Combined cyber and physical attacks on Critical Infrastructures have disastrous consequences on economies and in social well-being. Protection and resilience of CIs under combined attacks is challenging due to their complexity, reliance on ICT systems and the interdependences between different types of CIs. The PRAETORIAN framework was designed to address these challenges, by integrating components responsible for detecting both cyber and physical threats. Additionally, it forecasts how the combined attacks will evolve and their cascading effects on interdependent CIs. The PRAETORIAN framework was demonstrated based on a realistic scenario in the Zagreb airport, combining both physical and cyber attacks.

In this paper, we describe the functioning of the PRAETORIAN Framework, an integrated platform to identify complex threats across the physical and cyber domains of Critical Infrastructures (CIs). Therefore, the framework combines a physical and a cyber situation awareness solution into an innovative Hybrid Situation Awareness tool to detect the different stages of a complex threat. Further, the framework supports the decision makers and emergency organizations with a Coordinated Response tool to align and plan the activities for reducing or preventing the effects of an attack. All aspects are described according to a real-life use case that has been tested at the Zagreb airport.

Over the last years, critical infrastructures have become the target of highly sophisticated attacks causing severe damage to economic and social life. In most cases, such attacks are utilizing combined attack vectors from both the physical and the cyber domain. The magnitude of the consequences is often increased by cascading effects in both domains, even further amplifying each other. In this article, we present a framework implementing a holistic approach towards situational awareness for critical infrastructures. This Hybrid Situational Awareness (HSA) combines information coming from the physical as well as from the cyber domain and is able to identify potential cascading effects of an incident. In this context, the hybrid approach particularly focuses on the inter-domain propagation of a failure, i.e., the effects of a physical incident on the cyber domain and vice versa. We will show how such a Hybrid Situational Awareness can be implemented and illustrate its functionality based on a complex attack scenario.

Cyberattacks, which consist of exploiting security vulnerabilities of computer networks and systems for any kind of malicious purpose (e.g., extortion, data steal, assets hijacking), have been continuously increasing worldwide in recent years. Cyberspace appears today as a new battlefield, along with physical world scenarios (land, sea, air, and space), for the organizations defence and security. Besides, by the fact that attacks from the physical world may have significant implications in the cyber world and vice versa, these dimensions cannot be understood independently. However, the most common intelligence systems offer an insufficient situational awareness exclusively focused on one of these decision spaces. This article introduces HYBINT, an enhanced intelligence system that provides the necessary decision-making support for an efficient critical infrastructures protection by combining the real-time situation of the physical and cyber domains in a single visualization space. HYBINT is a real cross-platform solution which supplies, through Big Data analytical methods and advanced representation techniques, hybrid intelligence information from significant data of both physical and cyber data sources in order to bring an adequate hybrid situational awareness (HSA) of the cyber-physical environment. The proposal will be validated in a detailed scenario in which HYBINT system will be evaluated.

Starting from a common fictional scenario, simulated data sources and a set of measurements will feed two different visualization techniques with the aim to make a comparative analysis. Both visualization techniques described in this paper use the operational picture concept, deemed as the most appropriate tool for military commanders and their staff to achieve cyber situational awareness and to understand the cyber defence implications in operations. Cyber Common Operational Picture (CyCOP) is a tool developed by Universitat Politècnica de València in collaboration with the Spanish Ministry of Defence whose objective is to generate the Cyber Hybrid Situational Awareness (CyHSA). Royal Military Academy in Belgium developed a 3D Operational Picture able to display mission critical elements intuitively using a priori defined domain-knowledge. A comparative analysis will assist researchers in their way to progress solutions and implementation aspects.