Critical Infrastructure Systems Research Articles

Exploring the Interdependencies Between Transportation and Stormwater Networks: The Case of Norman, Oklahoma

The significance of critical infrastructure systems in maintaining productivity is undeniable. However, such systems remain susceptible to external disturbances and cascading failures. Instead of operating independently, these physical systems, such as transportation and stormwater systems, form an interdependent system. This interdependence, particularly important during flooding, illustrates that the failure of a stormwater system can disrupt traffic networks. To explore the extent of such interdependency, this study investigates the transportation and stormwater networks in Norman, Oklahoma. Using network science theories and concepts of multilayered networks, this paper analyzes these systems, both individually and in combination. The study identifies closely located components in the road and stormwater networks using Moran's I spatial autocorrelation metric. Next, the connectivity of these networks is represented in a graph format to investigate the topological credentials (i.e., rank of relative importance) of the network components (i.e., water inlets, road intersections as nodes, and stormwater conduits, road segments as links). Moreover, such credentials further change by considering the weights of the network components (i.e., average daily traffic, water flow). The proximity-based connectivity considerations between these networks utilizing Moran's I significance score revealed a good indicator of spatial interdependency. When incorporating directionality, the multilayer network analysis highlights that highly central components tend to cluster spatially, unlike the undirected counterpart. The study also identifies vulnerable locations and network components in a combined network setting that differ from the networks in isolation. In doing so, the research reveals new insights governing the complex reliance of transportation systems on neighboring stormwater systems.

Risks to Coastal Critical Infrastructure from Climate Change

Coastal systems are sensitive to direct and indirect impacts of climate change. Approximately 90% of all coastal areas will be affected by climate change to varying degrees. Nearly half of the world's major cities are located within 50 km of a coast, and coastal population densities are 2.6 times greater than those of inland areas, with a steep rise over the years. While coastal critical infrastructure is expanding, more social and physical systems are increasingly exposed to climate-induced hazards. The interconnectedness and interdependencies of critical infrastructure systems increase their systemic instability and fragility, resulting in greater dynamic risk and cascading impacts. Coastal critical infrastructure systems on several continents are at risk from the effects of climate change, including sea level rise, storm surges, and extreme weather events. Therefore, it is necessary to build and run climate-resilient infrastructure that is planned, designed, implemented, and operated to predict, be prepared for, and adapt to changing climatic circumstances. This review provides an up-to-date, objective, and critical assessment based on the literature to help determine what is known and what needs the future attention of researchers.

Operational and economy-wide impacts of compound cyber-attacks and extreme weather events on electric power networks

The growing frequencies of extreme weather events and cyber-attacks give rise to a novel threat where a malicious cyber actor aims to disrupt stressed components of critical infrastructure systems immediately before, during, or shortly after an extreme weather event. In this paper, we initiate the study of Compound Cyber–Physical Threats and develop a two-stage framework for the analysis of operational disruptions in electric power networks and economy-wide impacts under three scenarios: a Heatwave, a Cyber-attack, and a Compound scenario when the Cyber-attack is timed with the Heatwave. In the first stage, we use a bilevel optimization problem to represent the adversarial rationale of a cyber-attacker in the upper level. In the lower level, we model disruptions in the electric power network using an optimal power flow model. In the second stage, we couple the disruption of electricity supply with a Computable General Equilibrium model to elucidate the impacts on all economic sectors. For the New York Independent System Operator, we find that a 9% demand increase in a Heatwave may not lead to unserved load. The cyber-attack can lead to 4% of unserved electric load in Long Island, while the Compound scenario can increase unserved electric load in Long Island to 12% and affect almost 198,000 customers. Our results show that the activity of state and local government enterprises can decrease by 37% in the Compound scenario. We conclude that the vulnerability of federal, state, and local government enterprises to electricity disruptions can affect a broad range of populations.

