Alfredo Petruolo

Asset discovery in critical infrastructures, and in particular within industrial control systems, constitutes a fundamental cybersecurity function. Ensuring accurate and comprehensive asset visibility while maintaining operational continuity represents an ongoing challenge. Existing methodologies rely on deterministic tools that apply fixed fingerprinting strategies and lack the capacity for contextual reasoning. Such approaches often fail to adapt to the heterogeneous architectures and dynamic configurations characteristic of modern critical infrastructures. This work introduces an architecture based on a Mixture of Experts model designed to overcome these limitations. The proposed framework combines multiple specialized modules to perform automated asset discovery, integrating passive and active software probes with physical sensors. This design enables the system to adapt to different operational scenarios and to classify discovered assets according to functional and security-relevant attributes. A proof-of-concept implementation is also presented, along with experimental results that demonstrate the feasibility of the proposed approach. The outcomes indicate that our LLM-based approach can support the development of non-intrusive asset management solutions, strengthening the cybersecurity posture of critical infrastructure systems.

The evolution from traditional power grids to modern smart grids marks a significant advancement in energy management and efficiency. This transition—driven by the implementation of bidirectional energy and information flows—results in a dramatic increase in infrastructure vulnerability since new entry points are introduced on the attack surface. In particular, prosumers represent a brand new—and, thus, largely unexplored—attack vector, for which a thorough re-evaluation of the existing security measures is very much needed. This article proposes a novel approach to security monitoring, which exploits business process knowledge to effectively identify and mitigate prosumer-specific advanced persistent threats in smart grids. To validate the approach, an experimental campaign is done in a real setup, specifically the power grid of the Berchidda municipality, in Italy. Impact evaluation covers technical as well as business aspects since the analysis includes potential economic consequences of the attacks.

The rapid expansion of digital twin technology has revolutionized management and testing across various sectors, particularly in safeguarding critical infrastructure like smart grids. Aligned with the NIS2 Directive, Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022, digital twins play a critical role in bolstering cybersecurity measures by enabling advanced simulation and real-time monitoring, key aspects emphasized in the directive for enhancing the security of networks and information systems. Concurrently, Europe’s shift towards communal data spaces amplifies the need for robust cyber defences. This paper aims to bolster cybersecurity defences in critical infrastructure, with a particular focus on the energy sector and smart grids. It proposes an innovative architecture for cybersecurity monitoring, converting a Common Information Model-compliant system into a digital twin via the FIWARE platform and incorporating an open-source Security Information and Event Management solution. Validated by a real-world case study, our approach demonstrates significant advancements in protecting smart grids against cyber threats.

An important objective being pursued by the European Commission is the establishment of a unified data market where stakeholders can safely and confidently share and exchange data in standardized formats. This trend is supported by numerous initiatives, promoting the creation of European Common data spaces, and it is already in full swing in several sectors, such as energy and health. Among the many initiatives for building common data spaces, FIWARE appears to be one of the most promising. FIWARE promotes the use of Digital Twin technology to build distributed infrastructures for facilitating real-time data sharing in collaborative environments. By fostering an open and collaborative approach to software development and providing several building blocks of IT architectures for a number of domains (specifically: Smart AgriFood, Smart Cities, Smart Energy, Smart Industry, and Smart Water), FIWARE facilitates the creation of Digital Twins of real-world Industry 4.0 setups in a shared data space, which is typically hosted in the cloud. This paper addresses the security issues in a typical functional FIWARE architecture and provides a detailed description of a reference solution which ensures data confidentiality and integrity throughout the data life cycle, i.e. from the generation to the consumption phase. The proposed solution strongly relies on Commercial Off The Shelf Trusted Execution Environment technologies (namely: Intel SGX and Arm TrustZone) to provide effective protection of data-in-use. Protection of data-at-rest and data-in-transit is achieved by means of advanced cryptographic techniques and secure communication protocols, respectively.

The adoption of Digital Twin technology has witnessed significant growth in various domains, enabling continuous monitoring and testing in diverse applications. In the context of safeguarding critical infrastructures, particularly smart grids, Digital Twin has emerged as a viable solution to meet the requirements outlined in the NIS2 directive issued by the European Commission. Additionally, the increasing trend in Europe towards establishing shared dataspaces, and fostering collaborative environments through data sharing, necessitates a heightened focus on cybersecurity risks. This study focuses on enhancing cybersecurity measures in critical infrastructure, with a specific emphasis on the energy sector and smart grids. To achieve this objective, a robust architecture is proposed for the cybersecurity monitoring of a smart power and distribution grid. The proposed approach involves the transformation of a system model, conforming to the Common Information Model standard for the power system domain, into a digital twin model powered by FIWARE, an open-source platform. The architecture incorporates a SIEM (Security Information and Event Management) solution built on open-source technologies. A comprehensive validation is conducted through a real-world case study, providing empirical evidence of the effectiveness of the proposed approach.