Mohamed Kaaniche

Paolo Lollini

Andrea Bondavalli

Karama Kanoun

Modeling the Resilience of Large and Evolving Systems

Keywords: dependability, ubiquitous systems, stochastic modeling, evaluation

This paper summarizes the state of knowledge and ongoing research on methods and techniques for resilience evaluation, taking into account the resiliencescaling challenges and properties related to the ubiquitous computerized systems. We mainly focus on quantitative evaluation approaches and, in particular, on model-based evaluation techniques that are commonly used to evaluate and compare, from the dependability point of view, different architecture alternatives at the design stage. We outline some of the main modeling techniques aiming at mastering the largeness of analytical dependability models at the construction level. Actually, addressing the model largeness problem is important with respect to the investigation of the scalability of current techniques to meet the complexity challenges of ubiquitous systems. Finally we present two case studies in which some of the presented techniques are applied for modeling web services and General Packet Radio Service (GPRS) mobile telephone networks, as prominent examples of large and evolving systems.

Introduction

The main objectives of dependability and resilience evaluation activities are to support design decision-making and to assess the level of confidence that can be placed on the target systems with respect to their ability to fulfill their missions at the desired dependability and security level. Resilience evaluation can be qualitative or quantitative, and the evaluation techniques can be based on analytical modeling, simulation, experimental evaluation or judgments. Models can be used at the early development stages to describe various alternative architectures of the system at different abstraction levels, and to analyze the impact on the system behavior of different threat assumptions, error detection and recovery strategies, maintenance policies, etc.

This paper addresses model-based dependability evaluation approaches focusing on the techniques proposed in the literature for mastering models largeness and complexity. To master complexity when evaluating system dependability, a modeling methodology is needed so that only the relevant system aspects need to be detailed, allowing numerical results to be effectively computable. The complexity of models depends on the dependability measures to be evaluated, the modeling level of detail, and the stochastic dependencies among the components. State-space models, in particular homogeneous Markov chains, are commonly used for dependability modeling of computing systems. They are able to capture various functional and stochastic dependencies among components and allow evaluation of various measures related to dependability and performance (i.e., performability measures) based on the same model, when a reward structure is associated to them. Unfortunately not all the existing systems and their features can be captured properly by Markov processes; in some cases more general processes (e.g., semi-Markov, Markov Regenerative or even more non-Markovian processes) must be used. When dealing with such processes, complex and costly analytical solution techniques may exist, and otherwise simulation is the approach used to solve the models thus providing only estimates of the measures of interest. As an alternative one can approximate an underlying non-Markovian process with a Markov one, and thus represent a non-exponential transition with an appropriate set of exponential ones (Phased-Type approach). The price to pay following this approach is a significant increase in size, in terms of number of states of the resulting model.

Significant progress has been made in addressing the challenges raised by the large size of models, at the model construction and model solution levels, using a combination of techniques that can be categorized with respect to their purpose (largeness avoidance, largeness tolerance). Largeness avoidance techniques try to reduce the size of the models using many different approaches. Largeness tolerance techniques try to optimize the generation and processing of the models through the use of a) systematic rules to support the elaboration of the models and b) space and time efficient algorithms to optimize the state space generation, storage and exploration. It is important to note that these categories of techniques are complementary and both are needed, at the model construction and model solution levels, when detailed and large dependability models need to be generated and processed to evaluate metrics characterizing the resilience of real life systems.

In this paper we focus on the modeling approaches aimed at mastering complexity at the model construction level. We present in Section 2 two classes of structured techniques for a modular model construction. Two examples of case studies are presented in Section 3: the first one addresses the modeling of web based services and systems, and the second one deals with the assessment of a mobile telephone system. Finally, Section 4 concludes the paper and discusses some research gaps and directions that still need to be investigated to address the challenges raised by large and evolving ubiquitous systems.

Model construction techniques

This section presents two complementary techniques that can be applied in the model construction phase to cope with model largeness, grouping them in composition approaches (Section 2.1) and decomposition/aggregation approaches (Section 2.2). We focus on analytical models using Markov chains, stochastic Petri nets and their extensions.

Composition approaches

This class groups those techniques that build the system model as a modular composition of simpler sub-models that are then solved as a whole. Most of the works belonging to this class define the rules to be used to construct and interconnect the sub-models. They provide an easy way to describe the behavior of systems having a high degree of dependency between subcomponents. These dependencies can be exploited to manage the model complexity creating, for example, smaller, equivalent representations. In the following, we firstly outline briefly some general composition approaches based on Stochastic Petri nets and their extensions. Then we focus on specific studies dedicated to the dependability modeling and evaluation of complex real-life systems.

Basic approaches based on Stochastic Petri nets and their extensions

Research on process algebra [START_REF] Milner | Communication and Concurrency[END_REF] has inspired efforts to introduce compositionality into Petri nets. Composition of Petri Net (PN) consists in constructing PN models from a set of building blocks by applying suitable operators of places and/or transition superposition. Initially investigated for no timed models, composition approaches have been then explored for stochastic extensions of Petri nets. For example, [START_REF] Buchholz | A Notion of Equivalence for Stochastic Petri Nets[END_REF] explored composition in the context of Stochastic Petri Nets (SPNs) and [START_REF] Donatelli | The PSR methodology: integrating hardware and software models[END_REF] proposed a systematic compositional approach to the construction of parallel hardware-software models using Generalized Stochastic Petri Nets (GSPNs). The GSPN composition rules are based on the concept of matching labels associated with transitions and places of a GSPN, and the superposition of transitions (places) with matching labels, each one belonging to a different GSPN.

Composition operators have been defined in [START_REF] Rojas | Compositional Construction of SWN Models[END_REF][START_REF] Ballarini | Parametric Stochastic Well-Formed Nets and Compositional Modelling[END_REF] for the generation of Stochastic Well-formed Nets (SWN) (i.e., GSPNs permitting the identification of symmetry by means of a symmetric reachability graph) from its components. These operators preserve the functional structure of the model and support several types of communication between components. This approach is intended to support the modeling of distributed and parallel systems where both synchronous and asynchronous communications are required. However, it addresses only the class of systems that can be modeled by SWN.

Another example of composition operators is used in the context of Stochastic Activity Networks (SAN). In [START_REF] Meyer | Specification and Construction of Performability Models[END_REF], two composition operators are defined (Join and Replicate) to compose system models based on SANs. The Join operator takes as input a set of sub-models and some shared places belonging to different sub-models, and provides as output a new model that comprehends all the joined sub-models elements (places, arcs, activities) but with the shared places merged in a unique one. The Replicate operator combines multiple identical copies of a sub-model, which are called replicas, sharing some selected places. [START_REF] Obal | Measure-Adaptive State-Space Construction Methods[END_REF] introduces a graph composition approach that extends the replicate/join formalism and also combines models by sharing a portion of the state of each sub-model, reducing the total state-space size. Contrarily to the join/replicate formalism that requires the use of a special operation, the graph composition detects all the symmetries exposed at the composition level and uses them to reduce the underlying state space.

Compositional approaches with dependencies modeling

The composition techniques discussed in subsection 2.1.1 are very helpful to cope with the models complexity, in particular when the models exhibit symmetries. However, they are not sufficient in particular when the modeled systems exhibit various dependencies that need to be explicitly described in the dependability models. These dependencies may result from functional or structural interactions between the components or from interactions due to global system fault tolerance, reconfiguration and maintenance strategies. Various modeling approaches have been proposed to facilitate the construction of large dependability models taking into account such dependencies. Examples of such modeling approaches are briefly discussed in the sequel.

The block modeling approach defined in [START_REF] Kanoun | Fault-Tolerant System Dependability -Explicit Modeling of Hardware and Software Component-Interactions[END_REF] provides a generic framework for the dependability modeling of hardware and software fault-tolerant systems based on GSPNs. The proposed approach is modular: generic GSPN submodels called block nets are defined to describe the behavior of the system components and of the interactions between them. The system model is obtained by composition of these GSPNs. Composition rules are defined and formalized through the identification of the interfaces between the component and interaction block nets. In addition to modularity, the formalism brings flexibility and re-usability thereby allowing for easy sensitivity analyses with respect to the assumptions that could be made about the behavior of the components and the resulting interactions. The main advantage of this approach lies in its efficiency for modeling several alternatives for the same system as illustrated for example in [START_REF] Kanoun | Modeling the Dependability of CAUTRA, a Subset of the French Air Traffic Control System[END_REF].