A socio-technical approach for the assessment of critical infrastructure system vulnerability in extreme weather events

A socio-technical approach for the assessment of critical infrastructure system vulnerability in extreme weather events

ResQ-IOS: An iterative optimization-based simulation framework for quantifying the resilience of interdependent critical infrastructure systems to natural hazards

Critical Infrastructure Systems are highly complex and interdependent. Growing complexity and interdependency between infrastructure systems and frequent exposure to extreme events have inevitably increased the probability of cascading failures and the prolonged lack of serviceability in urban communities, especially so for energy systems. The resilience analysis of interdependent infrastructure systems against natural hazards provides stakeholders with a comprehensive outlook on recovery strategies to minimize the damage costs and losses caused by extreme events. This paper introduces the ResQ-IOS, a Resilience Quantification Iterative Optimization-based Simulation (IOS) framework for quantifying the resilience of interdependent infrastructure systems to natural hazards with the capability of considering the real-world conditions for the status of infrastructure systems' components. The ResQ-IOS framework consists of five modules: risk assessment, simulation, optimization, database, and controller. To evaluate the capabilities of this framework, the seismic resilience of interdependent energy infrastructure networks (power, natural gas, and water) in Shelby County (TN), USA, was assessed. The results of the resilience analysis of the case study suggest that the water network is the best candidate for implementing pre-disaster Resilience Enhancement Measures (REMs), like increasing the supply capacity. Due to the controlling role of the power network in the community's recovery process, it is recommended that post-disaster REMs, such as increasing the number of Repair and Maintenance (R&M) teams, should be applied to the power network to speed up the restoration of failed components in that network and consequently, shorten the recovery duration of the community. The ResQ-IOS can be employed as a useful computational tool for planning the resilience-oriented sustainable development of urban communities by, for example, deploying Renewable Energy (RE)-based strategies to enhance their disaster resilience.

A novel peridynamic solution for modelling saturated soil-pore fluid interaction in liquefaction analysis

Saturated soil-pore fluid interaction under earthquake shaking can cause extensive damages to critical infrastructure systems. As such, accurate modeling of saturated soil-pore fluid interaction and its consequences (e.g., seismically-induced large deformation) are of particular importance for liquefaction analysis. Peridynamics (PD) has emerged as an effective method for solving large deformation problems by overcoming the disadvantage of finite element method caused by mesh dependency. However, the PD has not been extended to model soil-pore fluid interaction, limiting its application in liquefaction analysis. To bridge this gap, a novel solution strategy is presented for modeling soil-pore fluid interaction (i.e., the u-p equations herein) in liquefaction analysis of saturated granular soils, based on a hybrid PD (HPD) method recently proposed by the authors and co-workers. An explicit-explicit method is used to solve the coupled u-p equations. Liquefiable soil on level and sloped ground are analyzed and compared with experimental data and finite element simulations to validate availability and efficiency of the method, demonstrating the method to be effective in solving the soil-pore fluid equations and applicable to a broad range of geotechnical earthquake engineering problems associated with liquefaction.

Measuring Resilience to Sea-Level Rise for Critical Infrastructure Systems: Leveraging Leading Indicators

There has been a growing interest in research on how to define and build indicators of resilience to address challenges associated with sea-level rise. Most of the proposed methods rely on lagging indicators constructed based on the historical performance of an infrastructure sub-system. These indicators are traditionally utilized to build curves that describe the past response of the sub-system to stressors; these curves are then used to predict the future resilience of the sub-system to hypothesized events. However, there is now a growing concern that this approach cannot provide the best insights for adaptive decision-making across the broader context of multiple sub-systems and stakeholders. As an alternative, leading indicators that are built on the structural characteristics that embody system resilience have been gaining in popularity. This structure-based approach can reveal problems and gaps in resilience planning and shed light on the effectiveness of potential adaptation activities. Here, we survey the relevant literature for these leading indicators within the context of sea-level rise and then synthesize the gained insights into a broader examination of the current research challenges. We propose research directions on leveraging leading indicators as effective instruments for incorporating resilience into integrated decision-making on the adaptation of infrastructure systems.

