Cyber DefenSe 

Situational awareness also extends to OPTIMA-DOMES by applying new technologies for detection and retraining, but also to SEGRES and SADCIP where the objective is to detect and trace APT-type threats in time. It should be noted that in SEGRES, NICS Lab has developed a response mechanism capable of intensifying the defense according to the level of aggressiveness of the attacker, and effectively maintaining the resilience of the system against them. The solutions proposed in SEGRES and SADCIP are based not only on Machine-Learning models but also on consensus-based models to delimit the level of threat in terms of geography, time and criticality ^[3]. In this regard, NICS Lab has demonstrated that Opinion Dynamics is the most suitable consensus technique for live attack traceability, proving it through practical experiments and comparative analysis. Among the analyses, we highlight those comparatives based on clustering ^[4], weighted-average and mode ^[3]. The latter work was explicitly modeled for charging stations controlled by a collaborative detection system ^[3], but we have also showed its applicability for general-purpose cyber-physical systems ^[5], IIoT-based systems ^[3] and their respective communications ^[6].

As indicated above, traceability approaches are primarily based on anomaly detection strategies. This condition means that NICS Lab has been able to develop the capability, and points out that detection is a process that itself requires a special dedication to adapt the approach to each application context, its devices and its data ^[3]. Any selection may involve the need to look at the degree of retraining and accuracy, the types of threats and their classification ^[7], but also the technologies involved for cyber defense, which can help to enhance the experience and results obtained, such as multi-agent systems ^[8] and digital twins ^[9]. Agents can enable intelligent distribution of defense mechanisms, while simulation could complement the detection process by monitoring the functional operations of the observed systems ^[9]. Both technologies have been integrated as part of the goals of Smart and Secure EV Urban Lab II and  SADECEI-4.0, respectively; but there is other related work in which NICS Lab has also been especially involved. In SADCIP, the research team has explored the state of the art on traditional intrusion detection systems to discern the possible needs from an academic and industrial perspective ^[9], as well as expected detection trends in industrial control systems in view of new industrial paradigms ^[3]; a set of detection requirements and metrics were identified to enhance defense ^[10].

To close the cyber defense lifecycle, it is also essential to provide resilience, both from a preventive and corrective perspective ^[11]. This also means that resilience helps to add robustness against attacks and ensures survivability and dependability against possible exploits ^[12]. Several resilience techniques have been identified, such as activation of adaptive techniques, deception, segmentation and redundant systems ^[13]. However, finding an approach capable of combining selective solutions that guarantee absolute stability at optimal times is not a trivial task. Through CAIN, NICS Lab has proposed several approaches, both preventives based on the prediction of anomalous states ^[14] and correctives based on reconfiguration ^[15] and recovery of control states ^[16]. The latter mainly focuses on link reconnection, either between nearby or strategic controllers ^[14] or considering additional cloud/edge-based infrastructures ^[17] and checkpoints ^[18]. The effectiveness of reconnection can also be combined with access control strategies to prevent major overloads while the system ensures immediate reconnection of control ^[19].