Industrial Cyber-Physical Systems (ICPSs) generate cyber and physical data whose joint elaboration can provide insight into ICPSs' operating conditions. Cyber-Physical Anomaly Detection (CPAD) addresses the joint analysis of cyber and physical threats through multi-source and multi-modal data analysis. CPAD is often tailored to specific anomaly types and may use opaque deep learning models, impairing flexibility and explainability. In light of these challenges, we propose a two-level fusion framework for modeling and deploying CPAD in distributed ICPSs. The first detector-level fusion involves deploying CPAD detectors to several distributed ICPS segments and training them through data/decision fusion techniques with historical cyber-physical data. When the distributed ICPS is operational, thus collecting new cyber-physical data, ICPS segments' trained CPAD detectors provide pieces of evidence that go through the second ensemble-level fusion, for which we propose an explainable decision fusion technique based on Time-Varying Dynamic Bayesian networks. The evaluation involves the comprehensive application of the framework to a real hardware-in-the-loop case-study in a laboratory environment. The proposed ensemble-level fusion outperforms the state-of-the-art decision fusion techniques while providing explainable results.

Localization and tracking support is useful in many contexts and becomes crucial in emergency response scenarios: being aware of team location is one of the most important knowledge for incident commander. In this work both localization and tracking for rescuers are addressed in the framework of REFIRE project. The designed positioning system is based on the well-known prediction-correction schema adopted in field robotics. Proprioceptive sensors, i.e., inertial sensors and magnetometer, mounted on the waist of the rescuers, are used to form a coarse estimation of the locations. Due to the drift of inertial sensors, the position estimate needs to be updated by exteroceptive sensors, i.e., RFID system composed by tags embedded in the emergency signs as exteroceptive sensors and a wearable tag-reader. In long-lasting mission RFID tags reset the drift by providing a positioning having room-level accuracy.

Digital twin development of industrial cyber-physical systems requires modeling, simulation, and monitoring to provide accurate digital replicas mimicking system dynamics. To this aim, modern solutions employ data-driven approaches to capture normal system dynamics using historical data, and anomaly detection using run-time data. However, these approaches are typically process-agnostic and have limited explainability, which negatively impacts trustworthiness. Hence, we propose a novel framework for the digital twin development of industrial cyber-physical systems based on process mining, which connects data-driven and process-based analyses. The framework implements an offline phase that systematically identifies the most suitable process model to capture normal dynamics and simulates faulty dynamics for what-if analysis. The subsequent online phase involves run-time monitoring for anomaly detection. We develop a proof-of-concept application of the framework addressing a water distribution case study that allows physical fault injection. Results highlight the importance of adopting high-quality process models to significantly improve anomaly detection and time performance.

In the last decade, many efforts have been devoted to indoor localization and positioning. In this paper, a hybrid indoor localization system has been developed within the European project REFIRE for emergency situations. The REFIRE solution estimates the user's pose according to a prediction-correction scheme. The user is equipped with a waist-mounted inertial measurement unit and a radio frequency identification (RFID) reader. In the correction phase, the estimation is updated by means of geo-referenced information fetched from passive RFID tags predeployed into the environment. Accurate position correction is obtained through a deep analysis of the RFID system radiation patterns. To this end, extensive experimental trials have been performed to assess the RFID system performance, both in static and dynamic operating conditions. Experimental validation in realistic environments shows the effectiveness of the proposed indoor localization system, even during long-last missions and/or using a limited number of tags.

In this paper, we provide a novel framework to assess the vulnerability/robustness of a network with respect to pair-wise nodes' connectivity. In particular, we consider attackers that aim, at the same time, at dealing the maximum possible damage to the network in terms of the residual connectivity after the attack and at keeping the cost of the attack (e.g., the number of attacked nodes) at a minimum. Differently from the previous literature, we consider the attacker perspective using a multiobjective formulation and, rather than making hypotheses on the mindset of the attacker in terms of a particular tradeoff between the objectives, we consider the entire Pareto front of nondominated solutions. Based on that, we define novel global and local robustness/vulnerability indicators and we show that such indices can be the base for the implementation of effective protection strategies. Specifically, we propose two different problem formulations and we assess their performances. We conclude this paper by analyzing, as case studies, the IEEE118 power network and the U.S. Airline Network as it was in 1997, comparing the proposed approach against centrality measures.