Temporal network reliability in perturbed scenarios: Application to a SCADA system

Share Embed


Descrição do Produto

Temporal Network Reliability in Perturbed Scenarios: Application to a SCADA System Roberta Terruggia, University of Piemonte Orientale Andrea Bobbio, University of Piemonte Orientale Alessandro Bonaventura, University of Piemonte Orientale Ester Ciancamerla, ENEA-CR Casaccia Davide Lefevre, ENEA-CR Casaccia Michele Minichino, ENEA-CR Casaccia Key Words: Critical Infrastructures, Network reliability, SCADA, Electrical grid. SUMMARY & CONCLUSIONS The role of network reliability in the analysis of Critical Infrastructures (CI) is investigated showing that the traditional approach must be extended in two directions: to include the packet propagation time along the links for real time analysis, and to include networks in which many sources may be variously connected to many sinks. A case study of a SCADA system controlling a power grid, originated from the EU Project MICIE (MICIE- Tool for systemic risk analysis and secure mediation of data exchanged across linked CI information infrastructures) [6], is examined in details, by considering the system in normal operation and when perturbed by malicious attacks. The paper describes an analytical model that can provide timely and accurate information about the reliability status of the system, and that can rapidly be adapted to the changing configurations of the interacting networks. The aim of this work is to explore the feasibility of providing the human operators with a reliability monitor that assists them in checking the status of the system. 1 INTRODUCTION The role of Critical Infrastructures (CI) in human society has assumed an increasing relevance in the public debate and in the technical community. Rinaldi et al. [7] define CI as: the framework of interdependent networks and systems comprising identifiable industries, institutions, and distribution capabilities that provide a reliable flow of products and services essential to the defense and economic security. The key element in analyzing CIs is the evaluation of the level and quality of the delivered service combined with its reliability, availability, timeliness and continuity. Since CIs consist of interdependent networks, network analysis and network reliability provide the natural logical and mathematical background to tackle their study. However, the usual assumptions in network reliability [2] (edges and nodes are binary entities with an up and a down state, and edges and nodes are undifferentiated) do not cope with the complexity of

978-1-4577-1851-9/12/$26.00 ©2012 IEEE

CIs and should be extended in two directions: 1. the edges (and nodes) should be enriched with an attribute or weight characterizing their main function (e.g. capacity, bandwidth, resistance, cost, length), so that performance indices and Quality of Service (QoS) can be quantitatively computed [3]. In CIs, time is often a crucial aspect of QoS delivery and the network description is augmented with time specifications. 2. In real networks, nodes in which the service is generated are differentiated with respect to nodes in which the service is consumed. In such networks (like electrical grids, aqueducts or telecommunication networks), a producer (denoted as source) may feed many consumers (denoted as sinks) and a consumer may be fed by different producers. We refer to this problem as the multi-source multi-sink reliability problem [4]. An example of CI with the above characteristics is offered by a SCADA (Supervision, Control And Data Acquisition) system that controls a power grid through both a private and a public communication network. The reliability and timeliness of the SCADA affects the availability of the power grid and the QoS received by the customers. Furthermore, the redundancy in the SCADA operation and the multiplicity of power generators make it possible for any final user to receive power from a combination of generators and control centers, even in the case of appearance of a failure. The paper investigates a case study of interdependent critical systems originated in the framework of the MICIE EUProject [6]. The MICIE case study considers a SCADA system controlling a portion of an electrical grid through a private or a public telecom network and aims at providing the operator of the control room with the real time status of the service offered at the terminal users in normal condition or in perturbed conditions due to the onset of failures or cyber attacks. Simulation is the usual technique utilized in these cases; but to provide a prompt reaction to changing conditions an analytical model is preferred. This paper describes an analytical model, aimed at investigating the problem of the