The efficiency of the block modeling approach can be further improved by using an incremental and iterative approach for the construction and validation of the models as suggested in [START_REF] Fota | Incremental Approach for Building Stochastic Petri Nets for Dependability Modeling[END_REF]. At the initial iteration, the behavior of the system is described taking into account the failures and recovery actions of only one selected component, assuming that the others are in an operational nominal state. Dependencies between components are taken into account progressively at the following iterations. At each iteration a new component is added and the GSPN model is updated by taking into account the impact of the additional assumptions on the behavior of the components that have been already included in the model. Similarly to the block modeling approach, sub-models are defined for describing the components behaviors and specific rules and guidelines are defined for interconnecting the submodels. This approach has been successfully used to model the dependability of the f the French air traffic control computing system [START_REF] Fota | Dependability Evaluation of an Air Traffic Control Computing System[END_REF].

An iterative dependability modeling approach has been also proposed in [START_REF] Betous-Almeida | Construction and Stepwise Refinement of Dependability Models[END_REF] where the construction and validation of the GSPN dependability model is carried out progressively following the system development refinement process, to facilitate the integration of dependability modeling activities in the system engineering process. Three main steps are distinguished. The first step is dedicated to the construction of a functionallevel model describing the system functions, their states and their interdependencies. In the second step, the functional level model is transformed into a high-level dependability model based on the knowledge of the system's structure. A model is generated for each pre-selected candidate architecture. The third step is dedicated to the refinement of the high-level dependability model into a detailed dependability model for each selected architecture. Formal rules are defined to make the successive model transformations and refinements as systematic as possible taking into account three complementary aspects: i) component decomposition, ii) state/event fine-tuning, and iii) stochastic distribution adjustments. This approach allows the integration of various dependencies at the right level of abstraction: functional dependency, structural dependency and those induced by non-exponential distributions. A case study is described in [START_REF] Betous-Almeida | Dependability modelling of Intsrumentation and Control Systems: A Comparison of Competing Architectures[END_REF].

Actually, the approach presented in [START_REF] Betous-Almeida | Construction and Stepwise Refinement of Dependability Models[END_REF] can be seen as a special case of the more general class of techniques based on layered and multi-level modeling methods, where the modeled system is structured into different levels corresponding to different abstraction layers, with a model associated to each level. Various techniques based on this idea have been developed, see e.g., [START_REF] Donatelli | The PSR methodology: integrating hardware and software models[END_REF][START_REF] Kaâniche | Multi-level modelling approach for the availability assessment of e-business applications[END_REF][START_REF] Bernardi | Building Petri Net Scenarios for Dependable Automation Systems[END_REF][START_REF] Bernardi | Building Stochastic Petri Net models for the Verification of Complex Software Systems[END_REF][START_REF] Rabah | Performability evaluation of multipurpose multiprocessor systems: the "separation of concerns" approach[END_REF][START_REF] Bondavalli | Hierarchical Modelling of Complex Control Systems: Dependability Analysis of a Railway Interlocking[END_REF][START_REF] Lollini | A modeling methodology for hierarchical control systems and its application[END_REF][START_REF] Nelli | Dependability Modelling and Analysis of Complex Control Systems: an Application to Railway Interlocking[END_REF][START_REF] Dai | A Hierarchical Modeling and Analysis for Grid Service Reliability[END_REF]. As an example, we can mention the multilevel modeling approach proposed in [START_REF] Kaâniche | Multi-level modelling approach for the availability assessment of e-business applications[END_REF] for evaluating the user perceived availability of webbased applications that is discussed in Section 3.1.

Generally, multilevel modeling approaches rely on the hierarchical composition and solution of the submodels corresponding to the different abstraction levels. Different techniques can be used to describe the submodels and to combine their results (combinatorial models, state-based models). The selection of the right technique depends on the kind of dependencies between the elements of the corresponding submodels and on the quantitative measures to be evaluated. It is noteworthy that hierarchical modeling approaches combining different types of models can be supported by automatic tools, e.g., SHARPE [START_REF] Sahner | Reliability modeling using SHARPE[END_REF][START_REF] Sahner | Performance and Reliability Analysis of Computer Systems: An Example-based Approach Using the SHARPE Software Package[END_REF], Draw-Net [START_REF] Gribaudo | Draw-Net, a customizable multi-formalism multi-solution tool for the quantitative evaluation of systems[END_REF]. These approaches belong to the more general class of model decomposition and aggregation approaches presented in Section 2.2.

Decomposition and aggregation approaches

The modeling approaches discussed in this section belong to largeness avoidance techniques that try to circumvent the generation of large models using model decomposition and aggregation of the partial results. The basic idea is the following: the overall model is decoupled into simpler and more tractable sub-models, and the measures obtained from the solution of the sub-models are then aggregated to compute those concerning the overall model. The decomposition and aggregation techniques depend on the type of measures to be evaluated (steady-state or transient) and on the modeling formalism. Generally approximate solutions are provided for the composition of the results derived from the submodels. In the following, we present different examples of decomposition/aggregation approaches proposed in the literature.

A decomposition and aggregation theory for steady state analysis of general continuous time Markov Chains has been proposed in [START_REF] Courtois | Decomposability -Queueing and Computer System Applications[END_REF]. The quality of the approximation is related to the degree of coupling between the blocks into which the Markov chain matrix is decomposed. In [START_REF] Bobbio | An Aggregation Technique for the Transient Analysis of Stiff Markov Chains[END_REF] the authors present an extension of this technique specifically addressed to the transient analysis of large stiff Markov chains, where stiffness is caused by the simultaneous presence of "fast" and "slow" rates in the transition rate matrix.

Time-scale based decomposition approaches have been applied to Non-Markovian stochastic systems in [START_REF] Haddad | Approximate Analysis of Non-Markovian Stochastic Systems with Multiple Time Scale Delays[END_REF], and to GSPN models of systems containing activities whose durations differ by several orders of magnitude in [START_REF] Ammar | Time scale decomposition of a class of generalized stochastic Petri net models[END_REF]. For example, in [START_REF] Ammar | Time scale decomposition of a class of generalized stochastic Petri net models[END_REF] the GSPN model is decomposed into a hierarchical sequence of aggregated sub-nets each of which is characterized by a certain time scale. Then these smaller sub-nets are solved in isolation, and their solutions are combined to get the solution of the whole system. The aggregation at each level is done by assuming that the transitions included in the lower level are immediate transitions. At each level of the hierarchy, the current marking of an aggregated sub-net determines the number of tokens in the sub-net at the lower level, which are then analyzed to determine the rate of transitions in the aggregated sub-net.

Another interesting extension of the decomposability theory presented in [START_REF] Courtois | Decomposability -Queueing and Computer System Applications[END_REF] is the decomposition approach for the solution of large stochastic reward net models proposed in [START_REF] Ciardo | Decomposition Approach to Stochastic Reward Net Models[END_REF]. The overall model consists of a set of submodels whose interactions are described by an import graph: each node of the graph corresponds to a parameterized stochastic reward net submodel and an arc from submodel A to submodel B corresponds to a parameter value that B must receive from A. It is shown that three quantities are sufficient for intercommunication between the defined subnets: the probability that a subnet is in a state satisfying a given condition, the average time a given condition remains satisfied, and the expected time until the subnet satisfies a given condition.

The decomposition approach in [START_REF] Daly | A connection formalism for the solution of large and stiff models[END_REF] is based on a new set of connection formalisms that reduce the state-space size and solution time by identifying submodels that are not affected by the rest of the model, and solving them separately. The result from each solved submodel is then used in the solution of the rest of the model. The authors develop four abstractions that can be used to make connection models, and they involve passing a continuous-time random process, a discrete-time random process, a random variable, and an average value between the models. When these abstractions are applied, each submodel should have a smaller state space and fewer time scales than the complete model.

