Risk Analysis and Crisis Scenario Evaluation in Critical Infrastructures Protection

This series is directed to diverse managerial professionals who are leading the transformation of individual domains by using expert information and domain knowledge to drive decision support systems (DSSs). The series offers a broad range of subjects addressed in specific areas such as health care, business management, banking, agriculture, environmental improvement, natural resource and spatial management, aviation administration, and hybrid applications of information technology aimed to interdisciplinary issues. This book series is composed of three volumes: Volume 1 consists of general concepts and methodology of DSSs; Volume 2 consists of applications of DSSs in the biomedical domain; Volume 3 consists of hybrid applications of DSSs in multidisciplinary domains. The book is shaped decision support strategies in the new infrastructure that assists the readers in full use of the creative technology to manipulate input data and to transform information into useful decisions for decision makers.

vehicular traffic on motorways might strongly perceive the effects (after a certain latency time) of an outage on the electrical system. This is a less subtle interdependence than that present for CI which are more directly related to the electrical power delivery, such as railway traffic; nevertheless, all these effects must be taken into account when healing and mitigation strategies must be envisaged for the solution of a crisis event (4). This work reports of a new strategy aimed at realizing tools for the prediction of the onset of crisis scenarios and for a fast prediction of their consequences and impacts on a set of interdependent infrastructures, in terms of reduction of the services dispatched by the infrastructures and the impact that services unavailability might have on population. All that in order to provide a new generation of Decision Support Systems which can support CIs operators in performing preparedness actions and to optimizing mitigation effects. The present chapter is composed of 3 sections: in the first, the general layout of the system is proposed, where each task of the system is described. This section contains the general description of the risk analysis and the tools which are used to make quantitative evaluations. The second section will encompass a general description of the meteo-climate simulation models which provide an accurate evaluation of the precipitation level expected on shortand medium-long period. The last section will be entirely devoted to the description of the impact evaluation of crisis scenarios.

General description of the DSS layout
The chapter will report on the main ideas at the origin of a new class of Decision Support System (DSS) which attempts to combine data (of several types and sources), dynamic data (from field sensors), dynamical predictions (weather, climate) in order to produce a dynamical risk assessment of CIs and a subsequent evaluation of the impact that predicted crises scenarios might have of technological infrastructures, services, population. MIMESIS (Multi Infrastructure Map for the Evaluation of the Impact of Crisis Scenarios) is an example of this new DSS concept, realized to evaluate the risk to which CIs present on a given area are exposed, and to study physical interdependencies among different networks. The tool can be used by CIs holders, Regional and National Agency for Civil Protection, Land Control Agencies. MIMESIS is composed of the following components: 1. a geo-database designed to store, query, and manipulate geographic information and spatial data which contains stored land e CIs data; 2. a "static" analysis tool which, combining topological information with land data, is able to evaluate a static risk exposition index to each constitutive element of all CIs; 3. a "dynamic" analysis tool which, combining information from land sensor networks, satellite images, weather forecast, is able to evaluate a dynamic risk through the acquisition of dynamic real-time data; 4. the crisis scenario generator that inputs data to the DSS which evaluates the impact of faults at the topological and functional level of the CIs by using CI federated simulators; 5. a GIS user interface which allows to view crisis scenario and its evolution.

The general layout of the MIMESIS DSS is reported in Figure1
MIMESIS's goal is to predict crisis scenarios, to evaluate their impact in order to achieve prompt response and to help mitigating their effects.