The New Dimensions of Critical Dependence on Space Systems

Abstract Space systems are a key enabler for a wide variety of applications and capabilities. They have become very important for the functioning of critical infrastructure systems and for national security processes. This article lays out the arguments in favor of characterizing the dependence on space systems as being critical, describes the recent and important changes in the security environment, and lays out key trends in space security governance which will affect the domain in the future.

Impacts of 5G on cyber-physical risks for interdependent connected smart critical infrastructure systems

5 G technology promises a wide range of benefits for critical infrastructure (CI), including improved reliability, increased efficiency, cost savings, and increased worker safety. However, it also brings many new risks that CI owners and operators must be prepared for to facilitate effective risk mitigation and response. These risks, however, have not been systematically assessed for CI systems. This paper investigates how the cyber-physical risk landscape will be impacted by 5 G for four major CI sectors in detail: smart transportation, smart water, smart power, and smart oil and gas networks. Compared to prior work only examining a single CI network, the authors present a comprehensive assessment of the types of threats that these sectors can expect based on past incidents, the new vulnerabilities introduced by 5 G and existing vulnerabilities exacerbated by the introduction of more connected devices, along with mitigation recommendations for each risk. Risks associated with the rollout of and transition to 5 G, risks from 5 G network disruptions, cyberattack risks, and privacy risks are included. While each of the sectors has a unique risk profile, general themes also emerged across multiple CI networks. Notably, there will be an increased number of threat vectors from smart devices reliant on the telecommunications network to provide monitoring and control of infrastructure services. Because many of these devices are accessible by the public, the risk of social engineering attacks and vulnerability to physical hacking are exacerbated. Successful risk mitigation requires collaboration among CI's many stakeholders to implement security measures at the interfaces between connected devices to limit the access to assets in case one security measure is successfully bypassed. Due to the increased interdependencies between CI networks, operators must create backup plans to keep the most essential services running on a smaller bandwidth in case of a 5 G outage or similar failure. As 5 G capabilities continue to develop and the risk landscape evolves, ongoing research is needed and CI owners and operators should be prepared to update security measures to remain ahead of identified risks and threats.

Analysis of the capacity of existing anti-virus protection systems and their based methods for detecting new malware in military information systems

The article solves the task of analyzing the ability of existing anti-virus systems and the methods based on them to detect new malicious software in information systems of critical infrastructure, in particular, the sector of the state defense forces. It is noted that the official data of the developers of antivirus systems often do not confirm the declared level of accuracy of detecting new malicious software in practice. In addition, in most cases, the declared accuracy rate of detecting new malware is higher than the similar rate of detection of known malware, which indicates that the antivirus systems in question are tested in specific conditions that are too different from real ones. The properties of new malicious software are described in order to find the most suitable class of computer viruses. Classes of polymorphic (oligomorphic) and metamorphic viruses demonstrate the most complete compliance with the specified properties, which allows us to assert their significant share in the use of new malicious software. The characteristics of malicious software detection methods are given, which due to their properties are able to adapt to a certain extent to their metamorphic (polymorphic) nature. Methods based on the theory of fuzzy logic demonstrate the most complete correspondence. The direction of improvement of the existing anti-virus systems in order to increase the adaptability to the detection of new (polymorphic, metamorphic) classes of malicious software is proposed. The obtained results should be considered as a basis for the implementation of new approaches to the detection of malicious software in order to identify previously unknown instances of it, which will allow to significantly increase the effectiveness of ensuring cyber security of modern information systems and networks.

Assessing the effectiveness of disaster risk reduction strategies on the regional recovery of critical infrastructure systems

Communities depend on critical infrastructure systems to support their regular operations and future development. Destructive events, such as natural disasters, threaten to disrupt service to these systems and the communities they support. Strategies designed to reduce the impacts from disasters and other events are therefore an important consideration for community planning. At a regional level, coordination between communities supports the efficient use of resources for implementing disaster risk reduction (DRR) measures and completing post-disaster repairs to meet the needs of all residents. Coordination is challenging, however, due to the complexity of regional systems and competing stakeholder interests. This work presents a case study model of regional water, wastewater, and power systems, and demonstrates the effect of seismic hardening and increased resource availability on post-earthquake repair requirements and critical infrastructure recovery. Model results indicate that implementing DRR strategies can reduce required repair costs by over 40 percent and outage severity by approximately 50 percent for the studied sectors. Not all strategies are effective for all sectors and locations, however, so this work discusses the importance of comprehensive, coordinated, and accessible emergency planning activities to ensure that the needs of all residents are considered.