reliability evaluation of probabilistic multi-source multi-sink networks where the source nodes are the redundant SCADA Control Centers (Main and/or Secondary Control Centers), while the sink nodes are represented by the RTUs (Remote Terminal Users), that are the points of conjunction between the SCADA network and the Power Grid. All the RTUs must be connected with at least one SCADA Control Center where operators remotely manage the Power Grid. Further, the reaction of the SCADA control centers must occur inside a given time threshold, in order to avoid the propagation of a malfunction into a catastrophic failure. To this end, the network reliability analysis must be combined with a temporal analysis, by associating to each network element its delay in forwarding the control packets. The temporal QoS is computed by means of the software program DNRA (Delay Network Reliability Analyzer) that is based on a technique described in [3] that uses an extended form of Binary Decision Diagrams [1]. The network description is augmented by assigning to each edge (and node) the delay that a control packet incurs in traversing the arc. To test the program the delays are evaluated by means of the NS2 simulator; however in a real application the delays can be measured directly on the network. The experiments are carried out in normal conditions and under malicious or random adverse events like a cyber attack of DoS (Denial of Service) type. To simulate a DoS attack, spurious packets are injected into the SCADA network to prevent the regular exchange of control packets from the SCADA to the RTUs. Furthermore, the portion of the power grid analyzed in the case study has two generating substations that can be configured to energize part of all the RTUs. Finally, the interdependencies of the SCADA reliability on the power grid reliability are evaluated. The paper describes in Section 2, the Delay Network Reliability Analyzer, derived from a previous work on weighted networks [3] and in Section 3 the multi-source multisink approach. The case study is introduced in Section 4, and, finally in Section 5 the results of the analysis are presented. 2 RELIABILITY ANALYSIS OF DELAY NETWORKS Delay networks can be considered as a particular aspect of the family of weighted networks [3] where the weight assigned to the network elements represents the delay that a message incurs in traversing the edge. With this specification, a probabilistic delay network can be defined as a graph G = (V, E, P, D) where V is the set of vertices, E the set of edges, P is the probability function and D is the delay function. We consider both directed and undirected arcs. The probability function P assigns a probability to the two exhaustive and mutually exclusive states (up and down) of each element of the graph. In this paper we assume that only edges can fail with statistically independent probabilities. The delay function D assigns a time delay to each edge of the network that represents the time incurred in traversing the edge. The delay is additive with respect to the paths, so that the time to reach a terminal node t from a source node s is the sum of the delays incurred in all the edges forming the path

connecting s with t. The s-t reliability problem in a delay network can be formulated as the probability that t receives messages from s within assigned real time bounds. The above defined s-t reliability of a delay network can be evaluated by representing the connectivity by means of a Multi-Terminal Binary Decision Diagram MTBDD (also called Algebraic Decision Diagram [1]) where the terminal leaves of the MTBDD are the values of the total delays summed over the edges traversed from the root of the MTBDD to the terminal leaf. In [3], the authors have introduced new logical/arithmetic operations to build up a MTBDD for a weighted network, from which the tool DNRA for the analysis of delay networks has been derived. 3 MULTI-SOURCE MULTI-SINK NETWORKS To take into account that the nodes of a CI must be differentiated according to their function, we consider multisource multi-sink networks, where a source is a node in which the service is generated and a sink is a node in which the service is consumed. The reliability problem can be defined, in very general terms, as the probability that a combination of sinks is fed by a combination of sources. Given a network G = (V, E, P, D), we denote by M ‫ ك‬V the subset of nodes of cardinality m = |M | that act as sources and we denote by W ‫ ك‬V the subset of nodes of cardinality w = |W| that act as sinks. We further assume that M and W are disjoint subsets. Given two positive integers ℓ ≤ m and z ≤ w, the general multi-source multi-sink reliability problem can be formulated as the probability that at least ℓ sources out of m (ℓ : m) are connected to at least z sinks out of w (z : w). We call this quantity the (ℓ:m)-source (z:w)-sink reliability. It is easy to show that the formulated problem encompasses all the traditional network reliability problems formulated in the literature [4]. The analysis algorithm proceeds along the following steps: 1. Enumeration of all the legal combinations of ℓ sources and z sinks that satisfy the specification of the (ℓ:m)source (z:w)- sink problem. 2. Construction of the BDD that represents the Boolean connectivity function that takes the value 1 when at least one combination of ℓ sources and z sinks (found at point i) is operating. 3. The final system reliability is evaluated from the BDD found at point 2), together with the enumeration of the complete list of minpaths and mincuts. In particular, the numerical results in Section V are obtained by exploiting the configurations (1:m) and (m:m) for the sources, combined with the configurations (1:w) and (w:w) for the sinks, where the symbols assume the following meaning: 1. (1:m) (1:w): at least one out of m sources is connected to at least one out of w sinks; 2. (m:m) (1:w): all the m sources are connected to at least one out of w sinks;

3. 4.