Geo-database
A major problem that risk assessments and mitigation strategies must cope with is the lack of a centralized data repository allowing comprehensive risk analysis and risk prediction of CI in a given region. Without a mean to consider, on the same ground, all CIs and their mutual interdependencies, any efficient way to predict and mitigate crisis scenarios could be realized. Impact mitigation strategies should, in fact, consider the different responses of the different CIs, their perturbation in relation to the crisis, the different latency times for perturbation spreading, the different timings in the healing actions.
To consider all these issues, the first necessary action is to constitute a control room where data of all CIs should be made available. For this reason, the geo-referenced database plays a central role in the MIMESIS tool. It contains a large set of data of different kinds: (1) regional nodes of critical infrastructures, such as electrical stations, power generators, high-to-medium-to-low voltage electrical transformers, telecommunication switches and primary cabins, railways and roads with the specific access points, gas and water pipelines and their specific active points; (2) geographic and elevation maps of the region with the highest possible accuracy; (3) position, flow rates, hydrographic models of all water basins (rivers, natural or artificial lakes, hydroelectric reservoirs etc.); (4) landslide propensity of the different areas according to historical repositories, where dates and landslides types are recorded; (5) geo-seismic data provided by the soil geo-seismic national agency, supported by real-time data provided by in-situ accelerometers (where available); (6) geo-seismic data on geological faults ; (7) social (cities, population densities), administrative (counties, districts) and economical (industrial areas classified in terms of energetic consumptions, produced GDP, types of resources the area is dependent on, etc.) data of the region; (8) agricolture's 379 Risk Analysis and Crisis Scenario Evaluation in Critical Infrastructures Protection www.intechopen.com maps, fisheries etc. (9) traffic data on motorways and major urban roads (Origin-Destination matrices, if available) (10) railways data with passengers and goods traffic; (11) any other data related to other infrastructures (water, gas-oil pipelines, wherever present in the territory). Such a huge database should be provided in a GIS format, allowing a precise geo-referenced of each constitutive network's elements.

Static risk analysis
MIMESIS workflow starts with a periodic (yearly) evaluation of the "static" risk to whom each constitutive element of CI is submitted because of its geographical position. It is possible, in fact, to determine a number of risk indices, each related to a specific risk threat, which could be evaluated on the base of historical, geographical, geo-seismic data. In all cases, the risk function R i (r) of the site r related to the risk agency i, say R i (r), can be expressed as follows: where V i (r) is a suitable, normalized function estimating the weight of the specific agent i in resulting a threat for the infrastructures (seismicity, presence of water basins, historical propensity of the terrain to landsliding etc.) integrated over a suitable area surrounding the CI element; P i (r) represents the sensitivity of the specific CI element to the threat i (for a given CI element located in the point r, the value P i (r) might be larger if i is the seismic threat rather than the flood threat caused by the nearby presence of water basins); I(r) (which is essentially independent on the threat i) is the sum of the impacts that the absence of the CI element in r produces upon failure in its network and in the other CI networks which are functionally related to that. We have distinguished a number of agents which could produce risk evidences for the CI elements. Among them: • geo-seismic risk; each CI element is evaluated as a function of its position in the seismicity map. In our database, we have the update italian seismic which is periodically updated by the National Institute of Geophysics and Volcanology (INGV) (5).
• landslide risk; each CI element is evaluated as a function of its position in the italian inventory of landslides (resulting from the ISPRA project IFFI (6) ).
• water basins proximity risk; each CI element is evaluated as a function of its position with respect to the regional water basin. Integration in Eq.(1) is performed over a circle of a radius which could be varied (from few hundreds meters up to a few kilometers, in the proximity of rivers with large discharge. The impact value can be estimated as being the reduction of the Quality of Service (QoS) of the specific service provided by the network containing the faulted element. However MIMESIS attempts to evaluate also the economic and social impact that the QoS loss implies.

Dynamic risk analysis
Analogously to "static" risk analysis, a time-dependent assessment of the risks to which CI elements are exposed can be performed by predicting, at the short-and medium-time scales, the amount of precipitations expected in a given area. Severe rainfalls are, in fact, meteorological events which can produce flooding of water basins and/or determine landslides in prone grounds. The MIMESIS system daily produces an high-resolution weather forecast with precipitation mamaps of 1 square kilometre. The numerical models involved in weather and climatological predictions will be will be described in section 3. Then, static analysis should be updated by evaluating the risk values upon the application of precipitation data. In fact, the value R i (r) of Eq. 1 could be recalculated by modifying the function V(r). Let consider V(r) as the current flow of a river. Upon consistent precipitations, the river flow could increase and the integration of the function V(r) over a given area could produce an higher, over-threshold value for the risk value R i (r). For the landslide risk threat, the V(r) function could measure the extent of the correlation (captured from historical data) precipitation abundance/landslide propensity. When precipitations are abundant, a large landslide probability could be triggered in a specific area (that comprised in the integration of V(r) in Eq. 1) and the risk function R i (r) consequently increase.

