{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,30]],"date-time":"2026-07-30T11:10:39Z","timestamp":1785409839783,"version":"3.56.0"},"reference-count":52,"publisher":"MDPI AG","issue":"15","license":[{"start":{"date-parts":[[2026,7,23]],"date-time":"2026-07-23T00:00:00Z","timestamp":1784764800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"European Union\u2019s Digital Europe Programme","award":["101190388"],"award-info":[{"award-number":["101190388"]}]},{"award":["101190388"],"award-info":[{"award-number":["101190388"]}],"id":[{"id":"https:\/\/ror.org\/022z2ef35","id-type":"ROR","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Electronics"],"abstract":"<jats:p>Critical National Infrastructures (CNIs) have evolved over the last years through the digitization of their services, which simultaneously led to an increase of their threat surface. Meanwhile, the exponential rise of Artificial Intelligence (AI) technologies has given the means to adversaries to perform targeted attacks against high impact systems as the ones found in CNIs. Current regulation directives as the NIS2 or the Cyber Resilience Act (CRA) focus on the presence of Security Operation Centers (SOCs), which include different security technologies for the detection and response to cyber-attacks. Nevertheless, such baseline SOCs do not provide the ability to perform a coordinated and orchestrated detection and response cycle for existing cyber threats, but also do not provide proactive measures for zero-day threats. To this end, this paper presents a new approach for automating the orchestration of the incident lifecycle through next-generation SOC services able to detect\/mitigate sophisticated attacks against CNIs, but also implement proactive detection and mitigation measures against zero-day threats. The approach is presented through a reference model for intelligent SOC components that additionally allow tackling the challenges in traditional SOC environments, such as fatigue for the multiple alerts for the SOC analysts and the time required for investigating triaging and investigating incidents.<\/jats:p>","DOI":"10.3390\/electronics15153248","type":"journal-article","created":{"date-parts":[[2026,7,23]],"date-time":"2026-07-23T15:05:42Z","timestamp":1784819142000},"page":"3248","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Next-Gen Security Operation Center Services for Critical National Infrastructures"],"prefix":"10.3390","volume":"15","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-8243-7075","authenticated-orcid":false,"given":"Alexios","family":"Lekidis","sequence":"first","affiliation":[{"name":"Department of Energy Systems, University of Thessaly, 41500 Larisa, Greece"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4311-393X","authenticated-orcid":false,"given":"Yagmur","family":"Yigit","sequence":"additional","affiliation":[{"name":"School of Computing, Engineering and the Build Environment, Edinburgh Napier University, Edinburgh EH10 5DT, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5360-9782","authenticated-orcid":false,"given":"Leandros A.","family":"Maglaras","sequence":"additional","affiliation":[{"name":"School of Computing, Engineering and the Build Environment, Edinburgh Napier University, Edinburgh EH10 5DT, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8730-6245","authenticated-orcid":false,"given":"Konstantinos","family":"Karantzalos","sequence":"additional","affiliation":[{"name":"Remote Sensing Laboratory, National Technical University of Athens, 15780 Athens, Greece"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"George","family":"Spanoudakis","sequence":"additional","affiliation":[{"name":"Sphynx Technology Solutions AG, 6300 Zug, Switzerland"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,7,23]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"1","DOI":"10.60097\/ACIG\/162868","article-title":"Protection of the EU\u2019s critical infrastructures: Results and challenges","volume":"2","author":"Mikac","year":"2023","journal-title":"Appl. Cybersecur. Internet Gov."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"102316","DOI":"10.1016\/j.ijdrr.2021.102316","article-title":"Critical review of the threats affecting the building of critical infrastructure resilience","volume":"60","author":"Tam","year":"2021","journal-title":"Int. J. Disaster Risk Reduct."