Alarm Flood Reduction in Critical Infrastructures - Research Roadmap & Preliminary Results

The constant flood of alarms triggered by operational technology (OT) used in critical infrastructures (CRITIS) such as energy or traffic systems poses a serious challenge to their safe and efficient operation. Operators must quickly recognize truly critical situations and make life-saving decisions. This task is made more difficult by typical characteristics of CRITIS, including the high heterogeneity of OT systems, their wide geographical distribution, decentralized nature, and continuous, partly unpredictable evolution. As a result, operators often have only an isolated view of individual OT components, without understanding their interdependencies, which prevents effective alarm reduction. This paper tackles the problem of alarm flood reduction based on interdependencies in CRITIS, as studied in our research project iReduce. We present a research roadmap that outlines a two-step approach to identify and represent OT interdependencies. This is supported by a domain-adaptable OT knowledge base for semantic representation and by provenance mechanisms to handle system evolution. We also report on the current implementation status and first evaluation results, focusing on the exploration of OT interdependencies as a key step towards intelligent alarm reduction.