143928466","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}