| 1. |
|
|
| 2. |
- Abbaneo, Chiara, et al.
(author)
-
UML based reverse engineering for the verification of railway control logics
- 2007
-
In: Proceedings of International Conference on Dependability of Computer Systems, DepCoS-RELCOMEX 2006. - : IEEE. - 0769525652 - 9780769525655 ; , s. 3-10
-
Conference paper (peer-reviewed)abstract
- The Unified Modeling Language (UML) is widely used as a high level object oriented specification language. In this paper we present a novel approach in which reverse engineering is performed using UML as the modelling language used to achieve a representation of the implemented system. The target is the core logic of a complex critical railway control system, which was written in an application specific legacy language. UML perfectly suited to represent the nature of the core logic, made up by concurrent and interacting processes, using a bottom-up approach and proper modeling rules. Each process, in fact, was strictly related to the management of a physically (resp. logically) well distinguished railway device (resp. functionality). The obtained model deeply facilitated the static analysis of the logic code, allowing for at a glance verification of correctness and compliance with higher-level specifications, and opened the way to refactoring and other formal analyses. © 2006 IEEE.
|
|
| 3. |
- Buemi, Francesco, et al.
(author)
-
Empty vehicle detection with video analytics
- 2013
-
In: Image Analysis and Processing – ICIAP 2013. ICIAP 2013. - Berlin, Heidelberg : Springer. - 9783642411830 - 9783642411847 ; , s. 731-739
-
Conference paper (peer-reviewed)abstract
- An important issue to be addressed in transit security, in particular for driverless metro, is the assurance that a vehicle is empty before it returns to the depot. Customer specifications in recent tenders require that an automatic empty vehicle detector is provided. That improves system security since it prevents voluntary (e.g. in case of thieves or graffiti makers) or involuntary (e.g. in case of drunk or unconscious people) access of unauthorized people to the depot and possibly to other restricted areas. Without automatic systems, a manual inspection of the vehicle should be performed, requiring considerable personnel effort and being prone to failure. To address the issue, we have developed a reliable empty vehicle detection system using video content analytics techniques and standard on-board cameras. The system can automatically check whether the vehicles have been cleared from passengers, thus supporting the security staff and central control operators in providing a higher level of security. © 2013 Springer-Verlag.
|
|
| 4. |
- Casola, Valentina, et al.
(author)
-
Freight train monitoring : A case-study for the pSHIELD project
- 2012
-
In: Proceedings - 6th International Conference on Innovative Mobile and Internet Services in Ubiquitous Computing, IMIS 2012. - : IEEE. - 9780769546841 ; , s. 597-602
-
Conference paper (peer-reviewed)abstract
- Embedded Systems (ES) are increasingly being used in critical applications, where Security, Privacy and Dependability (SPD) attributes are essential. The pSHIELD research project, funded in the framework of the European ARTEMIS program, introduces some innovative approaches to address SPD issues for ES. In this paper, after an introduction to the scope of the pSHIELD project, we describe a case study application to the monitoring of freight trains transporting hazardous materials. The application uses heterogeneous Wireless Sensor Networks (WSN) to measure environmental parameters like temperature, vibrations and transmit them to the security control center. The sensors are integrated by means of an appropriate middleware and data is elaborated by a specfically developed application. We report the architecture and the results achieved by testing the application and some of its relevant SPD functionalities, including data criptography, in a real railway environment. © 2012 IEEE.
|
|
| 5. |
- Casola, Valentina, et al.
