Enrico Zio’s research while affiliated with Politecnico di Milano and other places

Interdependent infrastructure networks (IINs) are increasingly vulnerable to potential threats from terrorist activities, which can severely disrupt their performance. The dynamic interactions between intelligent attackers and defenders are crucial in determining the resilience of IINs. Based on game theory and complex network theory, this paper proposes a Stackelberg attack-defense game model considering cascading failures. The proposed two-player game model prioritizes the actions of the defender, with the attacker adopting the role of a follower who formulates a response to the defender’s moves. The strategies and payoffs are defined based on the vulnerability of IINs under disruptions, accounting for cascading failures both within individual networks and between heterogeneous networks. An interdependent power and gas network is applied to explore equilibrium strategies and expected payoffs for both the attacker and defender. Simulation results reveal the importance of considering cascading effects from a network perspective when evaluating the performance of IINs. The findings demonstrate that narrowing the importance gap between nodes is an effective strategy for enhancing system resilience and mitigating the impact of attacks. The equilibrium strategies derived from this model offer valuable insights for improving the resilience of IINs against disruptive events.

Analyzing attacker behavior and exploring attack paths are crucial to design effective cybersecurity protection mechanisms. In this work, we propose a Monte Carlo (MC)-based probabilistic cost-benefit analysis approach to assess cyber vulnerabilities and identify attack paths most likely to be exploited in an industrial control setting. First, we draw an attack graph to represent the potential attack paths that attackers could exploit to compromise the vulnerabilities of a target Industrial Control System (ICS). A cost-benefit analysis is, then, integrated into a graph path algorithm to explore attacker’s decisions for exploiting vulnerabilities, whilst accounting for the dynamic characteristics of the system configuration. A probabilistic risk metric is introduced to measure the uncertainty that derives from the intrinsic technical exploitability of vulnerabilities and attackers’ propensities. For demonstration, we apply the proposed approach to a simplified corporate network in an ICS environment, which is vulnerable to multi-step cyberattacks. We identify the shortest attack paths with the highest probabilities and assess the risk associated to each vulnerable element.

Urban Critical Infrastructures (UCIs) are exposed to cascading failures due to their internal connectivity and the complex interactions across physical, logical, geographic and cybers. Assessing the vulnerability of UCIs is essential for ensuring the reliable and safe operation of cities. Considering the specific UCI model of the interdependent traffic and power systems, this paper proposes a two-layer cascading failure model for assessing the vulnerability of the Interdependent Traffic-Power System (ITPS), consisting of a Traffic Layer (TL) and a Power Layer (PL). A user equilibrium model is used to simulate traffic flow in the TL, while the PL applies Kirchhoff’s laws for power distribution. To enhance the realism of interdependence modeling between the two layers, a Local Flow Entropy (LFE) interdependence method is introduced, integrating the flow states of neighboring components within the infrastructures. A case study on the IEEE118 system and Watts–Strogatz (WS) network demonstrates that the degree of ITPSs vulnerability is higher than under traditional Node Degree (ND) method in initial intentional attacks. The results show a nonlinear relationship between infrastructure capacity and vulnerability, highlighting the need for risk management strategies to balance cost and system stability.

Deep Learning (DL) models processing images to recognize the health state of large infrastructure components can exhibit biases and rely on non-causal shortcuts. eXplainable Artificial Intelligence (XAI) can address these issues but manually analyzing explanations generated by XAI techniques is time-consuming and prone to errors. This work proposes a novel framework that combines post-hoc explanations with semi-supervised learning to automatically identify anomalous explanations that deviate from those of correctly classified images and may therefore indicate model abnormal behaviors. This significantly reduces the workload for maintenance decision-makers, who only need to manually reclassify images flagged as having anomalous explanations. The proposed framework is applied to drone-collected images of insulator shells for power grid infrastructure monitoring, considering two different Convolutional Neural Networks (CNNs), GradCAM explanations and Deep Semi-Supervised Anomaly Detection. The average classification accuracy on two faulty classes is improved by 8% and maintenance operators are required to manually reclassify only 15% of the images. We compare the proposed framework with a state-of-the-art approach based on the faithfulness metric: the experimental results obtained demonstrate that the proposed framework consistently achieves F_1 scores larger than those of the faithfulness-based approach. Additionally, the proposed framework successfully identifies correct classifications that result from non-causal shortcuts, such as the presence of ID tags printed on insulator shells.