Introducing hybrid threats and composite vulnerabilities to increase security in building automation

Michael Gerhalter; Keshav Dahal

doi:10.1109/SKIMA66621.2025.11155818

Introducing hybrid threats and composite vulnerabilities to increase security in building automation

Michael Gerhalter
, Keshav Dahal

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

50 Downloads (Pure)

Abstract

In warfare, it is known that hybrid threats are created by mixing cyber, physical and organizational threats, while asymmetric weaknesses allow attackers to exploit system vulnerabilities with minimal effort. When securing critical infrastructure, such considerations are already being made in some cases, with the aim of improving the resilience of the systems used accordingly. In the field of cyber-physical systems, such considerations have rarely been made to date, and certainly not in building automation. This document attempts to transfer the existing knowledge of composite vulnerabilities and asymmetric threats from other areas to the field of building automation.

Original language	English
Title of host publication	2025 International Conference on Software, Knowledge, Information Management & Applications (SKIMA)
Place of Publication	Piscataway, NJ
Publisher	IEEE
Number of pages	6
ISBN (Electronic)	9781665457347
ISBN (Print)	9781665457354
DOIs	https://doi.org/10.1109/SKIMA66621.2025.11155818
Publication status	Published - 16 Sept 2025
Event	16th International Conference on Software, Knowledge, Information Management & Applications - University of the West of Scoltand, Paisley, United Kingdom Duration: 9 Jun 2025 → 11 Jun 2025 https://skimanetwork.org/

Conference

Conference	16th International Conference on Software, Knowledge, Information Management & Applications
Abbreviated title	SKIMA 2025
Country/Territory	United Kingdom
City	Paisley
Period	9/06/25 → 11/06/25
Internet address	https://skimanetwork.org/

Keywords

digital twin
intelligent buildings
Modbus
M-Bus
BACnet
KNX
BACS
attack vector
risk appetite

Access to Document

10.1109/SKIMA66621.2025.11155818

2025 04 08 Gerhalter et al Hybrid accepted - for PureAccepted author manuscript, 357 KBLicence: CC BY 4.0

Cite this

@inproceedings{90a65506a42e4d039efebed34988482a,

title = "Introducing hybrid threats and composite vulnerabilities to increase security in building automation",

abstract = "In warfare, it is known that hybrid threats are created by mixing cyber, physical and organizational threats, while asymmetric weaknesses allow attackers to exploit system vulnerabilities with minimal effort. When securing critical infrastructure, such considerations are already being made in some cases, with the aim of improving the resilience of the systems used accordingly. In the field of cyber-physical systems, such considerations have rarely been made to date, and certainly not in building automation. This document attempts to transfer the existing knowledge of composite vulnerabilities and asymmetric threats from other areas to the field of building automation.",

keywords = "digital twin, intelligent buildings, Modbus, M-Bus, BACnet, KNX, BACS, attack vector, risk appetite",

author = "Michael Gerhalter and Keshav Dahal",

year = "2025",

month = sep,

day = "16",

doi = "10.1109/SKIMA66621.2025.11155818",

language = "English",

isbn = "9781665457354",

booktitle = "2025 International Conference on Software, Knowledge, Information Management \& Applications (SKIMA)",

publisher = "IEEE",

address = "United States",

note = "16th International Conference on Software, Knowledge, Information Management \& Applications, SKIMA 2025 ; Conference date: 09-06-2025 Through 11-06-2025",

url = "https://skimanetwork.org/",

}

Gerhalter, M & Dahal, K 2025, Introducing hybrid threats and composite vulnerabilities to increase security in building automation. in 2025 International Conference on Software, Knowledge, Information Management & Applications (SKIMA)., 11155818, IEEE, Piscataway, NJ, 16th International Conference on Software, Knowledge, Information Management & Applications, Paisley, United Kingdom, 9/06/25. https://doi.org/10.1109/SKIMA66621.2025.11155818

TY - GEN

T1 - Introducing hybrid threats and composite vulnerabilities to increase security in building automation

AU - Gerhalter, Michael

AU - Dahal, Keshav

PY - 2025/9/16

Y1 - 2025/9/16

N2 - In warfare, it is known that hybrid threats are created by mixing cyber, physical and organizational threats, while asymmetric weaknesses allow attackers to exploit system vulnerabilities with minimal effort. When securing critical infrastructure, such considerations are already being made in some cases, with the aim of improving the resilience of the systems used accordingly. In the field of cyber-physical systems, such considerations have rarely been made to date, and certainly not in building automation. This document attempts to transfer the existing knowledge of composite vulnerabilities and asymmetric threats from other areas to the field of building automation.

AB - In warfare, it is known that hybrid threats are created by mixing cyber, physical and organizational threats, while asymmetric weaknesses allow attackers to exploit system vulnerabilities with minimal effort. When securing critical infrastructure, such considerations are already being made in some cases, with the aim of improving the resilience of the systems used accordingly. In the field of cyber-physical systems, such considerations have rarely been made to date, and certainly not in building automation. This document attempts to transfer the existing knowledge of composite vulnerabilities and asymmetric threats from other areas to the field of building automation.

KW - digital twin

KW - intelligent buildings

KW - Modbus

KW - M-Bus

KW - BACnet

KW - KNX

KW - BACS

KW - attack vector

KW - risk appetite

U2 - 10.1109/SKIMA66621.2025.11155818

DO - 10.1109/SKIMA66621.2025.11155818

M3 - Conference contribution

SN - 9781665457354

BT - 2025 International Conference on Software, Knowledge, Information Management & Applications (SKIMA)

PB - IEEE

CY - Piscataway, NJ

T2 - 16th International Conference on Software, Knowledge, Information Management & Applications

Y2 - 9 June 2025 through 11 June 2025

ER -

Introducing hybrid threats and composite vulnerabilities to increase security in building automation

Abstract

Conference

Keywords

Access to Document

Fingerprint

Cite this