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Lehto, M. (2022). Cyber-attacks against critical infrastructure. Cyber Security: Critical Infrastructure Protection, Springer.","DOI":"10.1007\/978-3-030-91293-2"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"109","DOI":"10.1016\/j.ijmedinf.2019.04.019","article-title":"Evaluating information security core human error causes (IS-CHEC) technique in public sector and comparison with the private sector","volume":"127","author":"Evans","year":"2019","journal-title":"Int. J. Med. Inform."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Moradpoor, N., Abah, E., Robles-Durazno, A., and Maglaras, L. (2025). Adversarial Attacks on Supervised Energy-Based Anomaly Detection in Clean Water Systems. Electronics, 14.","DOI":"10.3390\/electronics14030639"},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Lekidis, A., Karalashvili, M., Maglaras, L., Karantzalos, K., and Spanoudakis, G. (2025). Intelligent Security Operation Centre Services for Critical National Infrastructures. Proceedings of the 2025 IEEE Conference on Communications and Network Security (CNS), IEEE.","DOI":"10.1109\/CNS66487.2025.11194948"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"18","DOI":"10.1007\/s12198-026-00337-y","article-title":"Emerging threats in aviation: A study of recent cyber and hybrid attacks on global airports","volume":"19","author":"Nautiyal","year":"2026","journal-title":"J. Transp. Secur."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Lehto, M. (2026). National Cyber Space. Cyber Security: Policy and Technology, Springer.","DOI":"10.1007\/978-3-032-08890-1"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"M\u00f6ller, D.P. (2026). Application Domain Network and Information Security (NIS2). Cybersecurity for Network and Information Security: Principles, Techniques and Applications, Springer.","DOI":"10.1007\/978-3-031-99790-7_4"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Maglaras, L., Janicke, H., and Ferrag, M.A. (2022). Combining security and reliability of critical infrastructures: The concept of securability. Appl. Sci., 12.","DOI":"10.3390\/app122010387"},{"key":"ref_11","unstructured":"Sotiropoulos, L. (2025). The European Cybersecurity Framework: Challenges, Legal Aspects and Regulations. Digital Lawscapes: Artificial Intelligence, Cybersecurity and the New European Order, ADJURIS\u2014International Academic Publisher."},{"key":"ref_12","first-page":"109","article-title":"The Future of Endpoint Security: Autonomous Agents and Self-Healing Systems","volume":"5","author":"Narra","year":"2025","journal-title":"J. Multidiscip."},{"key":"ref_13","first-page":"32","article-title":"Cybercrime in the year 2025","volume":"42","author":"Stephens","year":"2008","journal-title":"Futurist"},{"key":"ref_14","unstructured":"European Union Agency for Cybersecurity (ENISA) (2026, March 24). ENISA Threat Landscape 2024. Available online: https:\/\/www.enisa.europa.eu\/publications\/enisa-threat-landscape-2024."},{"key":"ref_15","unstructured":"European Union (2026, March 24). Directive (EU) 2022\/2555 on Measures for a High Common Level of Cybersecurity Across the Union (NIS2 Directive). Available online: https:\/\/eur-lex.europa.eu\/eli\/dir\/2022\/2555\/oj\/eng."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"105890","DOI":"10.1016\/j.clsr.2023.105890","article-title":"Cybersecurity in the EU: How the NIS2-directive stacks up against its predecessor","volume":"52","author":"Vandezande","year":"2024","journal-title":"Comput. Law Secur. Rev."},{"key":"ref_17","first-page":"251","article-title":"The European Approach to Cybersecurity in 2023: A Review of the Changes Brought in by the Network and Information Security 2 (NIS2) Directive 2022\/2555","volume":"5","author":"Singh","year":"2023","journal-title":"Int. Co. Commer. Law Rev."},{"key":"ref_18","unstructured":"European Union (2026, March 24). Regulation (EU) 2022\/2554 on Digital Operational Resilience for the Financial Sector (DORA). Available online: https:\/\/eur-lex.europa.eu\/eli\/reg\/2022\/2554\/oj\/eng."},{"key":"ref_19","unstructured":"European Union (2026, March 24). Commission Delegated Regulation (EU) 2024\/1366 Establishing a Network Code on Sector-Specific Rules for Cybersecurity Aspects of Cross-Border Electricity Flows. Available online: https:\/\/eur-lex.europa.eu\/eli\/reg_del\/2024\/1366\/oj\/eng."},{"key":"ref_20","unstructured":"Smeets, M., van Loon, G., Shires, J., and Rolland, A. (2026, March 24). Under Pressure: Securing Europe\u2019s Resource-Constrained Critical Infrastructure. Available online: https:\/\/virtual-routes.org\/under-pressure-securing-europes-resource-constrained-critical-infrastructure\/."