# A Methodological Approach to Securing Cyber-Physical Systems for Critical Infrastructures
## 4 Reference Architecture
### Target System Requirements  
The techniques, methodologies, and approaches introduced in Sections 2 and 3 apply to a broad class of TSs that are nevertheless required to implement some widely available technology. The main requirements that the TS shall satisfy for this purpose are listed in the following. In regard to the Advanced Secure Monitor (ASM) component, which allows for the simple but effective management of specific services and, as a consequence, potentially entire servers, some support is required in the underlying hardware. In fact, this would include one or more of the following:  
* (Open Source) Virtualization Technology aimed at supporting effective system and service isolation;
* (Well-Defined) Semantic introspection capabilities (i.e., the possibility of being able to understand the inner structure and workings of the components);
* (Restricted/Protected Access) Computing environments such as kernel-based (e.g., eBPF) or CPU-assisted ones (e.g., Enclaves/ringlevels). ASM instantiation can be potentially performed on most virtualization-capable TSs. The TS can be a network-exposed service where both the actual provided service and the monitoring system integrity could be protected by leveraging advanced Secure Transparent Virtualization capabilities. The ASM requires the TS to be able to perform multiple simultaneous activities (i.e., multithreading or multiprocessing architecture) in order to allow the ASM to iteratively evaluate service integrity over time. In order to allow the ASM to perform the intended purpose, the TS architecture has to provide full introspection to its internal components (e.g., by being fully open source or by providing specific APIs to do so). As such, the TS, provided that technological support is present, can also include automation scenarios with advanced hardware/software smart robot controllers. With regard to the behavioral monitoring of smart devices, the TS is expected to make use of TCP-oriented protocols to communicate and exchange information. In fact, the behavioral monitoring component can also be used to detect slow DoS attacks that typically exploit connection-oriented characteristics (e.g., timeouts). Figure 2: Packet processing diagram (PPD). The slow DoS detection approach imposes some requirements on the TS environment; in particular, it must be possible to perform the following:  
* Obtain raw network data captured either at the network or host level (i.e., in the form of PCAP packet capture files for offline analysis, or to access live raw PCAP data);
* Provide the possibility to generate legitimate traffic, as well as to perpetrate attacks on the network, for implementation and testing activities. As the methodology for identifying cyberattacks that we aim to design involves user behavior analytics, using AI methodologies to detect user behavior suggests the following:  
* It is possible to represent user actions as a series of sequential events. For example, these sequences can be mapped using characteristics extracted from deep/machine learning (D/ML) models by fitting them to the user's typical behavior since event sequence patterns present usual, accurate, and readable trends of the user behavior. * It is possible to make use of suitable classification approaches to distinguish between normal and unusual behavior to identify possible attacks through DL or XAI methodologies. The economics of cybersecurity effort/component aim to provide as much relevant and useful information as possible about risk assessment from an economic point of view that can help to make appropriate decisions and countermeasures. As such, there are no specific requirements imposed to the TS. Nevertheless, some ingredients are needed to perform such an evaluation. In particular, this includes the availability of suitable data concerning the frequency and the severity of attacks to assess the expected loss. Regarding the severity of attacks, the ideal condition should be to have data about financial losses.