(1:m) (w:w): at least one out of m sources is connected to all the w sinks; (m:m) (w:w): all the m sources are connected to all the w sinks. 4 THE CASE STUDY

The main objective of a SCADA system controlling a Power distribution grid is to assist utility companies in supplying power to customers, according to Quality of Service (QoS) indicators established by a National Electrical Authority [8]. SCADA performs real time measurements and commands to control operations on the power grid by means of Remote Terminal Units (RTUs) that are connected throughout a dedicated or a public Telco network [5]. Figure 1 shows a simplified view of a portion of a Medium Voltage (MV) grid of the MICIE case study under consideration.

Figure 2 SCADA Network 5 RESULTS The numerical results, presented in this Section, are intended to show how analytical model of interacting SCADA and power grid can provide timely information to the operator in the control room about reliability and delays in normal condition and under various forms of attacks. 5.1 The SCADA Network

Figure 1 Power Network In normal operative conditions, customers are energized by two separated subgrids fed by substations TF and CB, respectively. Substation TF energizes 9 RTUs named from Z1 to Z9, while CB energizes 4 RTUs named from H1 to H4. To separate the two subgrids, switches in nodes Z4, Z7, Z9 and H4 are normally open (N.O. in Figure 1) but can be remotely closed by SCADA to allow either substations to feed all the RTUs. The layout of the SCADA system is depicted in Figure 2. It consists of a main control center WP and a backup unit WB that are connected by a private network to node MND from which the control lines to the RTUs depart, or through a redundant link via the public telco network (nodes Pop 4 and Lex 40) to node MDN that again connects all the RTUs. The points of connection between the SCADA of Figure 2 and the electrical grid of Figure 1 is represented by the RTUs Z1, . . . , Z9, H1, . . . , H4.

The data about the traffic of messages from the SCADA to the RTUs have been derived from [5]. Furthermore, it has been assumed that the availability of all the SCADA links is equal to p = 0.99, however measured or estimated values for the failure and repair rates can be easily accommodated. With the above data we have conducted two series of experiments: the first one, utilizing the multi-source multi-sink approach to evaluate the effectiveness of the SCADA redundant architecture, the second one utilizing DRNA to evaluated the SCADA reliability as a function of the reaction time in normal operation and under cyber attack Table I Reliability of the SCADA Network in Normal Operation Source Set WP WP WP WP‫ר‬WB WP‫ר‬WB WP‫ר‬WB WP‫ש‬WB WP‫ש‬WB WP‫ש‬WB

Sink set Z1 Z1‫ר‬.‫ר‬Z9‫ר‬H1‫ר‬.‫ר‬H4 Z1‫ש‬.‫ש‬Z9‫ש‬H1‫ש‬.‫ש‬H4 Z1 Z1‫ר‬.‫ר‬Z9‫ר‬H1‫ר‬.‫ר‬H4 Z1‫ש‬.‫ש‬Z9‫ש‬H1‫ש‬.‫ש‬H4 Z1 Z1‫ר‬.‫ר‬Z9‫ר‬H1‫ר‬.‫ר‬H4 Z1‫ש‬.‫ש‬Z9‫ש‬H1‫ש‬.‫ש‬H4

Reliability 0.98940 0.98495 0.98979 0.97951 0.97510 0.97990 0.99930 0.99480 0.99969

Min paths 11 114671 143 11 114671 143 22 229342 286

Min cuts 43 223 43 44 224 44 43 223 43

1) Multi-source multi-sink Network The main Control Center WP and the backup Control Center WB are connected to all the RTUs and are in active parallel redundancy, so that in case of failure of WP, WB is activated. We have analyzed

different scenarios for the connectivity of the control centers to the RTUs and the results are reported in Table I, to show that the operator can demand various and detailed pictures of the status of the network. The first two columns (Source and Sink sets) report the combination of sources and combination of sinks for which the reliability and the minpaths and mincuts are computed (3rd, 4th and 5th columns). For example, the first row reports the reliability of the point-to-point connection of WP with Z1. The second row the probability that WP is connected to all the RTUs and the third row the probability that WP is connected to at least one of the RTUs. Then, the data follow of the connectivity of both centers (WP^WB) to one, all or at least one RTU (4th, 5th and 6th row), and finally the reliability of the connectivity of at least one control center (WP _ WB ) to one, all or at least one RTU (7th, 8th and 9th row). The last row (at least one control center to at least one RTU) provides the most reliable connection. 2) Time analysis in normal operation: The data packets from Control Centers to the RTUs follow the connected path with the minimal delay. The alternative connection via the public Telco network (nodes Pop 4 and Lex 40) is utilized if all the redundant paths in the private network are down. An important QoS index is the probability that the control messages are received by the RTUs inside a preassigned time threshold. To this end, the transmission delay of each link of the network has been evaluated using the NS2 simulator. The system is monitored for a period of 3000 seconds, long enough to reach stable conditions. Table II Reliability vs. Transmission Time for the SCADA Network Source-Sink