Decomposition approaches are also relevant for the modeling of multiple-phased systems having different operational phases and regimes with different configurations, behaviors, and dependability characteristics. In the literature, several approaches have been proposed for the analytical dependability modeling of Phased Mission Systems (PMS), all based on a hierarchical structure of the models [START_REF] Dugan | Automated Analysis of Phase-Mission Reliability[END_REF][START_REF] Alam | Quantitative Reliability Evaluation of Repairable Phased-Mission Systems using Markov Approach[END_REF][START_REF] Somani | Phased-mission System Analysis using Boolean Algebraic Methods[END_REF]. PMS are characterized by a sequence of phases in which the system configuration can change during operations. The existence of phases is a consequence of: i) diverse tasks to be performed, and ii) diverse environmental conditions, in different periods of system lifetime.

In [START_REF] Mura | Dependability Modelling and Evaluation of Phased Mission Systems: a DSPN Approach[END_REF], the model of a PMS is seen as composed of two logically separate Petri nets: the System Net, representing the system (its components, their interactions and their failure/repair behavior) as a GSPN, and the Phase Net, a deterministic and Stochastic Petri Net, representing the control part and describing the phase changes. In the System Net, a single model is built for the whole mission, characterized by a set of phases without detailing the behavior of the system inside each phase. This allows easy modeling of a variety of mission scenarios by sequencing the phases in appropriate ways. The parameter values to be used in the System Net model are obtained by solving the Phase Net models. This approach has been generalized in [START_REF] Mura | Markov Regenerative Stochastic Petri Nets to Model and Evaluate the Dependability of Phased Missions[END_REF] based on Markov Regenerative Stochastic Petri Nets. The key point is that the state space of the Markov regenerative process is never generated and handled as a whole, but rather the various subordinate intra-phase processes are separately generated and solved. As a consequence, the computational complexity of the analytical solution is reduced to the one needed for the separate solution of the different phases, as demonstrated in [START_REF] Bondavalli | Modeling and Analysis of a Scheduled Maintenance System: a DSPN Approach[END_REF].

In [START_REF] Lollini | On the modelling and solution of complex systems: from two domainspecific case-studies towards the definition of a more general framework[END_REF], the authors proposed a decomposition and aggregation approach that operates at the system-level, rather than the model-level. Using this approach, entities (or subsystems) are created that can work in isolation or can interact with each other through a set of dependency relations. The relations state how the behavior of each entity affects the others. The structure, together with the notion of a phased mission, allows one to solve each submodel in isolation, and then pass results between submodels as needed. Such formulation is not domain-specific and it reduces the complexity of solving models that can be expressed in this framework. This generic decomposition/aggregation approach has been applied to study a GPRS mobile telephone infrastructure that takes into account the congestion due to service outages and its subsequent impact on user-perceived quality of service. More details about this case study are presented in Section 3.2.

Case studies

This section summarizes the results of two case studies illustrating some of the methodologies and modeling approaches discussed in the previous section. The first example concerns the dependability modeling of web-based systems and services and the second example is related to the QoS analysis of mobile telephone systems.

Dependability modeling of web-based systems and services

Growing usage of applications on the Internet make the issue of assessing the dependability of the delivered services as perceived by the users increasingly important. The Internet is often used for money critical applications such as online banking, stock trading, reservation processing and shopping, where the temporary interruption of service could have unacceptable consequences on the e-business. Thus, it is important for ebusiness service providers and developers to analyze during the architecture design phase how hardware, software and performance related failures of the infrastructure supporting the delivered services might affect the quality of service perceived by the users.

Quantitative measures characterizing user-perceived availability for web-based applications are widely recognized as highly important to evaluate the impact of failures from the business point of view. However, there is still a lack of modeling frameworks and examples illustrating how to address this issue. Indeed a significant body of work has focused on various aspects of web performance evaluation. Although many efforts have been dedicated to analyze the availability of web hosts using measurement-based techniques [START_REF] Kalyanakrishnan | Reliability of Internet Hosts: a Case Study from the End User's Perspective[END_REF][START_REF] Oppenheimer | Architecture and Dependability of Large-Scale Internet Services[END_REF], less emphasis has been put on the modeling of web service availability taking into account the impact of server node failures and performance degradations (see [START_REF] Martinello | Availability Modeling and Evaluation of Web-based Services -A pragmatic approach[END_REF] for a review of the state-of-the art). In the following, we summarize the multi-level modeling framework proposed in [START_REF] Kaâniche | Multi-level modelling approach for the availability assessment of e-business applications[END_REF] in order to address this gap.

Internet-based applications are generally implemented on largely distributed infrastructures, involving various types of servers such as web, application, and database servers. Three key players are typically involved in the provision of the services delivered by such applications: 1) the users (i.e., the customers), 2) the e-business provider (eBP), who implements the e-business functions invoked by the users; these functions are based on a set of services and resources that are internal to the eBP site(s) or are provided by external suppliers, and 3) the external suppliers. Considering the example of a web-based travel agency allowing the customers to plan and book trips over the web, the external suppliers correspond to the flight reservation systems (AF, KLM, …), hotel reservation systems (Sofitel, Holiday Inn, …), and car rental systems (Hertz, Avis, …) that are accessed by the travel agency application through dedicated interfaces.

Generally, the eBP has a full control of its own architecture. Therefore, a detailed dependability modeling and analysis of this architecture can be carried out to support architectural design decisions. However, only limited information is generally available to analyze the dependability of the external suppliers services. In this context, remote measurements can be used to evaluate some parameters characterizing the dependability of these services. These parameters can then be incorporated into the models describing the impact of eBP component failures and repairs on the user perceived dependability.

The discussion above shows that several issues should be taken into account when modeling the user perceived availability of Internet based applications. Due to the complexity of the target system and the difficulty to combine various types of information (users behavior, failure-recovery scenarios of the supporting infrastructure), a systematic and pragmatic approach is needed to support the construction of such dependability models. The framework presented in [START_REF] Kaâniche | Multi-level modelling approach for the availability assessment of e-business applications[END_REF] proposed a multilevel hierarchical approach for modeling the user perceived availability of e-business applications. Modeling is done in two steps: 1) identification of the functions and services provided to the users and the resources contributing to their accomplishment, and characterize how the users interact with the application, and, 2) based on this, building of model(s) to assess the impact of component failures and repairs on the quality of service delivered to the users.

As sketched in Figure 1, four abstraction levels are distinguished, namely, user, function, service and resource levels. The highest level (user level) describes the availability of the application as perceived by the users. Intermediate levels describe the availability of functions and services provided to the users. The lowest level (resource level) describes the availability of the component systems on which functions and services are implemented. The availability measures of a given level are obtained based on the measures computed at the immediately lower level. Various techniques can be used to model each level: fault trees, reliability block diagrams, Markov chains, stochastic Petri nets, etc. The selection of the right technique mainly depends on the kinds of dependencies between the elements of the considered level and on the quantitative measures to be evaluated. This approach is illustrated in [START_REF] Kaâniche | A User-Perceived Availability Evaluation of a Web Based Travel Agency[END_REF] using a web-based travel agency as an example. In addition detailed analytical performability models are presented in [START_REF] Martinello | Web Service Availability -Impact of Error Recovery and Traffic Model[END_REF] to analyze the availability of web services implemented on cluster architectures taking into account explicitly: 1) the cluster architecture characteristics, considering the number of nodes in the cluster, the error recovery strategy after a node failure, as well as the reliability of cluster nodes, 2) the traffic model, describing the web traffic characteristics (i.e., the access patterns), and 3) various causes of service unavailability including requests loss due to buffer overflow or node failures.

