## 2 Cyber Threat Intelligence and Active Buildings
### Active Buildings  
Active buildings are an emerging technology having a special role in the transition to a sustainable energy infrastructure and a decarbonised society [27]. They are not traditional smart buildings, as, conversely, active buildings communicate with other peers not only for coordination purposes but also for exchanging energy among them [43]. Thus, they can energise not only their own premises but also their surrounding peers without the intervention of the conventional power grid. Active buildings employ intelligent sensing and information systems to enhance power quality [44; 45] and make prompt decisions to support the main grid's national infrastructure and promote near-zero energy [46; 47; 48]. Figure 2 shows an overview of the devices within the active building offering, that must be taken into account as potential attack vectors in cybersecurity analyses. From the cyber-security perspective, the additional services brought by active buildings would provide further incentives to perform attacks. Furthermore, their effect can be devastating on the security of the power grid. Being the power grid a critical infrastructure, the increased purposes for carrying out an attack to an active building incentivise malicious entities to perpetrate an attack. Active buildings need not be a single large smart building with energy distribution capabilities. For example, a collection of residential houses equipped with static batteries may be controlled to synchronously act like active buildings. Residents will plug their electric vehicles into smart charging stations, several smart home appliances such as smart plugs, sensors, alarm systems, surveillance systems, dishwashers, air conditioning, and so on. Energy trading, albeit an interesting feature, will be considered after the core business propositions on active buildings have been addressed. Clearly, an oversimplification of active buildings models translates to a reduction of the CTI taken into consideration, which would make a security analysis ineffective, and so the related incident responses. The complexity of cyber-attack types potentially affecting active buildings is increased from their ability to generate and consume locally without ever disconnecting from the main (conventional) grid, de facto acting as (part of) a _microgrid_. Microgrids usually operate in low-voltage distribution grids or in active distribution networks [49]. An example of an issue in these contexts could be forcing prosumers to use the main grid instead of using the services provided by active buildings. An adversary might exploit vulnerabilities of smart meters or smart chargers to carry out such attacks. We do not cover all aspects of cybersecurity but provide enough elements to appreciate the complexity of CTI in active buildings. With the same aim, Figure 3 shows an overview of data sources that is generally required to readily review for assessing cybersecurity in the context of active buildings. A comprehensive knowledge of cybersecurity in the context of active buildings, microgrids, and cyber-physical systems is fundamental for an effective CTI model of a real scenario. Cybersecurity of Active Buildings  
There is also preoccupation with data handling throughout active buildings, protecting stakeholders from improper use, and caring about privacy concerns. Active buildings present a large attack surface to protect where adversaries might seek to disturb these elements and provoke chaos, intercept/eavesdrop/delay communications, steal/divert power for financial gains, or exfiltrate data (for ransom or other malicious reasons). Cybersecurity should adapt to emerging technologies that will be attached to active buildings' operation as well as agnostic regarding telecommunication protocols deployed. Timely and regular  
Figure 3: Common CTI sources for assessing cybersecurity concerns in non-trivial infrastructure. Figure 2: Overview of a tentative architecture and most likely devices that managers will deploy for enacting the active building business proposition.