{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,7]],"date-time":"2026-10-07T16:04:57Z","timestamp":1791389097091,"version":"4.3.3"},"reference-count":51,"publisher":"Springer Science and Business Media LLC","issue":"6","license":[{"start":{"date-parts":[[2025,9,2]],"date-time":"2025-09-02T00:00:00Z","timestamp":1756771200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2025,9,2]],"date-time":"2025-09-02T00:00:00Z","timestamp":1756771200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"name":"Alma Mater Studiorum - Universit\u00e0 di Bologna"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Empir Software Eng"],"published-print":{"date-parts":[[2025,12]]},"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>Industrial Operational Technology (OT) environments face escalating cybersecurity challenges due to increasing interconnectedness, device heterogeneity, and the integration of legacy systems not designed with modern security requirements. Operators struggle with security validation in OT settings due to the complexity of static reasoning across multilayered architectures and the impracticality of in-production testing, which risks operational disruptions and safety hazards. To address these limitations, we propose SAFARI, a framework that leverages the concepts of digital twin and cyber range to enable Security-Investigation-as-Code for OT environments, automating the creation, deployment, and security testing of faithful OT architecture replicas. SAFARI uses technologies such as Terraform, Proxmox SDN, and MITRE Caldera to provide scalable, reproducible security assessment capabilities while maintaining complete air-gapping for safe malware testing. We demonstrate SAFARI\u2019s effectiveness through a comprehensive case study examining three industrial network architectures exhibiting increasing segmentation. Our results show that SAFARI successfully automates complex security scenarios, enables regression testing of architectural refinements, and provides quantifiable insights into attack resistance improvements. The framework represents a significant advancement in OT security testing methodology, offering security operators a practical tool for systematic vulnerability assessment and architectural validation without compromising operational continuity.<\/jats:p>","DOI":"10.1007\/s10664-025-10713-2","type":"journal-article","created":{"date-parts":[[2025,9,2]],"date-time":"2025-09-02T06:39:03Z","timestamp":1756795143000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":3,"title":["Investigating operational technology attacks as code"],"prefix":"10.1007","volume":"30","author":[{"given":"Franco","family":"Callegati","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Saverio","family":"Giallorenzo","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0101-2551","authenticated-orcid":false,"given":"Andrea","family":"Melis","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Simone","family":"Melloni","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Marco","family":"Prandini","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Alessandro","family":"Vannini","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2025,9,2]]},"reference":[{"key":"10713_CR1","unstructured":"Abbas SG, Ozmen MO, Alsaheel A, Khan A, Celik ZB, Xu D (2024) In: 33rd USENIX Security Symposium (USENIX Security 24), pp 6597\u20136613"},{"key":"10713_CR2","unstructured":"Abuelenain K, Doyle