Fig. 1: Hierarchical availability modeling framework

For the sake of illustration, in the web-based travel agency case study presented in [START_REF] Kaâniche | A User-Perceived Availability Evaluation of a Web Based Travel Agency[END_REF], we have evaluated the user-perceived unavailability considering two different user profiles and various alternative fault tolerant architectures for the implementation of the application and internal services. The first profile corresponds to users who are mainly seeking for information without a buying intention, whereas in the second profile the percentage of transactions that end up with the booking and payment of a trip is three times higher. It is shown that such a difference could have a significant impact on the user perceived unavailability (e.g., 173 hours downtime per year for the first profile compared to 190 for the second profile for one on the investigated scenarios).

Another facet of the web-services analyses has been studied in [START_REF] Gönczy | Dependability evaluation of web service-based processes[END_REF] considering a business model workflow that fits into the class of systems composed of multiple phases. It is shown that modeling methodologies and tools for dependability analysis of Multiple Phased Systems [START_REF] Bondavalli | Dependability modeling and evaluation of multiple-phased systems using DEEM[END_REF] can be applied to provide a useful support to service providers in choosing the most appropriate service alternatives to build their own composite services.

QoS analysis of Mobile Telephone Systems

Mobile telephone systems are prominent representatives of ubiquitous systems and their dependability, especially in terms of availability, has been extensively analyzed in the past literature. Besides the mere estimation of system availability, in recent years several works have been presented focusing on the QoS analysis from the users' perspective, analyzing how the user's perceived QoS is affected by outages, congestion events and by the application of appropriate congestion treatment techniques. The high system complexity in terms of largeness, heterogeneity and dynamicity has been attacked through the introduction of appropriate modeling methodologies based on composition as well as decomposition approaches. In this section we focus on works addressing mobile telephone systems based on General Packet Radio Service (GPRS) technology.

The work presented in [START_REF] Porcarelli | Analyzing Quality of Service of GPRS Network Systems from a Users Perspective[END_REF][START_REF] Porcarelli | Service Level Availability Estimation of GPRS[END_REF] contributes to the analysis of a GPRS network by providing a hierarchical/composition modeling approach to understand the effects of outage periods on the service provision, adopting the modeling capabilities of Stochastic Activity Networks. A typical GPRS configuration has been deeply analyzed and evaluated in terms of a few identified QoS indicators, namely, the number of served users per hour (and related measures) and the variation in system availability when including outages effects with respect to the bare network availability analysis. Interesting results have been observed, which can be fruitfully exploited in devising GPRS configurations adequate to maintain an acceptable QoS also in critical, overload conditions. Additionally, some sensitivity analysis has been performed by varying the frequency and duration of outages periods and for different values of network availability.

The congestion analysis of GPRS infrastructures consisting of a number of cells partially overlapping has been performed in [START_REF] Lollini | Evaluation of the Impact of Congestion on Service Availability in GPRS Infrastructures[END_REF], in terms of QoS indicators expressing a measure of the service availability perceived by users. When congestion is experienced by one of these cells, a family of congestion management techniques is put in place, to operate a redistribution of a number of users in the congested cell to the neighbor ones, in accordance with the overlapping areas. Since the service availability perceived by users is heavily impacted by the congestion experienced by the cells, determining appropriate values for the users to switch, so as to obtain an effective balance between congestion alleviation in the congested cell and congestion inducement in the receiving cells, is a critical aspect in this context. In order to carry on such fine-tuning activity, a decomposition/aggregation modeling methodology, appropriate to deal with the system complexity, has been defined. In particular, a top-down approach is adopted to move from the entire system description to the definition of more simple sub-models. Then, the model solution process follows a bottom-up compositional approach.

The obtained results show behavior trends very useful to make an appropriate choice of the number of users to switch, for example emphasizing that it is not always useful to switch as much users as possible from the congested cell to the other(s), since the positive effects induced in the congested cell do not always compensate the negative effects on the receiving cells. Moreover, an investigation on the amount of time that the system should be permitted to spend for its decision-making processes has been carried on.

A more general decomposition/aggregation approach based on the interactions between system subcomponents has been presented in [START_REF] Lollini | On the modelling and solution of complex systems: from two domainspecific case-studies towards the definition of a more general framework[END_REF]. The goal was to derive a domain-free modeling framework, not restricted to the analysis of mobile telephone systems but applicable to a more general class of systems sharing some high-level properties.

The overall modeling and solution process is depicted in Figure 2. The conceptuallevel system decomposition is a combination of a functional and temporal decomposition. The system is first analyzed from a functional point of view: the overall system is decomposed in a set of interacting sub-systems, called "entities" (the numbered circles of Figure 2), each one corresponding to a critical system function with respect to the validation objectives. The entities may interact through dependency relations: entity Y depends on entity X if the behavior of Y is affected by X (in Figure 2, X→Y). Then a temporal decomposition is applied, for which the system lifetime is seen as a sequence of phases such that each phase is characterized by the same dependency relations holding among entities, and at least one dependency relation changes between two consecutive phases. At this point the structure of the obtained equivalent system (called "phasedinteracting" system) is exploited to propose a decomposed modeling approach that also includes some capabilities for managing the system complexity. Accordingly, each entity is modeled in isolation using the most appropriate modeling formalism. Each model X* (the numbered squares of Figure 2) represents the behavior of entity X including its dependency relations. The decoupled models interact with each other through the passing of numerical results (the dashed arrows of Figure 2): an intermediate result produced by the solution of a given model is shared on a Data Base and it is used to set the value of a numerical parameter defined in another model. The model X*, together with the intermediate results provided as input, should reconstruct the original stochastic behavior of entity X. Then the decomposed solution process can be applied: in each phase, the decoupled models (with the available intermediate results) are solved in isolation using the most appropriate solution technique and following the order defined by the dependency relation graph, finally obtaining the measures of interest. The accuracy of the final measures depends on the accuracy of the intermediate results and on the capability of the decoupled models to properly reconstruct the entities' interactions.

Fig. 2: Interaction-based decomposition approach

The sketched general modeling and solution approach has been applied to analyze the same GPRS scenario presented in [START_REF] Lollini | Evaluation of the Impact of Congestion on Service Availability in GPRS Infrastructures[END_REF]. The goal was to demonstrate its usage in a concrete application domain and to check for its effectiveness and the accuracy of the final measures. In the corresponding phased-interacting system, each entity corresponds to a GPRS cell, the dependency relations represent the users' switching among cells (as consequence of the application of the congestion treatment techniques), and the beginning/end of the switching procedures determines the phase transitions. With respect to the study performed in [START_REF] Lollini | Evaluation of the Impact of Congestion on Service Availability in GPRS Infrastructures[END_REF]: i) the accuracy of the obtained results is acceptable, ii) the computational time slightly increases (the methodology presented in [START_REF] Lollini | Evaluation of the Impact of Congestion on Service Availability in GPRS Infrastructures[END_REF] has been specifically developed for the selected GPRS scenario, this is why it is more efficient), but it is substantially reduced compared to solving the whole non-decomposed model.

Conclusions

The increasing scale and complexity of modern-day computing systems continues to put a premium on efficient techniques for the construction and solution of large quantitative models. In addition, these large, dynamic and evolving systems pose some new research challenges.

In this paper, we have focused on model-based analytical evaluation techniques. The complexity of the scenarios to be considered for the assessment of large and dynamic systems calls for the development of holistic evaluation approaches including complementary evaluation techniques, covering simulation, analytical modeling and experimental measurements. Mechanisms are needed to ensure the cooperation and the unified integration of these techniques, in order to provide realistic assessments of architectural solutions and of systems in their operational environments.

More generally, evaluation methods must consider metrics at an increasingly high level of abstraction, to express the impact of the computing infrastructure on an enterprise business. Of increased significance is also the use of quantitative evaluation methods to support the effective use of adaptation mechanisms prevalent in modern-day systems. Mechanisms exist to dynamically change configurations, and well-founded quantitative techniques are necessary to run such systems in a resilient way.

Besides assessing the impact accidental threats, extensions are also needed to quantify the impact of malicious threats. Clearly, there is a need for a comprehensive modeling framework that can be used to assess the impact of accidental faults as well as malicious threats in an integrated way.

Acknowledgement

This work has been partially supported by the European Commission (IST Projects

ReSIST 0265764, HIDENETS 026979 and CRUTIAL 027513).


