@article {Flamini2022, title = {Towards Trustworthy Autonomous Systems: Taxonomies and Future Perspectives}, journal = {IEEE Transactions on Emerging Topics in Computing}, year = {2022}, publisher = {IEEE}, abstract = {

The class of Trustworthy Autonomous Systems (TAS) includes cyber-physical systems leveraging on self-x technologies that make them capable to learn, adapt to changes, and reason under uncertainties in possibly critical applications and evolving environments. In the last decade, there has been a growing interest in enabling artificial intelligence technologies, such as advanced machine learning, new threats, such as adversarial attacks, and certification challenges, due to the lack of sufficient explainability. However, in order to be trustworthy, those systems also need to be dependable, secure, and resilient according to well-established taxonomies, methodologies, and tools. Therefore, several aspects need to be addressed for TAS, ranging from proper taxonomic classification to the identification of research opportunities and challenges. Given such a context, in this paper address relevant taxonomies and research perspectives in the field of TAS. We start from basic definitions and move towards future perspectives, regulations, and emerging technologies supporting development and operation of TAS.

}, keywords = {Arti cial Intelligence, Cyber- Resilience, Cybersecurity, Dependability, Intelligent Systems, Trustworthy Autonomous Systems}, issn = {2168-6750}, doi = {https://doi.org/10.1109/TETC.2022.3227113}, url = {https://ieeexplore.ieee.org/abstract/document/9979717/authors$\#$authors}, author = {Francesco Flammini and Cristina Alcaraz and Emanuele Bellini and Stefano Marrone and Javier Lopez and Andrea Bondavalli} } @article {RubioSIJCS19, title = {Tracking APTs in Industrial Ecosystems: A Proof of Concept}, journal = {Journal of Computer Security}, volume = {27}, year = {2019}, month = {09/2019}, pages = {521-546}, publisher = {Elsevier}, type = {ESORICS 2018 Special Issue }, issn = {0167-4048}, author = {Juan E. Rubio and Rodrigo Roman and Cristina Alcaraz and Yan Zhang} } @inproceedings {RubioRomanAlcarazZhang2018, title = {Tracking Advanced Persistent Threats in Critical Infrastructures through Opinion Dynamics}, booktitle = {European Symposium on Research in Computer Security (ESORICS 2018)}, volume = {11098}, year = {2018}, month = {08/2018}, pages = {555-574}, publisher = {Springer}, organization = {Springer}, address = {Barcelona, Spain}, abstract = {

Advanced persistent threats pose a serious issue for modern industrial environments, due to their targeted and complex attack vectors that are difficult to detect. This is especially severe in critical infrastructures that are accelerating the integration of IT technologies. It is then essential to further develop effective monitoring and response systems that ensure the continuity of business to face the arising set of cyber-security threats. In this paper, we study the practical applicability of a novel technique based on opinion dynamics, that permits to trace the attack throughout all its stages along the network by correlating different anomalies measured over time, thereby taking the persistence of threats and the criticality of resources into consideration. The resulting information is of essential importance to monitor the overall health of the control system and correspondingly deploy accurate response procedures.

}, keywords = {Advanced Persistent Threat, Detection, Opinion Dynamics, Traceability}, doi = {10.1007/978-3-319-99073-6_27}, url = {https://link.springer.com/chapter/10.1007/978-3-319-99073-6_27}, author = {Juan E. Rubio and Rodrigo Roman and Cristina Alcaraz and Yan Zhang} } @article {lorena2015c, title = {A Three-Stage Analysis of IDS for Critical Infrastructures}, journal = {Computers \& Security}, volume = {55}, number = {November}, year = {2015}, pages = {235-250}, publisher = {Elsevier}, abstract = {