(author)
-
Performance evaluation of video analytics for surveillance on-board trains
- 2013
-
In: Advanced Concepts for Intelligent Vision Systems. ACIVS 2013.. - Cham : Springer. - 9783319028941 - 9783319028958 ; , s. 414-425
-
Conference paper (peer-reviewed)abstract
- Real-time video-surveillance systems are nowadays widespread in several applications, including public transportation. In those applications, the use of automatic video content analytics (VCA) is being increasingly adopted to support human operators in control rooms. However, VCA is only effective when its performances are such to reduce the number of false positive alarms below acceptability thresholds while still detecting events of interest. In this paper, we report the results of the evaluation of a VCA system installed on a rail transit vehicle. With respect to fixed installations, on-board ones feature specific constraints on camera installation, obstacles, environment, etc. Several VCA performance evaluation metrics have been considered, both frame-based and object-based, computed by a tool developed in Matlab. We compared the results obtained using a commercial VCA system with the ones produced by an open-source one, showing the higher performance of the former in all test conditions. © 2013 Springer-Verlag.
|
|
| 6. |
- Flammini, Francesco, Senior Lecturer, 1978-, et al.
(author)
-
A multiformalism modular approach to ertms/etcs failure modeling
- 2014
-
In: International Journal of Reliability, Quality and Safety Engineering (IJRQSE). - : World Scientific. - 0218-5393. ; 21:1
-
Journal article (peer-reviewed)abstract
- European Railway Traffic Management System/European Train Control System (ERTMS/ETCS) is a recent standard aimed at improving performance, safety and inter-operability of modern railways. In order to be compliant to ERTMS/ETCS, a railway signalling system must meet strict nonfunctional requirements on system level failure modes. In this paper, a multiformalism model is employed to perform an availability analysis of an ERTMS/ETCS reference architecture at early phases of its development cycle. At this aim, a bottom-up analysis is performed from subsystem failure models (expressed by means of Generalized Stochastic Petri Nets, Fault Trees and Repairable Fault Trees) up to the overall system model. The modular approach, here used, allows to evaluate the influence of basic design parameters on the probability of system-level failure modes and demonstrates that system availability is within the bound required by the ERTMS/ETCS specification. The results show that the multiformalism modeling approach helps to cope with complexity, eases the verification of availability requirements and can be successfully applied to the analysis of complex critical systems. © 2014 World Scientific Publishing Company.
|
|
| 7. |
- Flammini, Francesco, Senior Lecturer, 1978-, et al.
(author)
-
A new modeling approach to the safety evaluation of N-modular redundant computer systems in presence of imperfect maintenance
- 2009
-
In: Reliability Engineering & System Safety. - : Elsevier BV. - 0951-8320 .- 1879-0836. ; 94:9, s. 1422-1432
-
Journal article (peer-reviewed)abstract
- A large number of safety-critical control systems are based on N-modular redundant architectures, using majority voters on the outputs of independent computation units. In order to assess the compliance of these architectures with international safety standards, the frequency of hazardous failures must be analyzed by developing and solving proper formal models. Furthermore, the impact of maintenance faults has to be considered, since imperfect maintenance may degrade the safety integrity level of the system. In this paper, we present both a failure model for voting architectures based on Bayesian networks and a maintenance model based on continuous time Markov chains, and we propose to combine them according to a compositional multiformalism modeling approach in order to analyze the impact of imperfect maintenance on the system safety. We also show how the proposed approach promotes the reuse and the interchange of models as well the interchange of solving tools. © 2009 Elsevier Ltd. All rights reserved.
|
|
| 8. |
- Flammini, Francesco, Senior Lecturer, 1978-, et al.
(author)
-
A study on multiformalism modeling of critical infrastructures
- 2009
-
In: Critical Information Infrastructure Security. CRITIS 2008. - Berlin, Heidelberg : Springer. - 3642035515 - 9783642035517 ; , s. 336-343
-
Conference paper (peer-reviewed)abstract
- This paper explores the possibility of using multiformalism techniques for critical infrastructure modeling and proposes a general scheme for intra and inter infrastructure models. Multiformalism approaches allow modelers to adapt the choice of formal languages to the nature, complexity and abstraction layer of the subsystems to be modeled. Another advantage is the possibility of reusing existing (and validated) dependability models and solvers. Complexity and heterogeneity are managed through modularity, and composition allows for representing structural or functional dependencies. © 2009 Springer Berlin Heidelberg.
|
|
| 9. |
- Flammini, Francesco, Senior Lecturer, 1978-, et al.