},{"key":"ref_21","unstructured":"European Commission (2026, March 24). European Action Plan on the Cybersecurity of Hospitals and Healthcare Providers. Available online: https:\/\/health.ec.europa.eu\/ehealth-digital-health-and-care\/digital-health-and-care\/european-action-plan-cybersecurity-hospitals-and-healthcare-providers_en."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Neumannov\u00e1, A., Bernroider, E.W., and Elshuber, C. (2022). The Digital Operational Resilience Act for Financial Services: A Comparative Gap Analysis and Literature Review. Proceedings of the European, Mediterranean, and Middle Eastern Conference on Information Systems, Online, Springer.","DOI":"10.1007\/978-3-031-30694-5_40"},{"key":"ref_23","unstructured":"European Insurance and Occupational Pensions Authority (EIOPA) (2026, March 24). Digital Operational Resilience Act (DORA). Available online: https:\/\/www.eiopa.europa.eu\/digital-operational-resilience-act-dora_en."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"51","DOI":"10.1109\/MWC.2025.3602932","article-title":"Graph-Based Digital Twin Blueprint for Securing 6G Local Area Networks","volume":"32","author":"Yigit","year":"2025","journal-title":"IEEE Wirel. Commun."},{"key":"ref_25","unstructured":"Kalliola, M., Huovila, M., and Lindroth, M. (2025). Towards Safer Healthcare: Insights on the European Action Plan on Cybersecurity for Hospitals and Healthcare Providers, Sitra. Working Paper 39."},{"key":"ref_26","unstructured":"European Commission (2026, March 24). EU Cyber Solidarity Act. Available online: https:\/\/digital-strategy.ec.europa.eu\/en\/policies\/cyber-solidarity."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"485","DOI":"10.1017\/err.2025.24","article-title":"The Cyber Solidarity Act: Framework and Perspectives for the New EU-Wide Cybersecurity Solidarity Mechanism Under the EU Legal System","volume":"16","author":"Villani","year":"2025","journal-title":"Eur. J. Risk Regul."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Demertzis, K., Tziritas, N., Kikiras, P., Sanchez, S.L., and Iliadis, L. (2019). The next generation cognitive security operations center: Adaptive analytic lambda architecture for efficient defense against adversarial attacks. Big Data Cogn. Comput., 3.","DOI":"10.3390\/bdcc3010006"},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Lekidis, A., Mavroeidis, V., and Fysarakis, K. (2024). Towards incident response orchestration and automation for the advanced metering infrastructure. Proceedings of the 2024 IEEE 20th International Conference on Factory Communication Systems (WFCS), IEEE.","DOI":"10.1109\/WFCS60972.2024.10540775"},{"key":"ref_30","first-page":"1","article-title":"Alert fatigue in security operations centres: Research challenges and opportunities","volume":"57","author":"Tariq","year":"2025","journal-title":"ACM Comput. Surv."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Aljundi, I., Rawashdeh, M., Al-Fayoumi, M., Al-Badarneh, A., and Al-Haija, Q.A. (2023). Protecting critical National Infrastructures: An overview of cyberattacks and countermeasures. Proceedings of the International conference on WorldS4, Springer.","DOI":"10.1007\/978-981-99-7569-3_25"},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"1748","DOI":"10.1109\/COMST.2023.3273282","article-title":"Cyber threat intelligence mining for proactive cybersecurity defense: A survey and new perspectives","volume":"25","author":"Sun","year":"2023","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_33","unstructured":"Mohsin, A., Janicke, H., Ibrahim, A., Sarker, I.H., and Camtepe, S. (2025). A Unified Framework for Human AI Collaboration in Security Operations Centers with Trusted Autonomy. arXiv."},{"key":"ref_34","unstructured":"European Union (2026, April 01). Directive (EU) 2022\/2557 on the Resilience of Critical Entities (CER Directive). Available online: https:\/\/eur-lex.europa.eu\/eli\/dir\/2022\/2557\/oj\/eng."},{"key":"ref_35","first-page":"155","article-title":"What\u2019s New In The NIS 2 Directive Proposal Compared To The Old NIS Directive","volume":"9","author":"Dragomir","year":"2021","journal-title":"SEA\u2014Pract. Appl. Sci."},{"key":"ref_36","unstructured":"European Commission and High Representative of the Union for Foreign Affairs and Security Policy (2026, April 01). Joint Communication to Strengthen the Security and Resilience of Submarine Cables. Available online: https:\/\/digital-strategy.ec.europa.eu\/en\/library\/joint-communication-strengthen-security-and-resilience-submarine-cables."