The correct operation of Critical Infrastructures (CIs) is vital for the well being of society, however these complex systems are subject to multiple faults and threats every day. International organizations around the world are alerting the scientific community to the need for protection of CIs, especially through preparedness and prevention mechanisms. One of the main tools available in this area is the use of Intrusion Detection Systems (IDSs). However, in order to deploy this type of component within a CI, especially within its Control System (CS), it is necessary to verify whether the characteristics of a given IDS solution are compatible with the special requirements and constraints of a critical environment. In this paper, we carry out an extensive study to determine the requirements imposed by the CS on the IDS solutions using the Non-Functional Requirements (NFR) Framework. The outcome of this process are the abstract properties that the IDS needs to satisfy in order to be deployed within a CS, which are refined through the identification of satisficing techniques for the NFRs. To provide quantifiable measurable evidence on the suitability of the IDS component for a CI, we broaden our study using the Goal Question Metric (GQM) approach to select a representative set of metrics. A requirements model, refined with satisficing techniques and sets of metrics which help assess, in the most quantifiable way possible, the suitability and performance of a given IDS solution for a critical scenario, constitutes the results of our analysis.

}, issn = {0167-4048}, author = {Lorena Cazorla and Cristina Alcaraz and Javier Lopez} } @inproceedings {1805, title = {Towards Automatic Critical Infrastructure Protection through Machine Learning}, booktitle = {8th International Conference on Critical Information Infrastructures Security}, volume = {8328}, year = {2013}, pages = {197-203}, publisher = {Springer}, organization = {Springer}, address = {Amsterdam, The Netherlands}, abstract = {

Critical Infrastructure Protection (CIP) faces increasing challenges in number and in sophistication, which makes vital to provide new forms of protection to face every day{\textquoteright}s threats. In order to make such protection holistic, covering all the needs of the systems from the point of view of security, prevention aspects and situational awareness should be considered. Researchers and Institutions stress the need of providing intelligent and automatic solutions for\ protection, calling our attention to the need of providing Intrusion Detection Systems (IDS) with intelligent active reaction capabilities. In this paper, we support the need of automating the processes implicated in the IDS solutions of the critical infrastructures and theorize that the introduction of Machine Learning (ML) techniques in IDS will be helpful for implementing automatic adaptable solutions\ capable of adjusting to new situations and timely reacting in the face of threats and anomalies. To this end, we study the different levels of automation that the IDS can implement, and outline a methodology to endow critical scenarios with preventive automation. Finally, we analyze current solutions presented in the literature and contrast them against the proposed methodology

}, issn = {0302-9743}, doi = {http://link.springer.com/chapter/10.1007\%2F978-3-319-03964-0_18}, author = {Lorena Cazorla and Cristina Alcaraz and Javier Lopez} } @article {1750, title = {Towards Privacy Protection in Smart Grid}, journal = {Wireless Personal Communications}, volume = {73}, year = {2012}, month = {Nov 2013}, pages = {23-50}, publisher = {Springer}, abstract = {

The smart grid is an electronically controlled electrical grid that connects power generation, transmission, distribution, and consumers using information communication technologies. One of the key characteristics of the smart grid is its support for bi-directional information flow between the consumer of electricity and the utility provider. This two-way interaction allows electricity to be generated in real-time based on consumers{\textquoteright} demands and power requests. As a result, consumer privacy becomes an important concern when collecting energy usage data with the deployment and adoption of smart grid technologies. To protect such sensitive information it is imperative that privacy protection mechanisms be used to protect the privacy of smart grid users. We present an analysis of recently proposed smart grid privacy solutions and identify their strengths and weaknesses in terms of their implementation complexity, efficiency, robustness, and simplicity.

}, keywords = {authentication, Confidentiality, Critical Infrastructure Protection, Energy, privacy, Smart Grid}, isbn = {0929-6212}, issn = {0929-6212}, doi = {10.1007/s11277-012-0939-1}, url = {Wireless Personal Communications}, author = {S. Zeadally and A. Pathan and Cristina Alcaraz and M. Badra} }