Giovanna Dondossola
email: giovanna.dondossola@cesiricerca.it

Geert Deconinck
email: geert.deconinck@esat.kuleuven.be

Felicita Di Giandomenico
email: felicita.digiandomenico@isti.cnr.it

Susanna Donatelli

Mohamed Kaâniche
email: mohamed.kaaniche@laas.fr

Paulo Verissimo

CRITICAL UTILITY INFRASTRUCTURAL RESILIENCE

Keywords: i nfrastructure interdependencies, power control system protection, system analysis and model development, resilient control architectures

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

The problem of security and dependability, or generically speaking, resilience [START_REF]R&D challenges for Resilience in Ambient Intelligence (RAmI)[END_REF] of Internetoriented infrastructure systems, such as web server compounds, is reasonably well understood. Although it is not completely mastered (for example, denial of service is still a research subject), it is receiving adequate attention. However, such is not the case with the problem of resilience of critical utility infrastructures. T h i s p r o b l e m i s n o t c om p l e t e l y understood, mainly due to the hybrid composition of these infrastructures.

The process control of utility infrastructures is based on the SCADA (Supervisory Control and Data Acquisition) systems which yield the operational ability to acquire data, supervise and control whatever is the business in question (electricity, water, gas, telecomm). However, they also have interconnections to the standard corporate intranets, and hence indirectly to the Internet (e.g., remote access via dedicated or public networks). The aforementioned SCADA systems were classically not designed to be widely distributed and remotely accessed, let alone be open. They grew-up standalone, closed, not having security in mind.

Widely distributed monitoring, protection and control systems, implementing special protection scheme over the power transmission network, are emerging whose architecture is based on open communication infrastructures.

This opening that we observe nowadays is an afterthought in the line of the generic trend of any informatics system. Whilst it seems non-controversial that such a status quo brings a certain level of threat, namely but not only through interference, we know of no work that has tried to equate the problem by defining a model of "modern utilities distributed systems architecture". We believe that evaluation work on such a model will let us learn about activity patterns of interdependencies that will reveal the potential for far more damaging fault/failure scenarios than those that have been anticipated up to now. Moreover, such a model will be highly constructive as well, for it will form a structured framework for: conceiving the right balance between prevention and removal of vulnerabilities and attacks, and tolerance of remaining potential intrusions and designed-in faults.

In fact, this hap hazardous evolution led to the inevitable: access to operational networks such as remote SCADA maneuvering, ended up entangled with access to corporate intranets and public Internet, without there being computational and resilience models that understand (represent) this situation and deal with the resulting interference. In consequence, unlike what exists in simpler, more homogeneous settings, e.g. classical web-based server infrastructures on Internet, it is in most circumstances not possible to devise a dependability and security case for these interconnected critical utility infrastructures.

The damage perspectives that may result from this exposure are overwhelming. They range from wrong maneuvering, to malicious actions coming from terminals located outside, somewhere in the Internet. The targets of these actions are computer control units, embedded components and systems, that is, devices connected to operational hardware (e.g., water pumps and filters, electrical power generators and power protections, dam gates, etc.). In the electrical power provision these situations have already been experimented by citizens in various part of the world. As a single example, among blackouts that occurred in the summer of 2003 in several countries, we can remember the North American one, which is very relevant to explain the project motivations: as highlighted in the analysis report [START_REF]Causes of the August 14th Blackout in the United States and Canada[END_REF], it was the failure of various information systems that thwarted the utility workers' ability to contain the blackout before it cascaded out of control. A type of failure that is characteristic of interdependent critical infrastructures happened then, that is an escalating failure8 , a type of failure that we shall address in this project.

The main challenge of the project is to make power control resilient in spite of threats to their information and communication infrastructures. Considering the crucial role of control systems in governing the quality and the stability of the electric power service, it is considered of great importance for the utilities operating the infrastructures to dispose of tools for analyzing threat impacts and of technologies for avoiding, or limiting, most serious consequences.

The paper presents the basic research challenges that the CRUTIAL consortium has identified, an overview on the state of the art about the major topics involved, and the work plan that CRUTIAL intends to develop during the project course, based on the modeling and architectural approaches which represent the background of the project team.

Research challenges and objectives

The project focuses on the electrical power infrastructure and the information infrastructures, by considering different topology realms and different kinds of risks: distinguishing the backbone from the specific information networks and from the infrastructures dedicated to the control and monitoring of the electric power infrastructure, as they usually have different levels of protection; distinguishing faults of different kinds and severities, such as electric power outages and cyber attacks.

The main objective of the project is the investigation of models and architectures that cope with the scenario of openness, heterogeneity and evolvability endured by electrical utilities infrastructures, in the present and near future. The approach taken should support the analysis and management of interdependencies and of the resulting overall operational risk.

Firstly, the project aims to develop comprehensive modeling approaches, supported by measurement based experiments, to analyze critical scenarios in which internal or external faults in a segment of the information infrastructure provoke a serious impact on the controlled electric power infrastructure, in order to understand and master such interdependencies to avoid escalating and cascading failures that result in outages and blackouts. Effort will be focused on the modeling and analysis o f i n t e r d e p e n d e n c i e s , especially the various types of failures that can occur in the presence of accidental and malicious faults affecting the information and electric power infrastructures: physical (hardware) faults of various temporal characteristics from transient to permanent; yet undiscovered design faults in software ("bugs") and in hardware ("errata"); interaction faults due to mistakes of human operators or maintainers; malicious human-caused faults, i.e. denial or unauthorized alteration of services by software attacks or physical sabotage. Given the complexity of the analysis task, a difficulty will be to find the right abstractions of the models. The aim is therefore to produce, from conceptual analysis, generic models that can be refined and instantiated. The abstractions will be substantiated by examples taken from the electric application domain. Another expected difficulty is the heterogeneity of the models, given the very different nature of the various components under study.

Secondly, the project will investigate distributed architectures dedicated to the control and management of the power grid, in the perspective of improving the capability of analyzing critical scenarios and designing dependable interconnected power control systems. The architectures under study will address requirements coming from the needs of flexible electric power services, characterized by dispersed energy resources, on-demand control and inputs from the market. In consequence, our objective is to devise new architectural configurations that address the increase in operational risk derived from the analysis made above. This risk derives not only from accidental faults or wrong maneuvers, but also, and very importantly, from both the degree of vulnerability and the level of threat to which the infrastructures and services are subjected. The objective of preventing escalating failures on the various information infrastructures (monitoring, control, management) that interact on a decentralized power grid can only be met by the combined use of fault prevention and tolerance, and by the simultaneous addressing of accidental and malicious faults, also called intrusion-tolerance, enhanced by the provision of on-line monitoring support to evaluate possible alternative architectural configurations in uncertain and evolving scenarios.

Background

This section gives an overview of international initiatives and working groups related to the topic of our project, as well as related work on dependability and security modeling and on resilient distributed real-time architectures.

