## 1 Introduction  
The modern electrical grid, or smart grid, constantly evolves to offer an increasing variety of services that the traditional grid could not [1; 2; 3]. Such services sustain residential customers, business activities, and industrial organisations in an unprecedented scale. Smart buildings play a key role in the smart grid [4], as not only do they consume energy as traditional buildings, but they also produce (and store) energy from renewable sources. A great deal of smart grid infrastructure elements is exposed, however, to constant malicious activity [5; 6; 7; 8]. With the strengthening of security measures, also cyber-attacks have augmented in depth, breadth, intensity, and sophistication [5; 9]. These incursions have the potential of corrupting and disturbing systems, exposing users' confidential data, and causing significant damage or financial loss, particularly when adversaries coordinate skill and effort in variable length campaigns [10; 11; 12], e.g., load changing or state-sponsored attacks. The operational status of infrastructures is monitored and controlled through services adopting Internet-of-Things (IoT) devices over public and private domains in wired or wireless modes [6]. An important service is remote control; its spread adoption translates to a growth of interconnected cyber-physical systems (CPSs). One example of a CPS is the smart grid where power managers implement dynamic load responses for different energy profiles to balance supply and demand [13] that provides stability, reliability, and resilience to stakeholders [14]. Such smart components were studied in the literature employing stochastic programming, deep learning, robust hub management, and economical models [15; 16; 17; 18]. Moreover, the assessment of threats in such systems is traditionally collected as _cyber threat intelligence_ (CTI) [19], also termed _information security threat intelligence_, or ISTI; however, we shall use CTI throughout this work. Over time, business incentives, lower prices, and greater trust in renewable energy are convincing consumers to convert to _prosumers_, i.e., entities acting as both consumers and producers. One observes a high penetration of renewable generation devices such as solar roof-top photovoltaic or wind turbines combined with incentives to drive electric vehicles [20; 21]. Future prosumers will plug their generators directly in the distribution grids and (indirectly) assist the wider grid with ancillary services, such as frequency balancing [22] and grid stability. In this paper, we focus on a special type of prosumers, active buildings, that \"sustain a country's energy infrastructure\" [23] and are deployed in conjunction with electrical power grids. An active building can be seen as a CPS, or an organised assembling of multiple CPSs, with capabilities to distribute energy, or exchange energy with other active buildings, potentially selling it at different prices. They could function as individual power stations, supporting the wider grid and the local domain where they are located, implementing the notion of \"buildings as power stations\" [4; 24]. Active buildings are not only different from traditional smart buildings and microgrids from an energetic perspective, but also from a cybersecurity perspective: indeed, Figure 1 illustrates how additional communication and power links need to be setup [25; 26]. Communication links are used to handshake sessions of bidirectional energy transfers that will physically flow due to dedicated power links. Such links can be indeed targeted by cyber attacks with the purpose of taking advantages in the energy market [7]. With respect to the energy market in microgrids, we mention the work of [PERSON] et al. [28] that identified potential cyber-attacks in such systems as well as implications to smart grids.