SHADOWS OF HYBRIDITY: A SYSTEMATIC META-ANALYSIS OF THREAT MODELING TERMINOLOGY AND PRACTICES IN CRITICAL INFRASTRUCTURE PROTECTION

Cosmin PIELE, Marius CIOCA

Abstract


The word “hybrid” appears in various forms within critical infrastructure protection (CIP) literature, as it refers to two distinct concepts of adversarial hybrid threats that employ sequential attacks with strategic ambiguity and methodological hybrids that combine different modeling approaches. A systematic mapping study that applied the PRISMA guidelines to scan 909 Springer Nature Link records yielded 19 studies into CIP security modeling and simulation. Title analysis indicates that security-oriented “hybrid” applications occur in just 0.1% of instances, energy and smart grid applications account for 52.6%, and applications based on graph/network models and machine learning techniques occur frequently at 57.9% and 47.4%, respectively. The research data demonstrates that CIP research faces four major challenges due to (1) confusing duplicate conceptual definitions between different concepts, (2) unevenly prioritized industry-oriented research, (3) insufficient modeling of system responses, and (4) insufficient modeling of actual hybrid system behavior. The research community requires a standardized terminology in order to perform valid threat assessments and combinations in CIP studies.

Full Text:

PDF

References


Abraham, D., Erceylan, G., Gkioulos, V., Houmb, S. H., Towards enhanced cybersecurity in industrial control systems: a systematic review of context-based modeling, digital twins, and machine learning approaches, International Journal of Information Security, Springer, ISSN 1615-5262, Heidelberg, 2025.

Amin, S., Wollenberg, B., Toward a smart grid: Power delivery for the 21st century, IEEE Power & Energy Magazine, IEEE, ISSN 1540-7977, New York, 2005.

Banks, J., Carson, J. S., Nelson, B. L., Nicol, D. M., Discrete-event system simulation, Pearson, ISBN 978-0136062127, Upper Saddle River, 2010.

Bonagura, V., Foglietta, C., Panzieri, S., Rossi, M., Santini, R., Scannapieco, M., Franchina, L., Modeling and assessing the

impacts of cyber threats on interdependent critical infrastructures, Proceedings of the International Conference on Critical Infrastructure Protection XVII, Staggs, J., Shenoi, S. (Eds.), pp. 143–163, ISBN 978-3-031-49585-4, Washington, DC, July 2023, Springer, Cham.

Buczak, A. L., Guven, E., A survey of data mining and machine learning methods for cyber security intrusion detection, IEEE Communications Surveys & Tutorials, IEEE, ISSN 1553-877X, New York, 2016.

Cabuya-Padilla, D., Díaz-López, D., Martínez-Páez, J., Hernández, L., Castaneda-Marroquin, C., SERDUX-MARCIM: Maritime cyberattack simulation using dynamic modeling, compartmental models in epidemiology and agent-based modeling, International Journal of Information Security, Springer, ISSN 1615-5262, Heidelberg, 2025.

Cárdenas, A. A., Amin, S., Sastry, S., Secure control: Towards survivable cyber-physical systems, IEEE Design & Test of Computers, IEEE, ISSN 0740-7475, New York, 2008.

Directive (EU) 2016/1148 on security of network and information systems, Official Journal of the European Union, ISSN 1977-0677, Luxembourg, 2016.

Dunn Cavelty, M., Cyber-security and threat politics: US efforts to secure the information age, Routledge, ISBN 978-0415682684, London, 2008.

Eusgeld, I., Nan, C., Dietz, S., System-of-systems approach for critical infrastructure dependency analysis, International Journal of Disaster Risk Reduction, Elsevier, ISSN 2212-4209, Amsterdam, 2014.

ENISA, Threat landscape report, European Union Agency for Cybersecurity, ISBN 978-92-9204-358-3, Athens, 2022.

Grieves, M., Vickers, J., Digital twin: Mitigating unpredictable emergent behavior in complex systems, in: Kahlen, F.-J., Flumerfelt, S., Alves, A. (Eds.), Transdisciplinary perspectives on complex systems, Springer, ISBN 978-3319387137, Cham, 2017.

Haimes, Y. Y., Risk modeling, assessment, and management, Wiley-Interscience, ISBN 978-0470285157, Hoboken, 2009.

Higgins, J. P. T., Thomas, J., Chandler, J., et al., Cochrane handbook for systematic reviews of interventions, Wiley, ISBN 978-1119536628, Chichester, 2019.