International initiatives and working groups

There is a consensus in the literature on critical infrastructures that interdependency analyses and models constitute a necessary step [START_REF] Rinaldi | Identifying, understanding, and analysing critical infrastructures interdependencies[END_REF]. The International CIIP Handbook 2004 [START_REF] Wenger | Critical Information Infrastructure Protection[END_REF] is a comprehensive collection of information about the various initiatives undertaken by the different countries on the theme of Critical Information Infrastructure Protection (CIIP), mainly at governmental level. The CIIP Handbook underlies the need of developing methodologies for analyzing interdependencies and guiding the protection of critical information infrastructures. In Italy, the Working Group on Critical Information Infrastructure Protection released a document [START_REF]Gruppo di Lavoro sulla protezione delle Infrastrutture Critiche Informatizzate. Protezione delle Infrastrutture Critiche Informatizzate -La realtà Italiana (Critical Information Infrastructures Protection: The Case of Italy)[END_REF] in October 2003 describing many elements of the Italian infrastructures, emphasizing their interdependencies, suggesting CIIP policy strategies and research challenges. In the Unites States many research initiatives and activities related to the protection of critical infrastructures have been undertaken from the nineties. NERC has organized a Cyber Security Urgent Action, resulting in some guidelines, compliance audits, and activities such as workshops for awareness raising. In 1998 the USA's Department of Energy assigned to NERC the role of reference point for cyber security for the electric power sector. The CIPC (Critical Infrastructure Protection Committee) was created to develop and maintain capabilities to respond to security threats and incidents, and support the production of standards and guidelines. Also in the US, the Electric Power Research Institute (EPRI) started the "Infrastructure Security Initiative" addressing power system security at both electrical and cyber levels. The Department of Energy (DOE) published the "21 Steps to Improve Cyber Security of SCADA Networks", whilst the Sandia National Laboratories developed a research program on SCADA electronic security [6]. In Europe the need of setting up research programs on critical infrastructures has been recognized from several years. However a limited number of European Projects has addressed the emerging problems of digitalized critical infrastructures. The ACIP (Analysis & Assessment for Critical Infrastructure Protection) project produced a roadmap about R&D activities to be performed on the topic. A roadmap on research activity in the area of information system dependability has been produced by the AMSD accompanying measure (A Dependability Roadmap for the Information Society in Europe). The FP5-IST research project SAFEGUARD (Intelligent Agents Organization to Enhance Dependability and Survivability of Large Complex Critical Infrastructure) proposed an agent-based architecture for supporting the supervision and decision support systems in critical infrastructural domains.

From the standardization side, there are several working groups devoted to the application of Information Technology in Electric Power Systems. A paper [START_REF] Ericsson | Managing Information Security in an Electric Utility[END_REF] providing a survey on ongoing activities has been published by the Cigré Joint Working Group D2/B3/C2-01 "Security for Information Systems and Intranets in Electric Power Systems".

The American Gas Association (AGA) are active in the de ve lopm e nt of cr yptogr a phic standards for SCADA communication [START_REF]Cryptographic Protection of SCADA Communications[END_REF]. The Instrumentation, Systems and Automation Society (ISA) published two reference reports [START_REF]Security Technologies for Manufacturing and Control Systems[END_REF] on Electronic Security in Manufacturing and Control Systems Environment.

The Computer Security Resource Center, National Institute of Standards and Technology (NIST), including the Process Control Security Requirements Forum (PCSRF), published relevant papers on the topic ( [START_REF] Falco | IT Security for Industrial Control Systems[END_REF], [START_REF] Stoneburner | Recommendations[END_REF], [12]). We can observe that any document by such standard committees emphasizes the importance of Cyber Risk Assessment of power control systems and a first methodological approach has been presented in a recent paper of the Cigrè Group [START_REF] Dondossola | Cyber Risk Assessment in the Electric Power Industry[END_REF].

Also a number of institutional/research organization are performing activities which provide information suitable to the identification of robust architectural patterns for industrial control systems.

The National Infrastructure Security Co-ordination Centre -NISCC in London coordinates a forum on SCADA and Control Systems Information Exchange. They also are going to establish the CERT-UK for SCADA and they are developing the SCADA Incident Database. The British Columbia Institute of Technology -BCIT is developing a platform for testing SCADA vulnerability. They perform vulnerability analysis of SCADA protocols, they investigate on the use of firewall in SCADA systems and are developing the Industrial Security Incident Database.

The Idaho National Engineering and Environmental Laboratory -INEEL/SNL are developing the SCADA National Test Bed, which is specifically dedicated to testing control systems of a wide area electric power grid.

A test bed for the simulation of attack scenarios to power control and management systems has been set up at CESI Laboratory [START_REF] Dondossola | Evaluation of the effects of intentional threats to Power Substation Control Systems[END_REF].

Dependability and security modeling A large body of research exist on the dependability analysis and evaluation of computer based infrastructures, in particular with respect to accidental threats, considering two main complementary approaches: i) analytical modeling and ii) measurement-based assessment. Analytical modeling has been proven to be a cost effective and useful technique to support architectural design decisions, as a model can play the double role of a specification of the design, as well as the basis for a qualitative and quantitative evaluation of the design itself. Several model-based evaluation techniques are currently available, including combinatorial techniques (reliability block diagrams, fault trees, network graph analysis , Bayesian networks) or state space analysis (Markov chains, stochastic Petri nets and their extensions). State-based models are commonly used, as they are able to capture various functional and stochastic dependencies among components and allow the evaluation of various measures related to dependability and performance. However, the major difficulty with such models is related to the model largeness and state explosion problem. Significant progress has been obtained during the last twenty years, by CRUTIAL partners and elsewhere, for addressing such problem at the model construction and model solution levels. The proposed techniques include the use of hierarchical approaches, composition rules, parametric modelling, state truncation, state aggregation, as well as high-level specification formalisms and automated generation methods, based for example on SPNs (Stochastic Petri Nets) and their extensions, or on semi-formal specification languages like UML diagrams.

As regards malicious threats, traditional security evaluation approaches are mainly based on qualitative analysis and evaluation criteria. While these criteria provide useful guidelines during the design, it is widely recognized that they are insufficient to assess the impact of attacks on security during the operation phase. To fill this gap, new approaches have been proposed recently for the quantitative evaluation of security based on probabilistic modelling approaches [START_REF] Nicol | Model-based Evaluation: From Dependability to Security[END_REF].

Existing results on dependability and security modeling and evaluation have mainly addressed individual infrastructures without tackling the problem of interdependencies between infrastructures. However, to truly understand and analyze the operational characteristics of these infrastructures, it is necessary to model such interdependencies and analyze their impact with respect to the occurrence of critical outages. The need for such modeling and assessment studies has been highlighted in the conclusions of the RamI (R&D challenges for Resilience in Ambient Intelligence") Workshop organized by the European commission in March 2004. Also, it has been pointed out in the recommendations of the roadmap for European R&D on Critical Infrastructure Protection, produced by the ACIP (Analysis & Assessment for Critical Infrastructure Protection) project.

It is only recently that the problem of interdependencies modeling has been addressed by the research community. To the best of our knowledge there are currently no available significant results tackling this problem. The papers published so far on this topic mainly include definitions of the multiple dimensions of interdependencies [START_REF] Rinaldi | Identifying, understanding, and analysing critical infrastructures interdependencies[END_REF], or discuss potential approaches and preliminary models that are aimed at describing and analyzing the impact of interdependencies (see [START_REF] Rinaldi | Modeling and simulating critical infrastructures and their interdependencies[END_REF] and references within [START_REF] Gursesli | Modelling Infrastructure Interdependencies using Petri Nets[END_REF], [START_REF] Schneider | A proposed method of partially-decentralised power system protection[END_REF]).

Resilient distributed real-time architectures

There is a reasonable body of research on distributed computing architectures, methodologies and algorithms, both in the fields of dependability and fault tolerance, and in security and information assurance. These are commonly used in a wide spectrum of situations: information infrastructures; commercial web-based sites; embedded systems. Their operation has always been a concern, namely presently, due to the use of COTS, compressed design cycles, openness. Whilst they have taken separate paths until recently, the problems to be solved are of similar nature: keeping systems working correctly, despite the occurrence of mishaps, which we could commonly call faults (accidental or malicious); ensure that, when systems do fail (again, on account of accidental or malicious faults), they do so in a non harmful/catastrophic way. In classical dependability, and mainly in distributed settings, fault tolerance has been the workhorse of the many solutions published over the years. Classical security-related work has on the other hand privileged, with few exceptions, intrusion prevention, or intrusion detection without systematic forms of processing the intrusion symptoms.