(author)
-
Augmenting surveillance system capabilities by exploiting event correlation and distributed attack detection
- 2011
-
In: Availability, Reliability and Security for Business, Enterprise and Health Information Systems. CD-ARES 2011. - Berlin, Heidelberg : International Federation for Information Processing. - 9783642232992 - 9783642233005 ; , s. 191-204
-
Conference paper (peer-reviewed)abstract
- In recent years, several innovative security technologies have been developed. However, many of the novel sensing technologies (e.g. video analytics) do not always feature a high level of reliability. Very often, they need to be precisely tuned to fit specific installations and provide acceptable results. Furthermore, in large installations the number of surveillance operators is low with respect to the number of sensing devices, and operators' tasks include facing critical events, possibly including strategic terrorist attacks. In such human-in-the-loop systems, ergonomics and usability issues need to be carefully addressed to increase system performance in terms of detection probability and low rate of false/nuisance alarms. This paper describes a multi-sensor event correlation approach for augmenting the capabilities of distributed surveillance systems. The aim is to provide advanced early warning, situation awareness and decision support features. The effectiveness of the framework is proved considering threat scenarios of public transportation systems.
|
|
| 10. |
- Flammini, Francesco, Senior Lecturer, 1978-, et al.
(author)
-
Automatic instantiation of abstract tests on specific configurations for large critical control systems
- 2009
-
In: Software testing, verification & reliability. - : Wiley. - 0960-0833 .- 1099-1689. ; 19:2, s. 91-110
-
Journal article (peer-reviewed)abstract
- Computer-based control systems have grown in size, complexity, distribution and criticality. In this paper a methodology is presented to perform an 'abstract testing' of such large control systems in an efficient way: an abstract test is specified directly from system functional requirements and has to be instantiated in more test runs to cover a specific configuration, comprising any number of control entities (sensors, actuators and logic processes). Such a process is usually performed by hand for each installation of the control system, requiring a considerable time effort and being an error-prone verification activity. To automate a safe passage from abstract tests, related to the so-called generic software application, to any specific installation, an algorithm is provided, starting from a reference architecture and a statebased behavioural model of the control software. The presented approach has been applied to a railway interlocking system, demonstrating its feasibility and effectiveness in several years of testing experience. Copyright © 2008 John Wiley & Sons, Ltd.
|
|
| 11. |
- Flammini, Francesco, Senior Lecturer, 1978-, et al.
(author)
-
Fuzzy decision fusion and multiformalism modelling in physical security monitoring
- 2016
-
In: Recent Advances in Computational Intelligence in Defense and Security. - Cham : Springer. - 9783319264486 - 9783319264509 ; , s. 71-100
-
Book chapter (peer-reviewed)abstract
- Modern smart-surveillance applications are based on an increasingly large number of heterogeneous sensors that greatly differ in size, cost and reliability. System complexity poses issues in its design, operation and maintenance since a large number of events needs to be managed by a limited number of operators. However, it is rather intuitive that redundancy and diversity of sensors may be advantageously leveraged to improve threat recognition and situation awareness. That can be achieved by adopting appropriate model-based decision-fusion approaches on sensor-generated events. In such a context, the challenges to be addressed are the optimal correlation of sensor events, taking into account all the sources of uncertainty, and how to measure situation recognition trustworthiness. The aim of this chapter is twofold: it deals with uncertainty by enriching existing model-based event recognition approaches with imperfect threat modelling and with the use of different formalisms improving detection performance. To that aim, fuzzy operators are defined using the probabilistic formalisms of Bayesian Networks and Generalized Stochastic Petri Nets. The main original contributions span from support physical security system design choices to the demonstration of a multiformalism approach for event correlation. The applicability of the approach is demonstrated on the case-study of a railway physical protection system.
|
|
| 12. |
- Flammini, Francesco, Senior Lecturer, 1978-, et al.