GIS database and the interface
The GIS database is designed to store, query, and manipulate geographic information and spatial data. Inside a geodatabase, the feature classes are organized as datasets, a collection of data presented in tabular form. Data are stored together in a relational database where geospatial data are defined by vectorial representation. In the vector based model, the basic units of spatial information are points, lines and polygons, each of these is made up only as a series of one or more coordinate points. The database contains also the topological information of a network which is necessary for the topological algorithm analysis network developed in MIMESIS. The application is based on Intergraph's GeoMedia Object Model, which supplies the function for representation and analysis of GIS data. The interface presents a layer-based representation shown in Figure 2 In the layer-based approach, the spatial data are presented in a set of thematic maps, called layers, which denote some given theme such as electrical network, telecommunication network, rivers, railways, roads etc. Each layer is a geo-referenced data set and associated with a table of the geodatabase containing also the attributes of geographic data. MIMESIS proposes a dynamic GIS representation adding space-temporal information to represent the evolution of a scenario. Indeed, the interface allows to control the DSS and to show the results. As the DSS evaluates the impact of faults at the topological and functional level of the CIs by using federated simulators, the interface shows the consequences of crisis scenarios enabling to detect hidden interdependencies between the different infrastructure.

Weather and climate numerical models
Weather forecast and climate prediction must be considered as a key component of the new class of Decision Support System described in this work of Decision Support System. Weather forecast provides detailed and reliable short-term spatial analysis of mesoscale weather events, while climate predictions provide long-term climate change indicators at a lower spatial resolution. Weather forecast will be used in the MIMESIS DSS for the assessment of the so called dynamic risk, while climate predictions are more suitable for the generation of crisis scenario at a larger time scale and for assessing the impact of climate for designing new interventions and extension of the existing infrastructures. Both numerical weather forecast and climate prediction involve the use of mathematical models of the atmosphere, represented by a set of discretized dynamical equations and by local deterministic parameterizations of physical processes occurring at sub-grid scales. Such processes are supposed to be in statistical equilibrium with the resolved-scale flow and are, therefore, treated as to their mean impact on the resolved scales. Climate, seasonal and weather models are basically identical in structure, independent of the specific time scale for which they have been developed, and often share the dynamical core and physical parameterizations. Differences only lie in the resolution at which models are run, which may imply specific tuning of the sub-grid representation, although the mathematical core of the two approaches is conceptually distinct. Climate is, by definition, the statistical mean state of the Earth system with its associated variability. Therefore, numerical simulation of climate, as performed by General Circulation Models (GCMs), is a boundary condition problem, and changes in the system equilibrium derive from slow changes in boundary forcing (such as the sea surface temperature, the solar constant or the greenhouse gas concentration). On the other hand, Numerical Weather Prediction models (NWPs) are used to predict the weather in the short (1-3 days) and medium (4-10 days) range and depend crucially on the initial conditions. For instance, small errors in the sea surface temperature or small imbalances in the radiative transfer have a small impact on a NWP model but can dramatically impair GCM results.
To partly overcome this problem, coupled Atmosphere-Ocean models (AOGCMs) have been developed. In order to allow an adequate description of the system phase space the GCM simulation runs would last tens of years. The consequent computational cost limits the spatial resolution of climate simulations, so that local features and extreme events, which are crucial to good weather predictions are, by necessity, embedded in sub-grid process parameterizations.
A similar restriction holds for global Weather Prediction Models (WPMs) that are currently run at different meteorological centers around the world, whose prediction skill is enhanced by performing several model forecasts starting from different perturbations of the initial conditions (ensemble forecasting), thus severely increasing computational requirements. Future high resolution projections of both climate and weather rely on three classes of regionalization techniques from larger scale simulations: high-resolution "time-slice" Atmosphere GCM (AGCM) experiments (8), nested regional numerical models (9), and statistical downscaling (10), each presenting its own advantages and disadvantages. At present, dynamical downscaling by nested limited area models is the most widely adopted method for regional scenario production, its reliability being possibly limited by unavoidable propagation of systematic errors in the driving global fields, neglecting of feedbacks from the local to the global scales and numerical noise generation at the boundaries. This technique, however, possesses an unquestionable inherent capacity to fully address the problem of weather prediction and climate change at finer resolutions than those allowed by general circulation models, as it allows local coupling among different components of the Earth system at a reasonable computational cost.