A new approach has slowly emerged during the past decade, and gained impressive momentum recently: intrusion tolerance. That is, the notion of --handling/react, counteract, recover, mask --a wide set of faults encompassing intentional and malicious faults (we may collectively call them intrusions), which may lead to failure of the system security properties if nothing is done to counter their effect on the system state. In short, instead of trying to prevent every single intrusion, these are allowed, but tolerated: the system has the means to trigger mechanisms that prevent the intrusion from generating a system failure. In fact, the term "intrusion tolerance" was used for the first time more than 20 years ago, and a sequel of that work lead to a specific system developed in the DELTA-4 project [START_REF] Deswarte | Intrusion tolerance in distributed computing systems[END_REF]. In the following years, a number of isolated works, mainly on protocols, took place that can be put under the IT umbrella [START_REF] Alvisi | Dynamic Byzantine quorum systems[END_REF], [START_REF] Castro | Practical Byzantine fault tolerance[END_REF], [START_REF] Hiltunen | Enhancing survivability of security services using redundancy[END_REF], but only recently did the area develop significantly, with two main projects OASIS and MAFTIA [START_REF] Adelsbach | Conceptual Model and Architecture of MAFTIA[END_REF], doing structured work on concepts, mechanisms and architectures. These projects, however, mainly addressed the issue of intrusion tolerance on Internet-oriented infrastructures type of systems. Some progress has been obtained recently by CRUTIAL partners in protocols resilient to malicious faults [START_REF] Correia | Low Complexity Byzantine-Resilient Consensus[END_REF] and on architecting and programming with trusted components [START_REF] Correia | The Design of a COTS Real-Time Distributed Security Kernel[END_REF]. In this project, we intend to make important advances on how to tolerate intrusions on critical utility infrastructures.

CRUTIAL work plan

The research that will developed in CRUTIAL address the objective to improve the resilience of the power grid by deploying suited information and communication infrastructures. Two main research directions will be investigated to fulfill this objective. The first research line focuses on the development of a model-based methodology for the dependability and security analysis of the power grid information infrastructures. A second line of research is related to the design of control system architectures and protection mechanisms for electric power systems. Both the (modeling and architectural) project activities are driven by the identification of some reference control system scenarios and examples of various types of interdependencies based on the analysis of the existing and ongoing evolutions of the target architectures.

The activities that will be carried out can be summarized as follows: a) identification and description of reference control system scenarios; b) development of comprehensive modeling approaches for understanding and mastering the various interdependencies; c) development of test beds integrating the electric power system and the information infrastructure to support the analysis and validation of control system and interdependencies scenarios; d) investigation of fault-tolerant architectural configurations and protection mechanisms to enhance the resilience of target infrastructure; e) provision of qualitative and quantitative support for the identification, analysis and evaluation of the scenarios identified. The following subsections summarize these activities and the research directions that will be explored.

Identification and Description of Control System Scenarios

A control system scenario defines a reference structure of i) the power grid, ii) the monitoring & control network, with Intelligent Electronic Devices at different levels of the power system (Control Center level, Station level, Bay level, Process level), iii) the management information networks and their functional relationships with the process network, iv) and the different threats that may threaten the operation of the power system services. Control system scenarios are derived from ongoing evolutions of existing control systems, such as the increasing impact of dispersed electricity generation (renewable energy sources,e.g. photovoltaic and wind energy-that are connected on different places to the electricity distribution network). If sufficient generation (and storage) facilities are available in a part of the electrical grid, such part can become an energy island (or microgrid) which functions independently from the major grid (e.g. during blackout). Different evolution aspects are taken into account in the scenario identification phase. A first set of scenarios will be derived from the control of distributed generation systems and microgrids. Such control systems form a so-called Autonomous Electricity Network (AEN), i.e. a group of distributed generators, intelligent loads and storage devices, capable of cooperation and control in a distributed manner, i.e., without central controller, and this based on standard components and public communication networks. External information, such as the instantaneous electricity price from real-time market place, can be incorporated into the control strategies in order to optimize economic control objectives. Hence, this information infrastructure is used for tertiary control, based on communication among the different entities without central coordination. It comes on top of the primary control of voltage and frequency (which is local i.e. without communication) and secondary control (which is centralized and used for e.g. dispatching). As such reliability of these electricity networks is improved, also when sub-networks of the electricity network are separated from the main network. In islanding mode, several issues need to be solved regarding protection and control (e.g. the selectivity of the protection needs to react on different threshold), which requires appropriate communication and control. The ICT infrastructure and several control algorithms are also required when re-synchronizing the microgrid to the main grid after islanding. A second evolutionary aspect for control scenarios is related to new Power Management Systems which integrate management information networks with process control networks. Security and dependability issues become a major concern in this situation. This also includes the consideration of the configuration capabilities required to substation control systems by the new organization of the power market. These setups address information infrastructures in which involved stakeholders access to the power management system for many different purposes, and some of them require to modify the power network asset through the on-line reconfiguration of the field equipment and their control apparatus.

Interdependencies modelling

The objective is to develop a comprehensive modeling framework aimed at fulfilling the following goals: i) characterize and analyze the interdependencies between the information infrastructure and the controlled power infrastructure, especially the various types of failures that might occur in the presence of accidental and malicious faults; and ii) assess their impact on the resilience of these infrastructures with respect to the occurrence of critical outages and perform sensitivity analyses to support design decisions.

Two complementary analysis and modeling methods will be investigated: a) qualitative analysis methods based on hazard identification and risk modeling techniques, aiming at the identification of failure scenarios, the analysis of their impact and their ranking according to severity and criticality criteria; b) quantitative evaluation m e t h o d s b a s e d o n s t o c h a s t i c processes (using e.g., Markov chains or stochastic Petri nets), aiming at quantifying the impact of failure and recovery scenarios on the behavior of the infrastructures and the dependability and trustworthiness of the delivered service.

The modeling framework investigated in CRUTIAL is aimed at taking into account multiple dimensions of interdependencies [START_REF] Rinaldi | Identifying, understanding, and analysing critical infrastructures interdependencies[END_REF]: a) the types of interdependencies (physical, cyber, geographic, logical), b) the coupling and response behavior (loose or tight, inflexible or adaptive), c) the various classes of faults that can occur, and d) the different time scales, and the infrastructure characteristics (organizational, operational, temporal, spatial). Particular focus will be put on the study of the types of failures that are characteristic of interdependent critical infrastructures: Cascading failures, Escalating failures and Common cause failures. Although the modeling of such failures has received increasing interest in the last years 9 after the large blackouts of electric power transmission systems in 1996 and 2003, this problem is still open and further developments are needed, in particular with respect to the modeling of escalating failures. The analysis of such types of failures requires the use of models that are able to describe stochastic dependencies and to take into account non-stationary phenomena that result in particular from the combined impact of component failures and performance degradations due to overloads. Accounting for all such aspects raises a number of challenging issues that need to be addressed and require appropriate methodologies to overcome them. A discussion of some of these challenges and of the research directions that will be explored in the project is given in the following.

A major difficulty lies in the complexity of the modeled infrastructures in terms of largeness, multiplicity of interactions and types of interdependencies involved. To address this problem, a number of abstractions and appropriate approaches for composition of models will be necessary. The aim is therefore to produce, from conceptual analyses, generic models that can be refined, instantiated and composed according to hierarchical modeling approaches. Generalization, adaptation and extension of our previous approaches (see [START_REF] Kanoun | Fault-tolerant systems dependability. Explicit modelling of hardware and software component-interactions[END_REF], [START_REF] Kaâniche | Multi-level modelling approach for the availability assessment of e-business applications[END_REF], [START_REF] Porcarelli | A Modular Approach for Model-based Dependability Evaluation of a Class of Systems[END_REF], [START_REF] Bernardi | Building Petri Net scenarios for Dependable Automation Systems[END_REF], [START_REF] Bernardi | Stochastic Petri Nets and inheritance for dependability modelling[END_REF]) will be necessary to address: i) the specific challenges and characteristics inherent to the combined modeling of information and power distribution infrastructures; ii) the combination of different formalisms to describe the various component of a system and their dependencies); iii) extension of existing formalisms to deal with peculiar features raising from our application context.

Another point is on-line evaluation (as opposed to traditional off-line evaluation), which would be desirable in a number of circumstances, in particular to support the efficient selection of adaptive reconfiguration strategies. Of course, although appealing, the online solution shows a number of challenging problems requiring substantial investigations (e.g., dynamic instanciation of models, compositional rules, efficient model solution).