Humayed, A., Lin, J., Li, F., Luo, B., Cyber-physical systems security—A survey, IEEE Internet of Things Journal, IEEE, ISSN 2327-4662, New York, 2017.

Johansson, J., Hassel, H., An approach for modelling interdependent infrastructures in the context of vulnerability analysis, Reliability Engineering & System Safety, Elsevier, ISSN 0951-8320, Oxford, 2010.

Keković, Z., Bačanin Džakula, N., Dabetić, M., Ninković, V., Gavrilović, M., Managing emerging risks in critical infrastructure— Thinking in Tetris, in: Building resilience in a dynamic critical infrastructure landscape, Springer, ISBN 978-3-032-04383-2, Cham, 2026.

Kshetri, N., Cybercrime and cybersecurity in the global South, Palgrave Macmillan, ISBN 978-1137354094, London, 2013.

Law, A. M., Simulation modeling and analysis, McGraw-Hill, ISBN 978-0073401324, New York, 2014.

Lewis, T. G., Critical infrastructure protection in homeland security, Wiley, ISBN 978-0470170774, Hoboken, 2006.

Macal, C. M., North, M. J., Agent-based modeling and simulation, Proceedings of the Winter Simulation Conference, IEEE, ISBN 978-1424451270, Austin, TX, December 2009, IEEE Press, Piscataway.

Martini, T., Boigk, M., Catal, F., Dietze, S., Gerold, M., Lukau, E., Monteforte, M., Neuhäuser, S., Peitzsch, S., Phung, W., Pfennigschmidt, S., Simon, M., Vetter, J. Z., Winter, N., Adams, G., Finger, J., Rosin, J., Digital twin representation of socio-technical systems through a distributed co-simulation approach for crisis management, Environment Systems and Decisions, Springer, ISSN 2194-5411, New York, 2025.

NATO Strategic Communications Centre of Excellence, Hybrid threats: a strategic communications perspective, NATO StratCom COE, ISBN 978-9934-564-15-7, Riga, 2019.

Ouyang, M., Dueñas-Osorio, L., Min, X., A three-stage resilience analysis framework for urban infrastructure systems, Structural Safety, Elsevier, ISSN 0167-4730, Oxford, 2012.

Page, M. J., McKenzie, J. E., Bossuyt, P. M., Boutron, I., Hoffmann, T. C., Mulrow, C. D., et al., The PRISMA 2020 statement: an updated guideline for reporting systematic reviews, British Medical Journal, BMJ Publishing Group, ISSN 0959-8138, London, 2021.

Pederson, P., Dudenhoeffer, D., Hartley, S., Permann, M., Critical infrastructure interdependency modeling: a survey of U.S. and international research, Idaho National Laboratory Report, INL/EXT-06-11464, Idaho Falls, 2006.

Petticrew, M., Roberts, H., Systematic reviews in the social sciences, Blackwell, ISBN 978-1405121101, Oxford, 2006.

Setola, R., Rosato, V., Kyriakides, E., Rome, E. (Eds.), Managing the complexity of critical infrastructures, Springer, ISBN 978-3642035204, Berlin, 2016.

Sterman, J. D., Business dynamics: systems thinking and modeling for a complex world, McGraw-Hill, ISBN 978-0072389159, Boston, 2000.

Ten, C.-W., Manimaran, G., Liu, C.-C., Cybersecurity for critical infrastructures: attack and defense modeling, IEEE Transactions on Systems, Man, and Cybernetics, IEEE, ISSN 1083-4419, New York, 2010.

Thurow, L., Example Not in Text (dummy removed) — [removed].

Tuegel, E. J., Ingraffea, A. R., Eason, T. G., Spottswood, S. M., Reengineering aircraft structural life prediction using a digital twin, International Journal of Aerospace Engineering, Hindawi, ISSN 1687-5966, Cairo, 2011.

Zharikova, M., Sherstjuk, V., Pickl, S., Hybrid attack modeling for critical energy infrastructure protection, in: Ekanayake, J. (Ed.), Handbook of smart energy systems, pp. 429–447, ISBN 978-3-030-97940-9, Springer, Cham, 2023.

Zhong, R., Zhao, Y., Cyber risk assessment and resilience modelling for interdependent critical infrastructure systems, Environment Systems and Decisions, Springer, Cham, 2025.


Refbacks

  • There are currently no refbacks.


JOURNAL INDEXED IN :