Impacts and risks prediction
Recently there has been a growing concern for the quality and reliability of both weather and climate predictions, which are expected to improve the planning and management of several economic, social and security sectors (i.e. agriculture, energy production, tourism, transport). Either on long or on short time scales, our ability to predict atmospheric phenomena clearly has a direct impact on sensitive issues, such as water resource management and hydro-geological risk assessment. However, these issues intrinsically depend on a variety of additional phenomena, e.g. processes determining soil quality, vegetation type and extension, and water demand and distribution. Therefore, resource availability and risk control are the integrated result of natural events, socio-economical interactions and political decision, and only interdisciplinary strategies can tackle the definition of priorities and means of intervention. Following this approach, the UK Met Office has addressed, in conjunction with key energy players, the problem of responding to the challenge of climate change in the areas of energy transmission and distribution, network planning, energy trading and forecasting (11). The main findings of the project regarded network design standards, including changes in risk profiles for critical elements such as transformers, cables and conductors, the reduction in thermal plant output, the wind power potential and the vulnerability of infrastructures to extreme events such as snow and windstorms. The project also assessed changes in energy demand (gas and electricity). On the long time scale the analysis provided energy companies with guidelines on how to deal with climate projections and their related uncertainties. This approach is also advisable for the rest of Europe, recognized as a hot spot in the last Intergovernmental Panel on Climate Change (IPCC) report (12), (13), which further urged the scientific community to undertake the difficult, but inescapable, task of supporting governments and authorities for a responsible environmental and economic planning. The IPCC report states that nearly all European regions are expected to be negatively affected by future impacts of climate change and these will pose challenges to many economic sectors. Climate change is expected to magnify regional differences in Europe's natural resources and assets. Negative impacts will include increased risk of inland flash floods, and more frequent coastal flooding and increased erosion (due to storminess and sea-level rise). In Southern Europe, climate change is projected to worsen conditions (high temperatures and drought) in a region already vulnerable to climate variability, and to reduce water availability, hydropower potential, summer tourism and, in general, crop productivity. It is also projected to increase health risks due to heat waves and the frequency of wildfires (14). Such dramatic changes are attributed to the anthropogenic warming arising from augmented carbon dioxide emissions, which have a discernible influence on many physical and biological systems, as documented in data since 1970 and projected by numerical models. Carbon dioxide and the other greenhouse gases affect the atmospheric absorption properties of longwave radiation, thus changing the radiation balance. An immediate impact of this altered energy balance is the warming of the lower troposphere (an increase of the global temperature of about 0.6 • C has been observed over approximately the last 50 years) that, in turn, affects the atmospheric hydrological cycle. Although extremely relevant as to their effects on human activities, hydrological processes are still poorly modeled, and projections are affected by severe uncertainties. Climate models can hardly represent the occurrence probability and the duration of extreme rainfall or drought events, even in today's climate conditions (15), so that governmental authorities now explicitly demand innovative science-based approaches to evaluate the complexity of environmental phenomena.