J, Karneliuk A, Jain V (2021) Network programmability and automation fundamentals. Cisco Press"},{"key":"10713_CR3","doi-asserted-by":"publisher","unstructured":"Almulla ZT, Rahman H (2025) In: 2025 International Conference on Artificial Intelligence in Information and Communication (ICAIIC), pp 0342\u20130347. https:\/\/doi.org\/10.1109\/ICAIIC64266.2025.10920695","DOI":"10.1109\/ICAIIC64266.2025.10920695"},{"issue":"1","key":"10713_CR4","first-page":"1499","volume":"16","author":"HA Al-Ofeishat","year":"2024","unstructured":"Al-Ofeishat HA, Alshorman R (2024) Int J Comput Appl 16(1):1499","journal-title":"Int J Comput Appl"},{"key":"10713_CR5","doi-asserted-by":"publisher","unstructured":"Arifeen M, Petrovski A, Petrovski S (2021) In: 2021 International Conference on Security of Information and Networks (SIN). https:\/\/doi.org\/10.1109\/sin54109.2021.9699232","DOI":"10.1109\/sin54109.2021.9699232"},{"key":"10713_CR6","doi-asserted-by":"crossref","unstructured":"Awuson-David K, Thompson J, Tuner K, Al-Hadhrami T (2022) In: Saeed F, Mohammed F, Ghaleb F (eds) Advances on intelligent informatics and computing. Springer International Publishing, Cham, pp 461\u2013472","DOI":"10.1007\/978-3-030-98741-1_38"},{"key":"10713_CR7","doi-asserted-by":"crossref","unstructured":"Barkmeyer E, Barkmeyer E, Wallace EK (2016) Reference architecture for smart manufacturing part 1: functional models. US Department of Commerce, National Institute of Standards and Technology","DOI":"10.6028\/NIST.AMS.300-1"},{"key":"10713_CR8","doi-asserted-by":"crossref","unstructured":"Basta N, Ikram M, K\u00e2afar MA, Walker A (2022) In: Proceedings of the 2022 international symposium on security, pp 1\u20137","DOI":"10.1109\/NOMS54207.2022.9789888"},{"key":"10713_CR9","doi-asserted-by":"publisher","unstructured":"Berardi D, Callegati F, Giovine A, Melis A, Prandini M, Rinieri L (2023) Future Internet 15(3). https:\/\/doi.org\/10.3390\/fi15030095. https:\/\/www.mdpi.com\/1999-5903\/15\/3\/95","DOI":"10.3390\/fi15030095"},{"key":"10713_CR10","unstructured":"Brikman Y (2022) Terraform: up and running. O\u2019Reilly Media, Inc"},{"key":"10713_CR11","doi-asserted-by":"publisher","first-page":"110015","DOI":"10.1016\/j.comnet.2023.110015","volume":"236","author":"S Chaudhary","year":"2023","unstructured":"Chaudhary S, Mishra PK (2023) Comput Netw 236:110015","journal-title":"Comput Netw"},{"key":"10713_CR12","doi-asserted-by":"publisher","unstructured":"Compagnucci T, Callegati F, Giallorenzo S, Melis A, Melloni S, Vannini A (2025) SAFARI: a scalable air-gapped framework for automated ransomware investigation. https:\/\/doi.org\/10.1007\/978-3-031-92882-6_15","DOI":"10.1007\/978-3-031-92882-6_15"},{"key":"10713_CR13","doi-asserted-by":"publisher","unstructured":"d\u2019Ambrosio N, Capodagli G, Perrone G, Romano SP (2025) Comp Sec 151:104315. https:\/\/doi.org\/10.1016\/j.cose.2025.104315","DOI":"10.1016\/j.cose.2025.104315"},{"issue":"12","key":"10713_CR14","doi-asserted-by":"publisher","first-page":"11553","DOI":"10.1109\/TII.2023.3246983","volume":"19","author":"A De Benedictis","year":"2023","unstructured":"De Benedictis A, Flammini F, Mazzocca N, Somma A, Vitale F (2023) IEEE Trans Industr Inf 19(12):11553. https:\/\/doi.org\/10.1109\/TII.2023.3246983","journal-title":"IEEE Trans Industr Inf"},{"issue":"2","key":"10713_CR15","doi-asserted-by":"publisher","first-page":"198","DOI":"10.1109\/TIT.1983.1056650","volume":"29","author":"D