(author)
-
Improving the dependability of distributed surveillance systems using diverse redundant detectors
- 2015
-
In: Dependability Problems of Complex Information Systems. - Cham : Springer. - 9783319089638 - 9783319089645 ; , s. 35-53
-
Conference paper (peer-reviewed)abstract
- Sensor networks nowadays employed in critical monitoring and surveillance applications represent a relevant case of complex information infrastructures whose dependability needs to be carefully assessed. Detection models based on Event Trees provide a simple and effective mean to correlate events in Physical Security Information Management (PSIM) systems. However, as a deterministic modeling approach, Event Trees are not able to address uncertainties in practical applications, like: 1) imperfect threat modelling; 2) sensor false alarms. Regarding point (1), it is quite obvious that real-world threat scenarios can be very variable and it is nearly impossible to consider all the possible combinations of events characterizing a threat. Point (2) addresses the possibility of missed detections due to sensor faults and the positive/nuisance false alarms that any real sensor can generate. In this chapter we describe two techniques that can be adopted to deal with those uncertainties. The first technique is based on Event Tree heuristic distance metrics. It allows to generate warnings whenever a threat scenario is detected and it is similar to the ones in the knowledge base repository. The second technique allows to measure in real-time the estimated trustworthiness of event detection based on: a) sensors false alarm rates; b) uncertainties indices associated to correlation operators. We apply those techniques to case-studies of physical security for metro railways. © Springer International Publishing Switzerland 2015
|
|
| 13. |
- Flammini, Francesco, Senior Lecturer, 1978-, et al.
(author)
-
Model-driven V&V processes for computer based control systems : A unifying perspective
- 2012
-
In: Leveraging Applications of Formal Methods, Verification and Validation. Applications and Case Studies. ISoLA 2012. - Berlin, Heidelberg : Springer. - 9783642340314 ; , s. 190-204
-
Conference paper (peer-reviewed)abstract
- A recent trend in software engineering is to support the development process by providing flexible tool chains allowing for effective Model-Driven approaches. These solutions are very appealing in industrial settings since they enable the creation of development and verification processes, enhancing abstraction and reuse, and hence improving productivity. This paper addresses advantages and challenges in extending Model-Driven approaches to system engineering and specifically to verification and validation (V&V) of critical computer-based systems. Specifically, the paper highlights the needs for real-world industrial contexts and proposes the definition of a unifying Model-Driven process for V&V of functional and non-functional system properties. Some enabling techniques which aim at improving the reuse of Model-Driven artifacts are addressed to deal with process scalability and effectiveness. Two sample applications are described for ERTMS/ETCS signalling system in order to show the advantages of the approach: formal modeling for performance evaluation of message delivery between train and track controllers and test case generation for the verification of functional requirements of trains outdistancing. © 2012 Springer-Verlag.
|
|
| 14. |
|
|
| 15. |
|
|
| 16. |
- Flammini, Francesco, Senior Lecturer, 1978-, et al.
(author)
-
Optimisation of security system design by quantitative risk assessment and genetic algorithms
- 2011
-
In: International Journal of Risk Assessment and Management. - 1466-8297 .- 1741-5241. ; 15:2-3, s. 204-220
-
Journal article (peer-reviewed)abstract
- The design of physical security systems for critical infrastructures is a delicate task that requires a balance between the cost of protection mechanisms and their expected effect on risk mitigation. This paper presents an approach usable to support the design of security systems by automatically optimising some parameters, basing on external constraints (e.g., limited available budget) and using quantitative risk assessment. Risk assessment is performed using a software tool that implements a quantitative methodology. The methodology accounts for the attributes of threats (frequency, system vulnerability, expected consequences) and protection mechanisms (cost, effectiveness, coverage, etc.). The optimisation is performed by means of genetic algorithms with the objective of achieving the set of parameters that minimises the risk while fitting external budget constraints, hence maximising the return on investment. The paper also describes an example application of the approach to the design of physical security systems for metro railways.
|
|
| 17. |
- Flammini, Francesco, Senior Lecturer, 1978-, et al.