Hydrological impacts
From the point of view of weather forecast on shorter time scales (from daily to seasonal), a reliable representation of the hydrological cycle is also essential for the early warning of extreme events and the evaluation of their short-term impacts. Heavy rain may cause considerable compaction and erosion of the soil by its force of impact, sealing the soil surface and channeling the water to run off the surface carrying away the topsoil with it. Considering hilly and mountainous areas, heavy rain may produce enormous erosion by mudflow generation, while rainwater running off hard impervious surfaces or waterlogged soil may cause local flooding (16). At the other extreme, the early prediction of drought events deriving from extreme rainfall deficits would also greatly benefit from accurate forecasts of the relevant hydrological variables. As a matter of fact, drought is, unlike aridity, a temporary phenomenon characterized by high spatial variability (17), whose representation could be effectively approached with high resolution regional models.
In order to extend their ability to describe the hydrological cycle, river routing modules are currently being incorporated in atmospheric models in order to link the meteorological forcing (in particular rainfall) to the hydrological response of a catchment. Together with land modules (which mimic the interactions between the atmosphere and the biosphere) they represent an alternative to the rainfall-runoff models which, in recent years, have been employed in a wide range of applications to assess impacts of weather, climate or land-use change on the hydrological cycle (18), (19). As atmospheric models are routinely run in either meteorological or climatological applications, such an extension is likely to be a feasible and economic way to help hydrologists to derive quantitative figures about the impacts of the observed or expected environmental changes. It should be stressed again, however, that the impact studies, which follow up model projections, are definitely in need of complex systems capable of crossing information from different disciplines and of managing huge amounts of data. The uncertainty involved in this type of impact assessment limits the value of the results and great care should be taken in evaluating model skill in predicting the driving meteorological variables. Precipitations, the main atmospheric driver of hydrological catchment response, are unfortunately still a critical output of model diagnostics (20). Although the complexity of cloud parameterizations is always increasing, this is no guarantee of improved accuracy, and better representation of clouds within NWP models has been the focus of recent research (21), (22), (23), (24). Numerical models explicitly resolve cloud and precipitation processes associated with fronts (large scale precipitation), while parametrizing small scale phenomena by means of the large-scale variables given at the model's grid points. The most important parameters are humidity, temperature and vertical motion. The vertical velocity determines the condensation rate and, therefore, the supply of liquid water content. Temperature also controls the liquid water content, via the determination of the saturation threshold. Moreover, the temperature distribution within a cloud is also important in determining the type of precipitation -rain or snow. The complexity of the parameterization of cloud processes is limited by the associated numerical integration time (25). Model spatial resolution is crucial for a reliable treatment of condensation processes, as vertical motion of air masses is often forced by orography, whose representation therefore needs to be as accurate as possible. Again, regional models, due to their higher spatial resolution and reduced computational costs, seem to be the most appropriate tool for downscaling precipitation fields, at the same time preserving the complexity of convection parameterization. However, the reliability of precipitation forecasts provided by state-of-the art meteorological models also depends on their ability to reproduce the sub-grid rain rate fluctuations which are not explicitly resolved.
In particular, the assessment of precipitation effects on the hydrological scales requires an accurate characterization of the scaling properties of precipitation, which is essential for assessing the hydrological risk in small basins, where there is a need to forecast watershed streamflows of a few hundred square kilometres or less, characterized by a concentration time of a few hours or less. At these smaller space time scales, and specifically in very small catchments and in urban areas, rainfall intensity presents larger fluctuations, and therefore higher values, than at the scale of meteorological models (26). In order to allow a finer representation of land surface heterogeneity than that allowed by nominal grid resolution, mosaic-type schemes are being investigated, which account for topographical corrections in the sub-grid temperature and pressure fields and downscale precipitation via a simple statistical approach. Such schemes allow simple implementation of space dependent probability distribution functions that may result from ongoing research on statistical downscaling of precipitation (27). As already mentioned, a stochastic approach has also been successful in improving precipitation forecast reliability as to its large scale statistical properties. In the last decade, ensemble prediction systems have substantially enhanced our ability to predict precipitation and its associated uncertainty (28). It has been shown that such systems are superior to single deterministic forecasts for a time range up to two weeks, as they account for errors in the initial conditions, in the model parameterizations and in the equation discretization that might cause the flow-dependent growth of uncertainty during a forecast (29), (30), (31). At the same time, multi-model ensemble approaches have been indicated as a feasible way to account for model errors in seasonal and long-term climate studies (see Figure 3). It has been proved that, under the assumption that simulation errors in different models are independent, the ensemble mean outperforms individual ensemble members (29), (32), (33). By sampling modeling uncertainties, ensembles of GCMs should provide an improved basis for probabilistic projections compared to an ensemble of single model realizations, as the latter only samples different initial conditions, i.e. a limited portion of a specific model phase space. Ensemble predictions are therefore increasingly being used as the drivers of impact forecasting systems (34), (35), (20), thus reinforcing the already pressing demand for complex numerical systems that allow rapid inter-comparison between model realizations and multivariate data analysis.