},{"key":"ref_37","unstructured":"European Commission (2026, April 01). European Water Resilience Strategy. Available online: https:\/\/environment.ec.europa.eu\/publications\/european-water-resilience-strategy_en."},{"key":"ref_38","unstructured":"European Union (2026, April 01). Regulation (EU) 2016\/679 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data (GDPR). Available online: https:\/\/eur-lex.europa.eu\/legal-content\/EN\/ALL\/?uri=CELEX:32016R0679."},{"key":"ref_39","unstructured":"European Union (2026, April 01). Regulation (EU) 2019\/881 on ENISA and on Information and Communications Technology Cybersecurity Certification (Cybersecurity Act). Available online: https:\/\/eur-lex.europa.eu\/eli\/reg\/2019\/881\/oj\/eng."},{"key":"ref_40","unstructured":"European Union Agency for Cybersecurity (ENISA) (2026, March 24). EUCC in Application. Available online: https:\/\/certification.enisa.europa.eu\/news\/eucc-application-2025-02-27_en."},{"key":"ref_41","unstructured":"European Union (2026, April 01). Regulation (EU) 2024\/2847 on Horizontal Cybersecurity Requirements for Products with Digital Elements (Cyber Resilience Act). Available online: https:\/\/eur-lex.europa.eu\/eli\/reg\/2024\/2847\/oj\/eng."},{"key":"ref_42","unstructured":"MITRE (2026, April 01). MITRE ATT&CK Framework. Available online: https:\/\/attack.mitre.org\/."},{"key":"ref_43","unstructured":"MITRE (2026, April 01). MITRE ATLAS: Adversarial Threat Landscape for Artificial-Intelligence Systems. Available online: https:\/\/atlas.mitre.org\/."},{"key":"ref_44","unstructured":"OWASP Foundation (2026, April 01). OWASP Top 10 for Large Language Model Applications and Machine Learning Security Guidance. Available online: https:\/\/owasp.org\/www-project-top-10-for-large-language-model-applications\/."},{"key":"ref_45","unstructured":"National Institute of Standards and Technology (2026, April 01). Computer Security Incident Handling Guide (SP 800-61 Rev. 2), Available online: https:\/\/csrc.nist.gov\/pubs\/sp\/800\/61\/r2\/final."},{"key":"ref_46","unstructured":"National Institute of Standards and Technology (2026, April 01). The NIST Cybersecurity Framework (CSF) 2.0, Available online: https:\/\/www.nist.gov\/cyberframework."},{"key":"ref_47","unstructured":"Touvron, H., Martin, L., Stone, K., Albert, P., Almahairi, A., Babaei, Y., Bashlykov, N., Batra, S., Bhargava, P., and Bhosale, S. (2023). Llama 2: Open foundation and fine-tuned chat models. arXiv."},{"key":"ref_48","doi-asserted-by":"crossref","first-page":"100467","DOI":"10.1016\/j.array.2025.100467","article-title":"NLP based text classification using TF-IDF enabled fine-tuned long short-term memory: An empirical analysis","volume":"27","author":"Guleria","year":"2025","journal-title":"Array"},{"key":"ref_49","doi-asserted-by":"crossref","unstructured":"Mihaylova, D.A. (2025). Baseline Adversarial Machine Learning Attacks-a Comparative Study. Proceedings of the 2025 60th International Scientific Conference on Information, Communication and Energy Systems and Technologies (ICEST), IEEE.","DOI":"10.1109\/ICEST66328.2025.11098269"},{"key":"ref_50","doi-asserted-by":"crossref","first-page":"234","DOI":"10.1007\/s42979-025-03785-w","article-title":"Advancing trustworthy ai: A comparative evaluation of ai robustness toolboxes","volume":"6","author":"Agarwal","year":"2025","journal-title":"SN Comput. Sci."},{"key":"ref_51","doi-asserted-by":"crossref","first-page":"2299","DOI":"10.1109\/COMST.2023.3299519","article-title":"A survey on threat hunting in enterprise networks","volume":"25","author":"Nour","year":"2023","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_52","doi-asserted-by":"crossref","first-page":"108514","DOI":"10.1016\/j.future.2026.108514","article-title":"Enhanced-LLM extraction of CTI from unstructured threat reports. A tough nut to crack or a walk in the park?","volume":"183","author":"Psarrou","year":"2026","journal-title":"Future Gener. Comput. Syst."}],"container-title":["Electronics"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2079-9292\/15\/15\/3248\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,23]],"date-time":"2026-07-23T15:26:20Z","timestamp":1784820380000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2079-9292\/15\/15\/3248"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7,23]]},"references-count":52,"journal-issue":{"issue":"15","published-online":{"date-parts":[[2026,8]]}},"alternative-id":["electronics15153248"],"URL":"https:\/\/doi.org\/10.3390\/electronics15153248","relation":{},"ISSN":["2079-9292"],"issn-type":[{"value":"2079-9292","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,7,23]]}}}