WP-Z1

Transmission Time (sec) 0.63040 0.85873 1.08707 1.10695 1.33492 Not connected

given time threshold, all the probability values reported in the table, corresponding to times below the threshold must be summed. For instance, if we fix a threshold of 1 second, we get from Table II that the total probability that Z1 receives the control packets from WP in one second is equal to the sum of the first two rows: i.e. 0.95099 + 0.00950613 = 0.96049613. 3) The analysis under cyber attack: The time analysis is of particular importance when the operation of the network is perturbed by some external event that slows down the packet transmission. A typical perturbation of this kind is the Denial of Service (DoS) attack in which a malicious agent exploits the weakness of network protocols to flood a target node and exhaust its resources. In the following experiment, we have supposed that the attacker forces the system from node EthBus sending a continuous series of packets with increasing periodicity to target node Z1 (Figure 2). We have assumed three levels of periodicity, e.g. 0.5, 0.05, 0.005 sec and we have combined it with three possible values of the size of the buffer at the SCADA nodes (200, 500, 1000 KByte). Table III Effect of DOS Attack on the Connection of WP With Z1 and Z2 SourceSink

WP-Z1

WP-Z2

Reliability 0.95099 0.0095062 1.82703E-06 0.0288025 8.43297E-06 0.0105911

We use these delay values as weights assigned to the edges of the SCADA network, and the weighted SCADA network is then analyzed by means of the tool DNRA. The analysis combines the measures of the point-to-point reliability with the time that the control messages take to travel from the source to the destination, and also this information can be made available to the human operators. For the sake of illustration, Table II reports the DNRA results obtained by assuming WP as source and Z1 as sink. The first column reports the transmission time, of control messages emitted by WP and received by the RTU Z1, the second column the reliability of the connection. The last row, indicated as Not connected, gives the unreliability of the WPZ1 connection, i.e. the probability that all the paths between WP and Z1 are simultaneously down. If we want to evaluate the probability that Z1 receives the control messages within a

WP-Z1

WP-Z2

Buffer size (Kbytes)

Packet Period (sec) 0.5 sec

0.05 sec

0.005 sec

200 500 1000 200 500 1000

Transmission Time (sec) 1.158373 531.249993 ∞ 1.110754 576.078565 ∞ 1.134564 613.792851 ∞ 0.747064 70.717553 70.93422 0.747064 101.523803 78.76617 0.75748 152.569637 119.81755

200 500 1000 200 500 1000

Percentage of Control Packets 100% 4.075% 0% 100% 3.785% 0% 100% 7.055% 0% 100% 17.555% 1.923% 100% 12.216% 1.618% 100% 23.223% 1.618%

Results have been obtained by running the NS2 simulator and are reported in Table III. In the Table we have considered node WP as the source node emitting the control packets, and two destination nodes: Z1 (which is the target of the DoS attack), and a non target RTU Z2 (all non target RTUs behave in the same manner). For the 9 combinations of attack periodicities and buffer sizes we have reported in the first part of the table the Transmission Time between source and sink, and in the second part of the table the percentage of control packets arriving correctly to destination with an ACK back to the source. Table III shows that with a periodicity in the malicious packets of 0.005 sec the network is congested and node Z1 is isolated. The attack on Z1 affects also the operation of the other RTUs (like Z2) but with less dramatic effects. The final goal of the above simulative analysis is to obtain

for all the edges of the SCADA network the delays in the transmission of the control packets when a DoS attack is in action. With this information (that in real systems can be obtained by physical measures) the analysis of the weighted SCADA network by means of the tool DNRA provides the probability that the control messages are received by the RTUs inside a given time bound (as in Table II). 5.2 Power Grid The power grid of Figure 1 is separated in two subgrids (Section IV), by ”normally open (N.O.)” switches. Substation TF energizes 9 RTUs (Z1,..,Z9) and the corresponding users (loads in Figure 1), while Substation CB energizes 4 RTUs (H1,.., H4) and the corresponding users. When a fault occurs a Fault Isolation and System Restoration (FISR) service starts [5] that locates the fault and reconfigures the network by closing and opening switches so that the portion of the grid no more reachable by its own substation, can be reached by the alternative substation. The human operators need to know the probability that the RTUs are energized by the respective substations. In these experiments we suppose a probability of the links to be working of 0.99. Table IV Results for Power Grid in “NormallyY Open” Configuration Source set TF TF CB CB