Crisis scenario generator and impact evaluation
Once the risk assessment of the different CI elements is concluded and, after that, the state of risk of one (or more) elements of one (or more) infrastructures have taken over a pre-defined threshold, the system produces an alarm and defines a "crisis scenario". If one defines the generic k-th given infrastructure the set G k (Ω) of elements (nodes and arcs, together with the network which connects them), we define a "crisis scenario" a new set G k (Ω ′ ) where Ω ′ is the set of constitutive elements of the infrastructure k without the elements (nodes and/or arcs) which have been supposed to be lost (or damaged) because the above threshold risk value. MIMESIS first performs a topological analysis in order to see whether the network of the infrastructure is still topologically connected and determines which are the new topological "critical" points of the network. Topological analysis of the network is carried out through the evaluation of the following quantities (7): • nodes and links centrality indices (Betweenneess centrality, Information centrality); • network's diameter, min paths, min cuts; • spectral analysis of the Adjacency and Laplacian matrices associated to the network.
Topological analysis is a first mean to assess the integrity of the network. The presence of disconnected components of the graph can be easily seen by evaluating the eigenvalues of the Laplacian matrix associated to the network. If the graph G(associated to the network) has n vanishing eigenvalues, the graph has n different disconnected components. Centrality measures tend to identify which are the most relevant elements (nodes, arcs) of the network. Node i Information centrality, for instance, determines which is the increase of the min paths among all the other nodes if node i is lost (when network i is lost, the min paths connecting all other nodes originally passing through i should be re-evaluated and they will produce new min paths larger than the original ones). As far Information Centrality is concerned, larger is the Information Centrality, larger is the importance of the node to provide "good connections" among all the others. After a first assessment of the perturbed network upon topological analysis, the MIMESIS tool performs the most relevant action: the estimate of the reduction of the Quality of Services produced by the perturbation occurred to the network due to the faults in one or more of its elements. This task is accomplished by using "domain" or "federated" simulators of CIs. For domain simulators we intend commercial or open source simulators of specific infrastructures: electrical (such as Powerworld, E-Agora, Sincal etc.), telecommunications (NS2), railways (OpenTrack) etc. Federating domain simulator is one of the major achievements granted by a strong collaboration among the european CIP scientific community (e.g. the projects IRRIIS (36) and DIESIS (37)). For federated simulators we intend a new class of simulators which "couple" two or more domain simulators through some specific synchronization mechanisms and some interdependency rules which allows to describe how, and to what extent, a CI determines the functioning of another. MIMESIS integrates the outcome of one of the most successful EU FP7 projects, the DIESIS project (37) which has attempted to design a general model which could allow to integrate more domain simulators in an unique framework. The key role in the DIESIS mode is played by the ontology model (KBS) which is able, to an abstract level, to describe a generic Critical Infrastructure and its links with other Infrastructures. A generic element of a network from this abstract space can be subsequently "mapped" into the real space of a specific Critical Infrastructure (electrical, telecommunication or others) by adapting the generic elements to the specific case. The ontology model allows to avoid the problem of directly connecting systems which have different structures, different constitutive elements, different functioning laws: Integration is firstly performed in a "meta-space" (the abstract space of Critical Infrastructures) (38) and then mapped into the spaces of the single infrastructures. A brief sketch of the KBS approach is outlined in the following section.

The DIESIS ontological approach for CI simulators integration
Within the DIESIS project, a framework for CIs simulators integration has been proposed that allows the separation of the scenario representation (Scenario Definition Phase) from the simulation framework (Federated Simulation Phase). The main idea is to develop a Knowledge Base System (KBS) based on ontologies and rules providing the semantic basis for the federated simulation framework (40), (41).
In particular, a federation of simulators can be considered as a System of Systems where each simulator represents an independent entity with its own behavior and purpose. The super-system considers the interaction of these entities and puts in evidence an emergent behavior that does not reside in any component system (42). Therefore, in a federated simulation, the stand-alone simulators must be linked together so that an understandable and meaningful information exchange could be performed. This requires that simulators could interact and cooperate. The proposed ontological approach allows both an uniform modeling of heterogeneous infrastructures and the easy representation of inter-domain dependencies. The with and The KBS architecture includes the following ontology definitions: • World ONTology (WONT); • Infrastructure domain ONTologies (IONTs); • Federation ONTology (FONT).
The WONT is a general template providing the basic structures and rules to define CI domains. In particular, the WONT allows the definition of CI domain elements (through the WONT class Component), their physical and logical interconnections (through the WONT object property isConnected) and the dependencies among different CI domains (through the WONT object property dependsON). The IONTs inherit the basic template from the WONT and represent the specific knowledge of the critical infrastructure domains. For instance, the electric IONT class Load (that models the electric load element) and the telecommunication IONT class Switch (that models the telecommunication switch element) are subclasses of the WONT class Component. In addition, the railway IONT property isLinked that models the connection between two railway stations is a sub-property of the WONT property isConnected; similarly, the telecommunication IONT property transmits that models the connection between a transmitter and a receiver is another sub-property of the WONT property isConnected. Analogously, all dependencies among the considered CI domains are modeled through ad-hoc designed sub-properties of the WONT property dependsON. In the following, given a CI domain X i , C i indicates the set of all components of X i and Pr i indicates the set of properties related to the components of X i . Then, a generic IONT can be represented as Once the IONT has been defined to model a particular domain, it is possible to create individuals (instances of IONT classes) to represent actual network domains (for example the electrical power network or the telecommunication network of a specific city district).
Similarly to the IONT definitions, we indicate with C * i the set of the all instantiated components belonging to the domain X i and with Pr * i the set of instantiated properties related to X i . Then, the IONT instance IONT * i can be expressed as The FONT includes all IONTs of the domains involved in the considered scenario (e.g. electrical, telecommunication, railway domains). The FONT properties (sub-properties of the WONT property dependsON) allow to model dependencies among components of different domains (e.g. the FONT property feedsTelco models the electrical supply of telecommunication nodes). The sets of the FONT properties and of the FONT instantiated properties are defined respectively as: and The Figure 4 summarizes the proposed KBS architecture The FPr * allows the definition of FONT rules that express the semantic dependency. The FONT rules, expressed using the Semantic Web Rule Language (SWRL), have been actually translated into their JAVA counterpart and implemented through "if-then-else" constructs embedded within the Federation Managers which incapsulate the simulators of each CI domain ( (39)). The DIESIS distributed simulation framework using the KBS allows the components (involved in the defined FONT properties) to exchange the functioning status values.