(author)
-
Petri net modelling of physical vulnerability
- 2013
-
In: Critical Information Infrastructure Security. CRITIS 2011. - Berlin, Heidelberg : Springer. - 9783642414756 ; , s. 128-139
-
Conference paper (peer-reviewed)abstract
- Several multi-disciplinary aspects need to be addressed in security risk evaluation, including the estimation of risk attributes. One of the most widespread definitions of security risk relates it to the attributes of: probability of occurrence (or rather "frequency") of threats, system vulnerability with respect to the threat (or rather "probability of success of the threat"), and expected consequences (or rather "damage"). In this paper we provide a straightforward generic model based on Stochastic Petri Nets which can be adopted for the quantitative evaluation of physical vulnerability. The model allows to evaluate besides effectiveness parameters (e.g. probability of sensing, assessment, neutralization, etc.) also efficiency related ones (e.g. time to sense, assess, neutralize, etc.). Some examples will be provided in order to show how the model can be used in real-world protection systems applications. © 2013 Springer-Verlag.
|
|
| 18. |
- Flammini, Francesco, Senior Lecturer, 1978-, et al.
(author)
-
Quantitative security risk assessment and management for railway transportation infrastructures
- 2009
-
In: Critical Information Infrastructure Security. CRITIS 2008. - Berlin, Heidelberg : Springer. - 3642035515 - 9783642035517 ; , s. 180-189
-
Conference paper (peer-reviewed)abstract
- Scientists have been long investigating procedures, models and tools for the risk analysis in several domains, from economics to computer networks. This paper presents a quantitative method and a tool for the security risk assessment and management specifically tailored to the context of railway transportation systems, which are exposed to threats ranging from vandalism to terrorism. The method is based on a reference mathematical model and it is supported by a specifically developed tool. The tool allows for the management of data, including attributes of attack scenarios and effectiveness of protection mechanisms, and the computation of results, including risk and cost/benefit indices. The main focus is on the design of physical protection systems, but the analysis can be extended to logical threats as well. The cost/benefit analysis allows for the evaluation of the return on investment, which is a nowadays important issue to be addressed by risk analysts. © 2009 Springer Berlin Heidelberg.
|
|
| 19. |
- Flammini, Francesco, Senior Lecturer, 1978-, et al.
(author)
-
Trustworthiness evaluation of multi-sensor situation recognition in transit surveillance scenarios
- 2013
-
In: Security Engineering and Intelligence Informatics. CD-ARES 2013. - Berlin, Heidelberg : Springer. - 9783642405877 ; , s. 442-456
-
Conference paper (peer-reviewed)abstract
- Physical Security Information Management (PSIM) systems are a recent introduction in the surveillance of critical infrastructures, like those used for mass-transit. In those systems, different sensors are integrated as separate event detection devices, each of them generating independent alarms. In order to lower the rate of false alarms and provide greater situation awareness for surveillance operators, we have developed a framework-namely DETECT-for correlating information coming from multiple heterogeneous sensors. DETECT uses detection models based on (extended) Event Trees in order to generate higher level warnings when a known threat scenario is being detected. In this paper we extend DETECT by adopting probabilistic models for the evaluation of threat detection trustworthiness on reference scenarios. The approach also allows for a quantitative evaluation of model sensitivity to sensor faults. The results of a case-study in the transit system domain demonstrate the increase of trust one could expect when using scenarios characterized in a probabilistic way for the threat detection instead of single-sensor alarms. Furthermore, we show how a model analysis can serve at design time to support decisions about the type and redundancy of detectors. © IFIP International Federation for Information Processing 2013.
|
|
| 20. |
- Flammini, Francesco, Senior Lecturer, 1978-, et al.