Cyber-physical attack graphs (CPAGs): Composable and scalable attack graphs for cyber-physical systems

Attack graphs are a fundamental security tool focused on depicting how multi-stage attacks can be carried out through a network to compromise specific assets and systems. While attack graphs have been widely utilised in the IT cyber domain, their use in Operational Technology (OT) environments requires new approaches able to properly model and analyse Cyber-Physical Systems (CPS). In this paper, we introduce Cyber-Physical Attack Graphs (CPAGs) as a class of attack graphs able to cover both cyber and physical aspects. CPAGs aim at extending the reach of standard attack graphs to cyber-physical networks typically observed in industrial environments and critical infrastructure systems, analyse how an attacker can move within the network, and understand the impact that these actions may have on the system. We propose a constructive methodology to design CPAGs backed up by a formal rule-based approach that specifies how integral parts of the model can be generated and later composed to build more complex CPAGs. We then explore the semantics of CPAGs associated to cyber and physical attack actions as well as their impact on CPS environments. We also discuss potential CPAG-based analysis techniques and focus on risk analysis using Bayesian CPAGs. Finally, we show the application of the proposed model over a realistic scenario on smart farming using our open source tool T-CITY.

Towards Performance-Based Design of Masonry Buildings: Literature Review

Masonry is among the most widely used construction materials around the world. Contemporary masonry buildings are primarily designed to comply with prescriptive building code regulations. In recent decades, performance-based design (PBD) has gained increasing attention and achieved significant success in critical structures or infrastructure systems. Instead of being the first mover, the masonry research and practice community can be a faster follower in response to the design paradigm shift towards PBD for masonry buildings. A reliable performance assessment of masonry buildings is of paramount importance in the PBD framework. To facilitate this, this paper presents an up-to-date comprehensive literature review of experimental and analytical studies with emphasis on their contributions to advancement towards performance assessment of masonry buildings. This review categorized available works into two sub-topics: (1) traditional unreinforced masonry and (2) modern reinforced masonry. In each sub-topic, studies focusing on the structural behaviors of masonry at the component-level (i.e., masonry wall) are discussed first, followed by the building system-level-related studies. Through this literature review, the current state of the art and remaining research gaps are identified to provide guidance for future research needs and to pave the way for implementing PBD in the masonry industry.

A multi-criteria framework for critical infrastructure systems resilience

Critical infrastructure systems (CISs) play an essential role in modern society, as they are important for maintaining critical social functions, economic organisation, and national defence. Recently, CISs resilience has gained popularity in both academic and policy filed facing increased natural or technological disasters. Resilience assessments have become convenient and common tools for disaster management, as assessment results provide useful information to CIS managers. However, CISs resilience assessment is facing challenges of being practical to use in operational risk management.Although there are many existing assessments for CISs resilience, some shortcomings relating to assessment criteria, which cannot turn resilience useful in practical operation, are frequent in their assessment process. Existing assessments are based on different definitions, which makes criteria generalization difficult. Besides, these assessments are not comprehensive enough. Especially, few assessments address both the cost, effectiveness, and safety of optimisation actions. Moreover, most of the suggested criteria are not specific enough for being used for practical CISs risk management in real cases.This article develops therefore a multi-criteria framework (MCF) for CISs resilience, consisting of general criteria and a guide for defining specific sub-criteria. In this MCF, the side effects, cascading effects and cost-benefit in resilience scenarios are considered indispensable for CISs resilience assessment. The paper also presents an example of the application of the developed guide through two detailed scenarios, one on a single infrastructural system affected by a natural disaster, and the other addressing the interdependence of this infrastructural system and an urban healthcare system. The designed MCF contributes to the operationalisation and comprehensiveness of CISs resilience assessments.