Conclusions
CIP is a major concern of modern nations. EU has issued a Directive (3) to increase awareness of this duty as CIs are become transnational bodies whose care must be a shared concern. Whether markets liberalization has produced, at least in principle, benefits for the consumers, it has de facto imposed a deep revision of the governance strategies of the major national infrastructures. In many countries, there has been a (sometimes sudden) fragmentation of the ownership and the management of relevant parts of infrastructures (see, for instance, those of gas and oil distribution, telecommunications, electrical transmission and distribution, motorways and railways) which has strongly weakened the centralized governance model which has been substituted with a model of "diffused" governance of the infrastructures. Many different industrial players autonomously own and manage parts of the infrastructures, leading its global control more complex. The lack of information sharing among operators of different parts of the infrastructures, due in some cases to industrial competition reasons, reduces the technical control of the whole infrastructure and, even more, reduces the possibility of a control of the "systems of systems" defined by the entanglement of all interconnected CIs.
The new generation of analysis and risk prediction of CIs, whose the system MIMESIS would be a prototype, is intended to overcome the above mentioned drawbacks imposed by modern market policies and the increased CIs interdependency. The MIMESIS system has its core in weather and climate predictions and by new hydrological models. In a future perspective of rapid and (sometimes) strong climatic changes and the occurrence of a large fraction of extreme events, prediction capabilities will be a winning asset against the occurrence of large and uncontrolled outages of one or more CIs. Far from being usable only for assessing risk prediction related to meteo-climatic events, MIMESIS could also be used for "reverse engineering" actions related to CIP against external malicious attacks. MIMESIS could, in fact, be used to estimate the most vulnerable points of the networks, not only in relation to their single topology and functions, but also with respect to the role they play in the wider context within the cited "system of systems". An attentive "off-line" use of the tool through the insertion of random faults could reveal which types of faults produces largest perturbations to the systems, leading to suggestions in the network's Security area.
Other than being a prediction tool for external events, MIMESIS could also be used to correctly design new branches of existing infrastructures, by allowing the ex ante evaluation of their impact on the Quality of Services of all the system of interdependent infrastructures. We do believe that data availability by CI owners, their integration with other types of data (geophysical, economic, administrative etc.), the use of advanced numerical simulation tools for weather and climatic predictions, the use of CI simulators (both single domain or "federated" simulators) could represent an invaluable clue to realize a new generation of tools for increasing protection and enhancing security of CIs. This series is directed to diverse managerial professionals who are leading the transformation of individual domains by using expert information and domain knowledge to drive decision support systems (DSSs). The series offers a broad range of subjects addressed in specific areas such as health care, business management, banking, agriculture, environmental improvement, natural resource and spatial management, aviation administration, and hybrid applications of information technology aimed to interdisciplinary issues. This book series is composed of three volumes: Volume 1 consists of general concepts and methodology of DSSs; Volume 2 consists of applications of DSSs in the biomedical domain; Volume 3 consists of hybrid applications of DSSs in multidisciplinary domains. The book is shaped decision support strategies in the new infrastructure that assists the readers in full use of the creative technology to manipulate input data and to transform information into useful decisions for decision makers.