(author)
-
Using Bayesian Networks to evaluate the trustworthiness of '2 out of 3' decision fusion mechanisms in multi-sensor applications
- 2015
-
In: IFAC-PapersOnLine. - : Elsevier BV. - 2405-8963. ; , s. 682-687
-
Conference paper (peer-reviewed)abstract
- The use of smart-sensors to recognize automatically complex situations (anomalous behaviors, physical security threats, etc.) requires 'intelligent' methods to improve the trustworthiness of automatic decisions. Voting and consensus mechanisms can be employed whether supported by probabilistic formalisms to correlate event occurrence, to merge local events and to estimate the likelihood of overall decisions. This paper presents the results of a quantitative comparison of three different voting schemes based on Bayesian Networks. These models present a growing complexity and they are able to provide a trustworthiness estimation based on single nodes detection reliability in terms of false alarm probabilities. © 2015, IFAC (International Federation of Automatic Control) Hosting by Elsevier Ltd. All rights reserved.
|
|
| 21. |
- Flammini, Francesco, Senior Lecturer, 1978-, et al.
(author)
-
Using repairable fault trees for the evaluation of design choices for critical repairable systems
- 2005
-
In: Proceedings of IEEE International Symposium on High Assurance Systems Engineering. - : IEEE. - 0769523773 - 9780769523774 ; , s. 163-172
-
Conference paper (peer-reviewed)abstract
- Critical repairable systems are characterized by complex architecture and requirements. The evaluation of benefits produced by repair policies on the overall system availability is not straightforward, as policies can be very articulated and different. In order to support this evaluation process, the Repairable Fault Tree (RFT) formalism revealed to be useful and suitable to represent complex repair policies by extending the existing Fault Tree formalism. In this paper we show how to exploit RFT advantages by evaluating the effects of different repair policies on the availability of the most critical component of ERTMS/ETCS (an European railway standard) systems: the Radio Block Centre (RBC).
|
|
| 22. |
- Flammini, Francesco, Senior Lecturer, 1978-, et al.
(author)
-
Wireless sensor data fusion for critical infrastructure security
- 2009
-
In: Proceedings of the International Workshop on Computational Intelligence in Security for Information Systems CISIS’08.. - Berlin, Heidelberg : Springer. - 9783540881803 ; , s. 92-99
-
Conference paper (peer-reviewed)abstract
- Wireless Sensor Networks (WSN) are being investigated by the research community for resilient distributed monitoring. Multiple sensor data fusion has proven as a valid technique to improve detection effectiveness and reliability. In this paper we propose a theoretical framework for correlating events detected by WSN in the context of critical infrastructure protection. The aim is to develop a decision support and early warning system used to effectively face security threats by exploiting the advantages of WSN. The research addresses two relevant issues: the development of a middleware for the integration of heterogeneous WSN (SeNsIM, Sensor Networks Integration and Management) and the design of a model-based event correlation engine for the early detection of security threats (DETECT, DEcision Triggering Event Composer & Tracker). The paper proposes an overall system architecture for the integration of the SeNsIM and DETECT frameworks and provides example scenarios in which the system features can be exploited. © 2009 Springer-Verlag Berlin Heidelberg.
|
|
| 23. |
- Marrone, Stefano, et al.
(author)
-
Towards Model-Driven V&V assessment of railway control systems
- 2014
-
In: International Journal on Software Tools for Technology Transfer. - : Springer. - 1433-2779 .- 1433-2787. ; 16:6, s. 669-683
-
Journal article (peer-reviewed)abstract
- Verification and Validation (V&V) activities aiming at certifying railway controllers are among the most critical and time-consuming in system development life cycle. As such, they would greatly benefit from novel approaches enabling both automation and traceability for assessment purposes. While several formal and Model-Based approaches have been proposed in the scientific literature, some of which are successfully employed in industrial settings, we are still far from an integrated and unified methodology which allows guiding design choices, minimizing the chances of failures/non-compliances, and considerably reducing the overall assessment effort. To address these issues, this paper describes a Model-Driven Engineering approach which is very promising to tackle the aforementioned challenges. In fact, the usage of appropriate Unified Modeling Language profiles featuring system analysis and test case specification capabilities, together with tool chains for model transformations and analysis, seems a viable way to allow end-users to concentrate on high-level holistic models and specification of non-functional requirements (i.e., dependability) and support the automation of the V&V process. We show, through a case study belonging to the railway signalling domain, how the approach is effective in supporting activities like system testing and availability evaluation. © 2014, Springer-Verlag Berlin Heidelberg.
|
|