Designing resilient and economically viable water distribution systems: a multi-dimensional approach

Enhancing the resilience of critical infrastructure systems requires substantial investment and entails trade-offs between environmental and economic benefits. To this aim, we propose a methodological framework that combines resilience and economic analyses and assesses the economic viability of alternative resilience designs for a Water Distribution System (WDS) and its interdependent power and transportation systems. Flow-based network models simulate the interdependent infrastructure systems and Global Resilience Analysis (GRA) quantifies three resilience metrics under various disruption scenarios. The economic analysis monetizes the three metrics and compares two resilience strategies involving the installation of remotely controlled shutoff valves. Using the Micropolis synthetic interdependent water-transportation network as an example, we demonstrate how our framework can guide infrastructure stakeholders and utility operators in measuring the value of resilience investments. Overall, our approach highlights the importance of economic analysis in designing resilient infrastructure systems.

Hybrid precoding design for secure smart-grid enabled MIMO wireless communications in Industry 5.0

Secure and reliable wireless communication systems are essential for the successful integration of smart grid-enabled wireless communications and Industry 5.0 applications. This work proposes a hybrid precoding design for secure smart-grid multiple-input multiple-output (MIMO) wireless communications in Industry 5.0 to maximize the average secrecy capacity of the system while minimizing user outages crucial for maintaining the security and privacy of sensitive data in critical infrastructure. To achieve this, we develop a mathematical model that considers the impact of various system parameters, such as eavesdropping and interference caused by the active eavesdropper and noise, on the secrecy capacity. To find an efficient solution to the optimization problem, we propose an algorithm that decouples the original optimization problem into a series of subproblems and uses iterative techniques to find the optimal values, thereby improving computational efficiency. The hybrid precoding scheme is an effective technique for optimizing the design parameters of MIMO-based secure wireless communication systems. Our proposed approach provides a practical solution for achieving this optimization. Our numerical results demonstrate that our proposed scheme outperforms traditional benchmark schemes, maximizing the average secrecy capacity while minimizing user outages. Our work highlights the importance of secure wireless communication systems in Industry 5.0 and smart grid applications. The proposed approach provides an efficient method for designing secure wireless communication systems that can effectively address the unique challenges posed by these critical infrastructure systems.

A Multi-Model Proposal for Classification and Detection of DDoS Attacks on SCADA Systems

Industrial automation and control systems have gained increasing attention in the literature recently. Their integration with various systems has triggered considerable developments in critical infrastructure systems. With different network structures, these systems need to communicate with each other, work in an integrated manner, be controlled, and intervene effectively when necessary. Supervision Control and Data Acquisition (SCADA) systems are mostly utilized to achieve these aims. SCADA systems, which control and monitor the connected systems, have been the target of cyber attackers. These systems are subject to cyberattacks due to the openness to external networks, remote controllability, and SCADA-architecture-specific cyber vulnerabilities. Protecting SCADA systems on critical infrastructure systems against cyberattacks is an important issue that concerns governments in many aspects such as economics, politics, transport, communication, health, security, and reliability. In this study, we physically demonstrated a scaled-down version of a real water plant via a Testbed environment created including a SCADA system. In order to disrupt the functioning of the SCADA system in this environment, five attack scenarios were designed by performing various DDoS attacks, i.e., TCP, UDP, SYN, spoofing IP, and ICMP Flooding. Additionally, we evaluated a scenario with the baseline behavior of the SCADA system that contains no attack. During the implementation of the scenarios, the SCADA system network was monitored, and network data flow was collected and recorded. CNN models, LSTM models, hybrid deep learning models that amalgamate CNN and LSTM, and traditional machine learning models were applied to the obtained data. The test results of various DDoS attacks demonstrated that the hybrid model and the decision tree model are the most suitable for such environments, reaching the highest test accuracy of 95% and 99%, respectively. Moreover, we tested the hybrid model on a dataset that is used commonly in the literature which resulted in 98% accuracy. Thus, it is suggested that the security of the SCADA system can be effectively improved, and we demonstrated that the proposed models have a potential to work in harmony on real field systems.