Sink set

Reliability

Z9 Z1‫ר…ר‬Z9 H4 H1‫ר…ר‬H4

0.931880 0.877260 0.922745 0.922745

Min paths 2 3 1 1

Min Cuts 9 16 8 8

In Table IV we have analyzed the normal condition where the two subnetworks are energized separately, and we have computed the reliability of the connection of each substation to a single RTU or to all the RTUs of its own subgrid. The first column reports the source, the second column the set of sinks, while in the last three columns the reliability, the number of minpaths and the number of mincuts are reported. Notice that since the RTUs from H1 to H4 are connected in series the probability that the last node of the series H4 is energized, coincides with the probability that all the nodes are energized (3rd and 4th row in Table IV). When a fault occurs, the FISR service may be activated and the SCADA remotely closes all the “Normally open” switches so that either substations can energize all the RTUs. In the “closed network” situation the operator may want to know the reliability of different connections of the generators with the RTUs. Table V provides a set of cases by combining single substations with single RTUs pertaining to its subgrid or to the other subgrid, single substations with partitions of RTUs, and, finally, either substation with a single RTU or with partitions of RTUs.

Table V Results for Power Grid in “Closed Network” ConfigurationN Source Set TF TF TF TF CB CB CB CB TF ‫ש‬CB TF ‫ש‬CB TF ‫ש‬CB TF ‫ש‬CB TF ‫ש‬CB

Sink Set Z1 H4 Z1‫ר‬.‫ר‬Z9 Z1‫ר‬.‫ר‬Z9‫ר‬H1‫ר‬.‫ר‬H4 Z1 H4 H1‫ר‬.‫ר‬H4 Z1‫ר‬.‫ר‬Z9‫ר‬H1‫ר‬.‫ר‬H4 Z1 H4 H1‫ר‬.‫ר‬H4 Z1‫ר‬.‫ר‬Z9 Z1‫ר‬.‫ר‬Z9‫ר‬H1‫ר‬.‫ר‬H4

Reliability 0.97853 0.97882 0.96779 0.91991 0.94101 0.94073 0.94073 0.91991 0.99854 0.99855 0.95003 0.97699 0.92910

Min paths 16 16 150 270 3 3 3 270 19 19 31 360 540

Min cuts 44 35 72 85 17 26 26 85 310 388 54 81 85

Compare, for instance, the reliability of the point-to-point connection of a single substation with Z9 or of a single substation with H4, with the reliability value when the two substations are considered in parallel redundancy and either (TF ‫ ש‬CB) can feed Z9 or H4. Further, it is interesting to compare the probability that all the 9+4 RTUs are simultaneously energized, by a single substation or by either one of the two substations in parallel redundancy. Based on the above data, the operators may decide how to reconfigure the topology of the network. 5.3 SCADA and Power grid as interconnected networks In the previous two sections we have examined various reliability aspects of the SCADA and power grid separately. However, the two systems are interdependent since the correct operation of SCADA is mandatory for a correct operation of the power grid. Table VI Power Grid Influenced by SCADA:“Normally Open”

Source Set TF TF TF TF CB CB CB CB TF ‫ש‬CB TF ‫ש‬CB TF ‫ש‬CB TF ‫ש‬CB TF ‫ש‬CB

Sink Set Z1 H4 Z1‫ר‬.‫ר‬Z9 Z1‫ר‬.‫ר‬Z9‫ר‬H1‫ר‬.‫ר‬H4 Z1 H4 H1‫ר‬.‫ר‬H4 Z1‫ר‬.‫ר‬Z9‫ ר‬H1‫ר‬.‫ר‬H4 Z1 H4 H1‫ר‬.‫ר‬H4 Z1‫ר‬.‫ר‬Z9 Z1‫ר‬.‫ר‬Z9‫ר‬H1‫ר‬.‫ר‬H4

Reliability 0.96266 0.96325 0.92324 0.85963 0.92150 0.92112 0.92113 0.85963 0.99209 0.99223 0.93014 0.93188 0.86822

