Threat Analysis and Detection in Critical Infrastructure Security

Critical Infrastructure Protection against threats has become a major issue in modern society, due in particular to the traumatic terrorist attacks of New York and Washington (2001), Madrid (2004), London (2005) and to the very recently train bomb attack on the Nevsky Express from Moscow to St. Petersburg (November 2009). Such events highlighted the vulnerabilities of actual civil infrastructures and demonstrated that traditional concepts of Homeland Security did not match the current requirements. Critical infrastructures include physical assets as well as Information and Communication Technology services, networks and installations that constitute vital points of a country. Their protection has become an important and tricky activity which requires the development of innovative and multidisciplinary approaches in order to identify and mitigate vulnerabilities and risks, provide security operators with an acceptable situation awareness level in order to prevent threats, and coordinate emergency procedures after a natural catastrophe or a malicious attack. In this thesis we propose a protection strategy for critical infrastructures, made up of three main contributions. First of all, we present a quantitative methodology for risk management implemented in a specified tool, which allows for a cost/benefit analysis and also provides a valid support for the classification of threats; secondly, we propose an integration platform for sensor systems aims to solve heterogeneity issues of sensing technologies employed in modern security systems; finally we introduce a deterministic model-based detection engine aims to early detect threats against critical infrastructures by correlating events signaled by different sensor systems. Some experimental testbeds of the proposed solutions show how our protection strategy can be very effective in enhancing the security level of a critical rail-based infrastructure.