Security-Enhanced Serial Communications

Industrial Control Systems (ICS) are widely used by critical infrastructure and are ubiquitous in numerous industries including telecommunications, petrochemical, and manufacturing. ICS are at a high risk of cyber attack given their internet accessibility, inherent lack of security, deployment timelines, and criticality. A unique challenge in ICS security is the prevalence of serial communication buses and other non-TCP/IP communications protocols. The communication protocols used within serial buses often lack authentication and integrity protections, leaving them vulnerable to spoofing and replay attacks. The bandwidth constraints and prevalence of legacy hardware in these systems prevent the use of modern message authentication and integrity techniques, such as those provided by Transport Layer Security (TLS). Our approach seeks to address the challenges of providing authentication to serial communications while keeping the existing serial communications bus in place and adding minimal hardware. Here we demonstrate the integration of field-programmable gate arrays (FPGAs) on the bus to inject message authentication codes into an out-of-band (OOB) communications channel, leveraging Power Line Communication (PLC) techniques. Our results show that simple solutions can be integrated into existing serial communications to provide necessary security features in critically important systems. The presented solution is inexpensive, scales well, is modular and extensible, and has low temporal overhead. Providing authenticated serial communications for critical infrastructure systems will improve their ability to resist cyber attacks.

A simulation‐based generalized framework to model vulnerability of interdependent critical infrastructure systems under incomplete information

AbstractThis paper proposes a novel simulation‐based hybrid approach coupled with time‐dependent Bayesian network analysis to model multi‐infrastructure vulnerability over time under physical, spatial, and informational uncertainties while considering cascading failures within and across infrastructure networks. Unlike existing studies that unrealistically assume that infrastructure managers have full knowledge of all the infrastructure systems, the proposed approach considers a realistic scenario where complete information about the infrastructure network topology or the supply–demand flow characteristics is not available while estimating multi‐infrastructure vulnerability. A novel heuristic algorithm is proposed to construct a dynamic fault tree to abstract the network topology of any infrastructure. In addition, to account for the unavailability of exact supply–demand flow characteristics, the proposed approach constructs the interdependence links across infrastructure network systems using different simulated parameters considering the physical, logical, and geographical dependencies. Finally, using parameters for geographical proximity, infrastructure managers' risk perception, and the relative importance of one infrastructure on another, the multi‐infrastructure vulnerability over time is estimated. Results from the numerical experiment show that for an opportunistic risk perception, the interdependencies attribute to redundancies, and with an increase in redundancy, the vulnerability decreases. On the other hand, from a conservative risk perspective, the interdependencies attribute to deficiencies/liabilities, and the vulnerability increases with an increase in the number of such interdependencies.

Fragility-based system performance assessment of critical power infrastructure

Climate change and population growth require the development and operations of critical power infrastructure systems to meet the energy demand. Performance assessment of the power infrastructure usually focuses primarily on the thermodynamic analysis calculating the energy output and system efficiency. However, the energy output from the thermodynamic analysis under normal operation could not fully represent the infrastructure behavior due to the neglect of the component reliability in the energy generation system. There is a lack of consideration of the energy delivery system and its fragility with respect to external meteorological parameters (e.g., wind). In this study, the fragility of the energy-delivery system concerning wind speed is modeled and integrated to assess critical power infrastructure performance. The reliability consideration of the energy generation system is included based on the state space diagram and the frequency-balance method. The fragility of the energy-delivery system is used to derive a system reliability index for the system which is the probability that end-users will receive the energy. Besides, sensitivity analysis is conducted to investigate the influence of the important decision variables on the system performance. The study employs a small-scale power infrastructure system at the University of Connecticut as an example to demonstrate the feasibility of the performance assessment framework. The system is composed of a cogeneration plant and energy distribution systems. The results from the case study prove that the decision variables have considerable nonlinear impacts on the system performance. With the integration of fragility, the proposed approach could estimate the energy received by consumers from the generation site.