# A Methodological Approach to Securing Cyber-Physical Systems for Critical Infrastructures
## 2 State of The Art
In fact, virtualization enables the protected transparent introspection of the activity and content of virtual machines, allowing for more robust monitoring and control. In fact, most approaches allow for the use of introspection techniques for monitoring intrusions and anomalies by analyzing the system memory and checking its consistency [23]. Hyperupcalls [24] allows a hypervisor to execute in a safe way verified code that is provided by a guest virtual machine to protect data transfers. Hyperupcalls have complete access to guest data structures, potentially allowing for more detailed debugging and monitoring. KVMIveggur [25] offers isolation leveraging containers and virtual machines to enable access control for VMI in cloud environments. It supports continuous monitoring, allows using both active and passive VMI, and can have a very low overhead. With regard to monitoring and detection execution, we refer to ontology-based monitoring. It is based on utilizing ontologies, which are structured representations of knowledge, to enhance the monitoring of various systems, including, but not limited to, IoT (Internet of Things) devices, networks, and applications. In recent years, substantial research has been conducted on ontology in the representation of different realities and contexts such as DOLCE [26] or BFO, or possibly domain-specific representation in order to describe specific domains or individual systems [27]. All in all, in the last decade, the individual topics mentioned so far have been seen as facets of a comprehensive, unified, and automated cyber-defence architecture [28; 29; 30], thus progressing in the same direction as the OPA discussed in this paper. In particular, the OPA being proposed is aligned with the SANS Security Controls 4, 6, 10, 11, 13, 16, and 19 discussed in [28] and is coherent with the high-level NATO Cyber Defence framework also presented therein. The incorporation of machine learning elements also makes the OPA ready to support next-generation cybersecurity paradigms leveraging artificial general intelligence, like the one proposed in [31]. It is worth highlighting that effective cybersecurity is more than a technical matter, as it involves the whole business and the economic aspect of it is very important. Indeed, huge financial losses can arise from a cyber incident, including damages to tangible and intangible assets and liabilities to third parties such as customers, suppliers, employees, and shareholders. A key point is to optimally invest money in order to manage cyber risk, given a certain budget. The peculiarity of cyber risk makes this goal challenging [PERSON] and [PERSON] [32]. A first step to mitigate cyber risk is to raise the level of security by investing in self-protection. Many contributions concern the use of risk metrics borrowed from economic and financial contexts to evaluate these investments; among which are [33; 34; 35]. Another tool to mitigate cyber risk is cyber insurance, a risk transfer option which allows one to shift residual cyber risks to an insurance company. Comprehensive existing reviews concerning state of the art, trends, and future directions of this kind of insurance include [36; 37]. Finally, as far as reaction means are concerned, firewalls (FWs) are widely deployed popular software and hardware components that (a) block unwanted traffic forwarding, (b) prevent malicious messages from reaching their targets, and (c) can deploy attack countermeasures [38]. Nevertheless, FWs may well become performance bottlenecks and/or targets, e.g., denial-of-service (DoS) attacks. Mitigating approaches to this problem exist, either by operating within a single FW, i.e., _intra-firewall_ techniques, or by relying on network-level approaches leveraging multiple FWs, i.e., _inter-firewall_ approaches. Some intra-firewall approach include (optimal) rule ordering [39; 40], rule analysis [41; 42], and firewall compression [43]. Oftentimes, special architectures such as parallel firewalls [44] support inter-firewall approaches.