8 papers
Digital Twin-Assisted Mapping of ICS Telemetry to ATT&CK for ICS with Evidence-Driven Dependency Reasoning
Konstantinos E. Kampourakis, Vyron Kampourakis, Vasileios Gkioulos +1
Reconstructing adversarial behavior from Industrial Control System (ICS) telemetry is difficult because process observations reveal physical changes more directly than the actions…
Using LLMs to Elicit Security Requirements for Service-Oriented Cyber Ranges
Michail Takaronis, Athanasia Kollarou, Georgios Kavallieratos +2
Cyber ranges are complex environments comprising many interacting components and stakeholders with different security concerns. The Service-Oriented Cyber Range (SOR) is no excepti…
Detect First, Explain Later: Training-Free Temporal-Memory Digital Twin Anomaly Detection with Post-Hoc LLM Interpretation for ICS
Konstantinos E. Kampourakis, Vasileios Gkioulos, Sokratis Katsikas
Industrial Control Systems (ICS) are increasingly exposed to cyber-physical attacks that manifest as subtle and temporally evolving deviations in process behavior. Detecting such a…
ICS Cybersecurity Datasets: A Systematic Meta-Review of Coverage, Evaluation Practice, and Structural Gaps
Konstantinos E. Kampourakis, Vyron Kampourakis, Georgios Kambourakis +4
Intrusion detection research in Industrial Control Systems (ICS) heavily depends on public datasets, yet no prior work has systematically assessed whether the collective dataset co…
Digital Twin Degradation: Detecting Cyber Physical Attacks via Temporal Inconsistencies
Konstantinos E. Kampourakis, Vasileios Gkioulos, Sokratis Katsikas
Digital Twins (DTs) are increasingly used to monitor and analyze Cyber Physical Systems (CPS). However, in adversarial environments, the fidelity of a DT cannot be assumed. Communi…
From Conceptual Scaffold to Prototype: A Standardized Zonal Architecture for Wi-Fi Security Training
Vyron Kampourakis, Efstratios Chatzoglou, Vasileios Gkioulos +1
Wi-Fi is the dominant wireless access technology, but its widespread use also exposes systems to threats such as rogue access points, deauthentication attacks, and other IEEE 802.1…
Systematic Integration of Digital Twins and Constrained LLMs for Interpretable Cyber-Physical Anomaly Detection
Konstantinos E. Kampourakis, Vasileios Gkioulos, Sokratis Katsikas
Cyber attacks targeting Industrial Control Systems (ICS) have become increasingly sophisticated and hard to identify. Detecting such attacks requires integrating low-level behavior…
ICSSPulse: A Modular LLM-Assisted Platform for Industrial Control System Penetration Testing
Michail Takaronis, Athanasia Kollarou, Vyron Kampourakis +2
It is well established that industrial control systems comprise the operational backbone of modern critical infrastructures, yet their increasing connectivity exposes them to cyber…