Dolev","year":"1983","unstructured":"Dolev D, Yao A (1983) IEEE Trans Inf Theory 29(2):198","journal-title":"IEEE Trans Inf Theory"},{"key":"10713_CR16","doi-asserted-by":"crossref","unstructured":"Erba A, Tippenhauer NO (2022) In: Proceedings of the 38th annual computer security applications conference, pp 412\u2013426","DOI":"10.1145\/3564625.3564633"},{"key":"10713_CR17","unstructured":"Formby D, Rad M, Beyah R (2018) In: 2018 USENIX Workshop on Advances in Security Education (ASE 18). USENIX Association, Baltimore, MD. https:\/\/www.usenix.org\/conference\/ase18\/presentation\/formby"},{"key":"10713_CR18","unstructured":"Giuliano V, Formicola V (2019) Icsrange: a simulation-based cyber range platform for industrial control systems. https:\/\/arxiv.org\/abs\/1909.01910"},{"key":"10713_CR19","unstructured":"Goldman R (2016) Learning proxmox VE. Packt Publishing Ltd"},{"key":"10713_CR20","doi-asserted-by":"publisher","unstructured":"Grasselli C, Melis A, Rinieri L, Berardi D, Gori G, Sadi AA (2022) In: 2022 International Symposium on Networks, Computers and Communications (ISNCC), pp 1\u20137. https:\/\/doi.org\/10.1109\/ISNCC55209.2022.9851731","DOI":"10.1109\/ISNCC55209.2022.9851731"},{"key":"10713_CR21","doi-asserted-by":"publisher","unstructured":"Hollerer S, Brenner B, Bhosale PR, Fischer C, Hosseini AM, Maragkou S, Papa M, Schlund S, Sauter T, Kastner W (2023) Challenges in OT security and their impacts on safety-related cyber-physical production systems. Springer Berlin Heidelberg, Berlin, Heidelberg, pp 171\u2013202. https:\/\/doi.org\/10.1007\/978-3-662-65004-2_7","DOI":"10.1007\/978-3-662-65004-2_7"},{"key":"10713_CR22","doi-asserted-by":"publisher","first-page":"37","DOI":"10.1016\/j.ijcip.2008.08.003","volume":"1","author":"P Huitsing","year":"2008","unstructured":"Huitsing P, Chandia R, Papa M, Shenoi S (2008) Int J Crit Infrastruct Prot 1:37","journal-title":"Int J Crit Infrastruct Prot"},{"key":"10713_CR23","doi-asserted-by":"crossref","unstructured":"Ike M, Phan K, Sadoski K, Valme R, Lee W (2023) In: 2023 IEEE Symposium on Security and Privacy (SP). IEEE, pp 20\u201337","DOI":"10.1109\/SP46215.2023.10179411"},{"key":"10713_CR24","doi-asserted-by":"crossref","unstructured":"Jiang H, Choi T, Ko RK (2021) In: Security in computing and communications: 8th international symposium, SSCC 2020, Chennai, India, October 14\u201317, 2020, Revised Selected Papers 8. Springer, pp 1\u201320","DOI":"10.1007\/978-981-16-0422-5_1"},{"key":"10713_CR25","unstructured":"Kallatsa M (2024) arXiv preprint ArXiv:2401.xxxxx"},{"key":"10713_CR26","doi-asserted-by":"publisher","DOI":"10.1016\/j.compeleceng.2022.108061","volume":"101","author":"NK Kandasamy","year":"2022","unstructured":"Kandasamy NK, Venugopalan S, Wong TK, Leu NJ (2022) Comput Electrical Eng 101:108061. https:\/\/doi.org\/10.1016\/j.compeleceng.2022.108061","journal-title":"Comput Electrical Eng"},{"issue":"3","key":"10713_CR27","doi-asserted-by":"publisher","first-page":"49","DOI":"10.1109\/MSP.2011.67","volume":"9","author":"R Langner","year":"2011","unstructured":"Langner R (2011) IEEE Secur Privacy 9(3):49. https:\/\/doi.org\/10.1109\/MSP.2011.67","journal-title":"IEEE Secur Privacy"},{"issue":"6","key":"10713_CR28","doi-asserted-by":"publisher","first-page":"31","DOI":"10.1109\/MIM.2022.9847127","volume":"25","author":"RV Mahmoud","year":"2022","unstructured":"Mahmoud RV, Anagnostopoulos M, Pedersen JM (2022) IEEE Instr Meas Mag 