Min paths 16 16 150 270 3 3 3270 19 19 360 31 360 540

Min cuts 151 103 159 166 39 83 83 166 1929 2833 245 197 168

To this end, we can adjust the power grid analysis, reported in Section 5.2, by assigning to the RTUs the probability of correct operation resulting from the SCADA analysis of Section 5.1. In particular, if we assign to all the RTUs the reliability value of 0.9948 resulting from the second last line of Table I (at least one SCADA center is correctly connected to all the RTUs), the updated computations of the probability that the RTUs are energized for the same combinations of source/sink in the power grid in the “normally open” configuration are reported in Table IV and in the ”closed network” configuration in Table VII. With respect to traditional techniques, our approach allows the operators to quickly verify the reliability of the networks under various combinations of generators and final users, and help them in managing the correct network configuration. Table VII Power Grid Influenced by SCADA: “Closed Network” Source set TF TF CB CB

Sink set

Reliability

Z9 Z1‫ר…ר‬Z9 H4 H1‫ר…ר‬H4

0.91260 0.83705 0.90370 0.90370

Min paths 2 3 1 1

Min Cuts 19 32 17 17

ACKNOWLEDGMENTS This research was motivated and partially supported by the EU project MICIE (http://www.micie.eu). REFERENCES 1. 2. 3.

4.

5.

6.

R.I. Bahar, E.A. Frohm, and C.M. Gaona. Algebraic decision diagrams and their applications. Formal Methods in System Design, 10(2-3):293– 318, 1997. M.O. Ball. Computational complexity of network reliability analysis: An overview. IEEE Transactions on Reliability, R-35:230–239, 1986. A. Bobbio and R. Terruggia. Reliability and quality of service in weighted probabilistic networks using algebraic decision diagrams. In Proceedings IEEE Annual Reliability and Maintainability Symposium, pages 19–24, Fort Worth, TX, 2009. A. Bobbio, R. Terruggia, E. Ciancamerla, and M. Minichino. Reliability analysis of multi-source multi-sink critical interacting systems. In 3rd IFAC Workshop on Dependable Control of Discrete Systems (DCDS’11), pages 129–134, 2011. E. Ciancamerla, S. Di Blasi, C. Foglietta, D. Lefevre, M. Minichino, L. Lev, and Y. Shneck. QoS of a scada system versus QoS of a power distribution grid. In Proceedings10th International Probabilistic Safety Assessment & Management Conference, PSAM10, Seattle, WA, 2010. EU Project MICIE. Information Exchange Among Critical Infrastructures., (http://www.micie.eu), 2008-11.

7.

8.

S. Rinaldi, J. Peerenboom, and T. Kelly. Identify, understanding, and analyzing critical infrastructure interdependencies. IEEE Control System Magazine, Dec:11–25, 2001. UE-Energy Community Regulatory Board. http://www.ecrb.eu BIOGRAPHIES

Roberta Terruggia Department of Computer Science University of Piemonte Orientale V.le T. Michel 11 Alessandria, 15121, Italy e-mail:[email protected] Roberta Terruggia received the B.S. and M.S. degrees in Computer Science from the University of Piemonte Orientale in 2003 and 2006. She received Ph.D. degree of Computer Science from the University of Torino in 2010. Andrea Bobbio Department of Computer Science University of Piemonte Orientale V.le T. Michel 11 Alessandria, 15121, Italy e-mail: [email protected] Andrea Bobbio is full professor of computer science at the University of Piemonte Orientale Italy. His main research activities are devoted to the modeling and analysis of the performance and reliability of stochastic systems. Michele Minichino ENEA - CR Casaccia, Via Anguillarese 301, 00060 Roma,Italy e-mail: [email protected] Michele Minichino is coordinator of the Program for Critical Infrastructure Protection at ENEA. His main research interest is on methods, algorithms and tools for reliability, dependability and quality of service analysis. Ester Ciancamerla ENEA - CR Casaccia, Via Anguillarese 301,00060 Roma,Italy e-mail: [email protected] Ester Ciancamerla is researcher at ENEA. Her main research interest is on risk based methodologies, multi formalism and multi solution methods and tools for vulnerability and interdependency measures of networked systems. Alessandro Bonaventura Department of Computer Science University of Piemonte Orientale V.le T. Michel 11 Alessandria, 15121, Italy Alessandro Bonaventura is graduated in Computer Science from the University of Piemonte Orientale in 2011 Davide Lefevre

ENEA - CR Casaccia, Via Anguillarese 301, 00060 Roma,Italy

Davide Lefevre received his degree in Management and Automation Engineering from University of Roma Tre in 2009, discussing a thesis on “ Modelling a SCADA system of a power distribution grid”.

Lihat lebih banyak...

Comentários

Copyright © 2017 DADOSPDF Inc.