# A Methodological Approach to Securing Cyber-Physical Systems for Critical Infrastructures
## 2 State of The Art  
This section provides an overview of the recent literature contributions on activities categorized according to the proposed architecture (Figure 1). Regarding the monitoring and detection pre-setup, we first refer to slow DoS characterization and detection. Considering denial of service (DoS) attacks, if we exclude exploit-based threats, which are often able to target specific software versions, we can distinguish between flooding-based DoS threats [3], which typically require the consideration of attack resources, and slow DoS attacks [4], which are characterized by the use of minimum amounts of attack resources. In the slow DoS context, although [4] exhaustively contributes to the description of the threat and the possible approaches that a malicious user could exploit, specific attacks of such kind have been introduced in the literature. To this aim, the authors of [5] designed attacks that are able to target specific communication protocols. By focusing on the attacking nodes, [6] considers slow DoS attacks executed from mobile devices, showing that it is actually feasible to perpetrate DoS attacks against a network service by using as little as a single mobile device. As far as behavioral monitoring is concerned, runtime monitoring systems are receiving increasing attention in various applications because they are considered an effective means for addressing or predicting behavioral patterns and properties using algorithms and analytics. Usually, runtime monitoring systems rely on an event-based data sent by the target environment's component, sensors, or subsystem when specific conditions occur. These kinds of systems can be used to improve the quality of service (QoS), prevent or reduce violations of properties, and provide recovery mechanisms in case of detected problems [7; 8] especially in dynamic environments where unpredictable events may occur. Usually, the runtime monitor includes a rule-based complex event processor [9] that collects and analyzes data during the execution according to the concept of observability [10]. Researchers have explored runtime monitoring in various domains, such as industrial automation, healthcare monitoring, and smart cities. Available proposals include monitoring based on logical or axiomatic approaches [11], monitoring focused on instrumentation algorithms for asynchronous components [12], monitoring relying on model-driven specification [13; 14] or based on an event-driven approach [9; 10]. In this context, machine learning (ML) plays an important role as it allows for identifying complex patterns faster than humans, especially with large datasets, making it valuable for detecting anomalies in behavioral monitoring [15]. Its application in environments requiring real-time, continuous, and reliable processing, such as the Internet of Things (IoT), has produced important and positive results [16]. Indeed, ML algorithms, through supervised and unsupervised learning, enable data analysis and predictions without explicit programming [17]. Despite its effectiveness in threat detection, enhancing the explainability of ML decisions, especially in IoT security, remains a critical area of ongoing research to make outcomes understandable at a human level [18]. Explainable AI (XAI), a specialized domain within machine learning (ML), focuses on refining the processes of training, learning, and representation to yield explanations that can be easily understood by humans [19]. Enhancing the transparency of a model's decision-making processes facilitates the validation of key attributes such as privacy, fairness, and trust [20]. Another relevant issue is the requirement to increase computing and data security and safety with acceptable performance loss. Most approaches involve making use of advanced abstract machines [21] in order to balance safety, security, and performance requirements. In particular, hardware virtualization allows multiple tenants to share resources with a higher degree of security and isolation than containerization [22].