25(6):31. https:\/\/doi.org\/10.1109\/MIM.2022.9847127","journal-title":"IEEE Instr Meas Mag"},{"key":"10713_CR29","doi-asserted-by":"publisher","unstructured":"Martin G, Ghafur S, Kinross J, Hankin C, Darzi A (2018) BMJ 361. https:\/\/doi.org\/10.1136\/bmj.k2381. https:\/\/www.bmj.com\/content\/361\/bmj.k2381","DOI":"10.1136\/bmj.k2381"},{"issue":"2","key":"10713_CR30","doi-asserted-by":"publisher","first-page":"689","DOI":"10.1007\/s10270-022-01075-0","volume":"22","author":"M Masi","year":"2023","unstructured":"Masi M, Sellitto GP, Aranha H, Pavleska T (2023) Softw Syst Model 22(2):689","journal-title":"Softw Syst Model"},{"key":"10713_CR31","doi-asserted-by":"publisher","unstructured":"Melis A, Piroddi A, Kaya O, Girau R (2024) In: 2024 IEEE 29th International Workshop on Computer Aided Modeling and Design of Communication Links and Networks (CAMAD), pp 1\u20136. https:\/\/doi.org\/10.1109\/CAMAD62243.2024.10942708","DOI":"10.1109\/CAMAD62243.2024.10942708"},{"key":"10713_CR32","unstructured":"MITRE Corporation (2024) Mitre att &ck framework. https:\/\/attack.mitre.org\/. Accessed Nov 2024"},{"key":"10713_CR33","unstructured":"MITRE Corporation (2024) Mitre caldera: automated adversary emulation platform. https:\/\/caldera.mitre.org\/. Accessed Nov 2024"},{"key":"10713_CR34","unstructured":"OpenWrt Team (2025) Openwrt. https:\/\/openwrt.org\/. Accessed Sept 2024"},{"key":"10713_CR35","doi-asserted-by":"publisher","unstructured":"Parian C, Guldimann T, Bhatia S (2020) Proc Comput Sci 171:2453. https:\/\/doi.org\/10.1016\/j.procs.2020.04.265. https:\/\/www.sciencedirect.com\/science\/article\/pii\/S1877050920312576. Third International Conference on Computing and Network Communications (CoCoNet\u201919)","DOI":"10.1016\/j.procs.2020.04.265"},{"key":"10713_CR36","unstructured":"Pickren R, Shekari T, Zonouz S, Beyah R (2024) In: Network and Distributed System Security (NDSS) Symposium"},{"key":"10713_CR37","doi-asserted-by":"publisher","unstructured":"Pokhrel A, Katta V, Colomo-Palacios R (2020) In: Proceedings of the IEEE\/ACM 42nd international conference on software engineering workshops. Association for Computing Machinery, New York, NY, USA. ICSEW\u201920, pp 671\u2013678. https:\/\/doi.org\/10.1145\/3387940.3392199","DOI":"10.1145\/3387940.3392199"},{"key":"10713_CR38","unstructured":"Proxmox Team (2025) Proxmox provider. https:\/\/registry.terraform.io\/providers\/Telmate\/proxmox\/latest\/docs. Accessed Sept 2024"},{"key":"10713_CR39","unstructured":"Proxmox Team (2025) Proxmox software-defined network. https:\/\/pve.proxmox.com\/pve-docs\/chapter-pvesdn.html. Accessed Sept 2024"},{"key":"10713_CR40","doi-asserted-by":"publisher","unstructured":"Rinieri L, Iacobelli A, Al\u00a0Sadi A, Melis A, Callegati F, Prandini M (2024) In: 2024 IEEE 10th international conference on Network Softwarization (NetSoft), pp 190\u2013194. https:\/\/doi.org\/10.1109\/NetSoft60951.2024.10588908","DOI":"10.1109\/NetSoft60951.2024.10588908"},{"key":"10713_CR41","doi-asserted-by":"publisher","unstructured":"S DPV, Sethuraman SC, Khan MK (2023) Comput Secur 135:103490. https:\/\/doi.org\/10.1016\/J.COSE.2023.103490","DOI":"10.1016\/J.COSE.2023.103490"},{"key":"10713_CR42","doi-asserted-by":"crossref","unstructured":"Schwab W, Poujol M (2018) Schneider electric","DOI":"10.15407\/as2018.03.04"},{"key":"10713_CR43","unstructured":"Setola R, Oliva G, Assenza G, Faramondi L (2020) Int J Syst Syst Eng 