An additional relevant issue that needs to be carefully addressed in the modeling concerns the well known stiffness problem, or system parameters that are only partially defined. Such a problem can be alleviated by the use of aggregation and approximation techniques. Also, we need to address the problem of modeling interdependencies in a context characterized by different operation phases and regimes with different configurations and behaviors. Such changes might have a significant impact on the parameters describing the occurrence of failures and their propagation. We will investigate the use of stochastic models for multiphased systems to address this problem [START_REF] Bondavalli | Dependability Modelling and Evaluation of Multiple Phased Systems using DEEM[END_REF].

Finally, a difficult issue concerns t h e e v a l u a t i o n o f t h e i m p a c t o f malicious faults. Traditionally, only accidental faults in software and hardware components have been taken into account in the evaluation of quantitative dependability measures, while the evaluation of security has been mainly based on qualitative evaluation criteria [START_REF] Dondossola | Emerging standards and methodological issues for the security analysis of the Power S ys te m i nf or ma ti on i nf ras t r uct ur e s . C R I S[END_REF]. However, quantitative criteria are widely recognized to be insufficient for analyzing and assessing the impact of malicious attacks and vulnerabilities on the security of systems in operation, or to support the design of intrusion-tolerant systems, and quantitative evaluation based on probabilistic modeling is a promising research direction aimed at filling this gap. Some pioneering work has been achieved by some of the CRUTIAL partners towards this objective [START_REF] Ortalo | Experimenting with Quantitative Evaluation Tools for Monitoring Operational Security[END_REF]. However, to be applicable to the context of interdependent information and power distribution systems, generalization and extensions have to be developed. The ultimate objective that will be pursued during the project on this topic will be the definition of a comprehensive framework for the modeling and evaluation of resilience taking into account malicious faults as well as accidental faults.

Resilient architectures and protection mechanisms CRUTIAL will study the information infrastructures used in electric power systems, in order to derive common denominators: exposure, threat, vulnerability, unsafety, etc. Thus it will define a reference architecture that takes into account the needs defined by this operation (e.g., that a certain level of exposure is unavoidable). Considering the testbed described above we foresee at least three interconnection realms with different levels of threat, degrees of vulnerability, level of criticality w.r.t. acceptable operational risk: operational SCADA/embedded networks; corporate intranets; Internet/PSTN access. WP4 will investigate on • architectural configurations that induce prevention of the more severe interaction faults, and attack and vulnerability combinations. The challenge here, furthering recent research achievements on fault and intrusion tolerant (FIT) architecturing [START_REF] Adelsbach | Conceptual Model and Architecture of MAFTIA[END_REF], lies exactly with the (unavoidable) entanglement of the information flows of the three above-mentioned realms; • middleware devices that achieve tolerance of the remaining faults/intrusions (architectural blocks, protocols). We plan to study combinations of recent promising techniques for building protocols that address the different levels of criticality in the foreseen architecture, such as randomization or wormholes; • sophisticated system monitoring mechanisms that go beyond mere intrusion detection but instead achieve what might be called trustworthiness monitoring, where the general level of resilience of the system is assessed during its operation, both from the perspective of attacks, vulnerabilities, and general faults. The architectural configurations developed in the project will have to strike a right balance between the prevention and removal of the more severe interaction faults and vulnerabilityattack combinations, and the tolerance of the remaining potential faults and intrusions. The challenge here, furthering recent research achievements on fault and intrusion tolerant architecturing, lies exactly with the (unavoidable) entanglement of the information flows of the various above-mentioned infrastructures.

The findings of WP4 investigations will be validated both through proof-of-concept prototypes of the above-mentioned functionality, and real-life testbed experiments, and by building a resilience case in the new architectural scene, and compare it against the starting scenarios studied in the beginning. They will be formally validated also, by several means that include modeling, and experimental validation.

Testbed and experimental evaluation Two testbed will be developed which integrate the electric power system and the information infrastructure. This will allow the elaboration of new control scenarios in order to better identify them, to allow for the deployment of architectural patterns, and, to complement the modeling to analyze interdependencies and to identify critical failure modes. These testbed platforms will be based on power electronic converters and Intelligent Electronic Devices (IEDs) -such as bay level controllers and power station computers -that are interconnected via off-the-shelf communication protocols (TCP/IP or UDP/IP). It is clear that in all control scenarios identified, ICT and electric power infrastructures are tightly coupled: a suited architecture needs to be developed and the interdependencies analyzed. The identified scenarios will drive the development of the analysis methodology and of the architectural design. The testbed experiments will instantiate the designed ideas onto innovative infrastructures in which the power process control is connected to the power business management.

The testbed will consist of two platforms; as illustrated below, both platforms are required, because they are complementary to each other.

A first testbed consists of several power electronic converters, which are interconnected via off-the-shelf communication protocols (TCP/IP). It is based on the Herakles platform [START_REF] Van Den Keybus | Using a fully digital rapid prototype platform in grid-coupled power electronics applications[END_REF], developed at K.U.Leuven. Each converter can be used to emulate generators or loads in an energy island. The Herakles platform allows different control ideas (voltage/frequency/current control, power quality control, etc.) to be modeled in a high level programming tool such as Matlab, after which it can be swiftly prototyped on a 4-quadrant power electronic converter, whereby the control algorithms a r e dow nloa de d on high pe r f or m a nce signa l pr oc e ssing hardware (DSP + FPGA) which manages the power electronics. This DSP is connected to a PC which allows communication with other intelligent components. As these Herakles platforms are connected to PC's, they can be interconnected via TCP/IP modules in order to extend the control scope from local towards hierarchical and decentralized control algorithms. By the project-start, about 3 of these Herakles elements are available, on which mainly local control algorithms are being executed. During the CRUTIAL project, this platform will be further developed to be able to execute different hierarchical and distributed control algorithms. For this, work is required on the hardware and software of the platform, as well as on the middleware modules to interconnect them into a network -as such creating an information infrastructure. Because of the distributed approach, this platform will be mainly used in the context the socalled 'new' control scenarios. It will be used to evaluate the aspects of interdependencies between the information infrastructure and the electric power system, and to identify the robustness of the control algorithms to disturbances, and to provide feedback to the modeling and architectural parts based on the experiments.

A second testbed is based on a platform which is currently under development at CESI labs for supporting the simulation of attack scenarios. The platform consists of an Ethernet based communication infrastructure interconnecting a power substation control network, a substation supervision network and a control centre network through protocols based on standard communication stacks (e.g. UDP/IP). The power substation control network is modular and composed by a heterogeneous set of real time targets performing process data elaboration. The software architecture of the station automation application is based on an automation software engineering environment developed at CESI that supports automata-based specification, automatic code generation and distributed execution. The substation supervision network consists of standard elaboration units which provide data base, administration and web services supporting monitoring and maintenance functions, whilst the control center implements remote supervision and control functions, as well as maintenance.

This second set-up is complementary to the first platform because it builds on environments that are used in industrial automation (SCADA-based). It is also well suited to evaluate the effects of fault propagation of e.g. malicious faults, because these SCADA networks can be integrated into corporate control and administrative networks.

"An escalating failure occurs when an existing disruption in one infrastructure exacerbates an independent disruption of a second infrastructure, generally in the form of increasing the severity or the time for recovery or restoration of the second failure".

I. Dobson, B.A. Carreras, V. Lynch, D.E. Newman, "Complex Systems analysis of series of blackouts: cascading failure, criticality, and self-organization", Bulk Power System and Control, Aug. 2004, Cortina d'Ampezzo, Italy.

Project Coordinator's Biography

Giovanna Dondossola belongs to the Networks and Infrastructures Department of CESI RICERCA company where she manages European Projects and National activities on dependability and security issues of power network control systems. Among the activities she is currently leading there are interoperability issues in power station control software, fault tolerant distributed architectures in real time industrial automation, cyber security for the electric power system. Two main objectives of the activities on power system electronic security are the development of methodologies for threat analysis and the evaluation of tools for monitoring the communications and for studying attack evolutions and secure architectures.

She is author of about 30 papers published in international conferences proceedings. She is member of the Cigré Working Group D2/B3/C2-01 on Security for Information Systems and Intranets in Electric Power Systems.