HAL is a multidisciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers. L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Telecommunication networks based on commonplace technologies (such as Ethernet) often constitute a vulnerable attack vector against modern Critical Infrastructures (CIs), particularly for Supervisory Control and Data Acquisition (SCADA) systems, which rely on them for monitoring and controlling physical components. This article presents a unique platform that encompasses a range of capabilities, from cyber attack detection to mitigation strategies, through interdependency and risk evaluation. The platform is made of two main components: a cyber attack detection subsystem and a risk assessment framework. Both blocks are innovative from a research point of view and they have been developed and customized to fit the CIs' features, that are completely different from telecommunication networks. This platform has been tested on a hybrid environment testbed, made of virtual and real components, within the scope of the EU FP7 CockpitCI and EU H2020 ATENA projects. The case study corresponds to a medium voltage power grid controlled by a SCADA control center, where the platform has been validated with optimal results in terms of detection capabilities and time response. Index Terms-cyber attack detection risk assessment, decision support systems, cyber-physical systems, supervisory control and data acquisition (SCADA) I. INTRODUCTION T HE concept of Critical Infrastructure has been changing over the past years. This notion, which was mainly related to the public sector during the 1980s [1], was redefined as a matter of national security [2] during the 1990s, and particularly after 9/11. This comes as no surprise, as CIs are the key assets, systems or networks of our lives; their partial destruction would have a negative effect on security, economy and public health. With time, the definition of CI has been extended to include other services. The concept of "lifeline system" was developed to evaluate large and geographically distributed networks, such as electric power, gas and liquid fuels, telecommunications, transportation, waste disposal and water supply. Thinking about CIs through the subset of lifelines helps clarify common

Critical infrastructures are vital complex systems for our lives. Electrical grids, gas pipelines, telecommunication networks and transportation roads are examples of those critical infrastructures. Furthermore, critical infrastructures are tightly interconnected one to another, and their interdependencies are more evident during adverse events, such as faults, natural disasters or cyber attacks. Making smart decisions is a hard task for operators. This paper wants to suggest a complete procedure for helping critical infrastructure operators in managing assets during adverse events. CISIApro simulator is an agentbased simulator able to evaluate the risk associated with the consequences of adverse events. The agent ability to produce resources is summarized into the concept of operative level. The output of CISIApro, related to the power infrastructure, is used as input of the unit commitment algorithm as an example of decision making algorithm. In this paper, the unit commitment includes network topology security constraints and a risk-based objective function. This process is validated by means of a reference scenario made of four interconnected infrastructures, within a regional area. Results are presented in order to understand how unit commitment can suggest different solutions based on different risk assessment