10"},{"key":"10713_CR44","doi-asserted-by":"crossref","unstructured":"Shang W, Qiao Q, Wan M, Zeng P (2016) J Softw, pp 432\u2013438","DOI":"10.17706\/jcp.11.5.432-438"},{"key":"10713_CR45","unstructured":"Sshuttle Team (2025) Sshuttle. https:\/\/github.com\/sshuttle\/sshuttle. Accessed Sept 2024"},{"key":"10713_CR46","doi-asserted-by":"publisher","unstructured":"Stouffer K, Pease M, Tang C, Zimmerman T, Pillitteri V, Lightman S, Hahn A, Saravia S, Sherule A, Thompson M (2023) Guide to operational technology (ot) security. NIST Special Publication NIST SP 800-82r3, US Department of Commerce, National Institute of Standards and Technology, Gaithersburg, MD, USA. https:\/\/doi.org\/10.6028\/NIST.SP.800-82r3","DOI":"10.6028\/NIST.SP.800-82r3"},{"key":"10713_CR47","doi-asserted-by":"publisher","unstructured":"Wagner N, \u015eahin C, Winterrose M, Riordan J, Pe\u00f1a J, Hanson D et\u00a0al (2016) In: 2016 IEEE Symposium Series on Computational Intelligence (SSCI). https:\/\/doi.org\/10.1109\/SSCI.2016.7849908","DOI":"10.1109\/SSCI.2016.7849908"},{"issue":"6","key":"10713_CR48","doi-asserted-by":"publisher","first-page":"157","DOI":"10.1109\/MNET.008.2100484","volume":"36","author":"Z Wan","year":"2022","unstructured":"Wan Z, Gao Z, Di Renzo M, Hanzo L (2022) IEEE Netw 36(6):157. https:\/\/doi.org\/10.1109\/MNET.008.2100484","journal-title":"IEEE Netw"},{"key":"10713_CR49","unstructured":"White A (2017) (No Title)"},{"key":"10713_CR50","doi-asserted-by":"publisher","unstructured":"Yamin MM, Katt B (2022) Comput Secur 122:102892. https:\/\/doi.org\/10.1016\/j.cose.2022.102892. https:\/\/www.sciencedirect.com\/science\/article\/pii\/S0167404822002644","DOI":"10.1016\/j.cose.2022.102892"},{"key":"10713_CR51","unstructured":"Zerotier Team (2025) Zerotier. https:\/\/www.zerotier.com\/. Accessed Sept 2024"}],"container-title":["Empirical Software Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10664-025-10713-2.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10664-025-10713-2\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10664-025-10713-2.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,11,5]],"date-time":"2025-11-05T02:41:00Z","timestamp":1762310460000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10664-025-10713-2"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,9,2]]},"references-count":51,"journal-issue":{"issue":"6","published-print":{"date-parts":[[2025,12]]}},"alternative-id":["10713"],"URL":"https:\/\/doi.org\/10.1007\/s10664-025-10713-2","relation":{},"ISSN":["1382-3256","1573-7616"],"issn-type":[{"value":"1382-3256","type":"print"},{"value":"1573-7616","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,9,2]]},"assertion":[{"value":"28 July 2025","order":1,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"2 September 2025","order":2,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"Not applicable.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethical Approval"}},{"value":"Not applicable.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Informed Consent"}},{"value":"The authors declare that they have no conflict of interest.","order":4,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of Interest"}},{"value":"The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.","order":5,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing Interest"}},{"value":"not applicable.","order":6,"name":"Ethics","group":{"name":"EthicsHeading","label":"Clinical Trial Number"}}],"article-number":"158"}}