Full Text
<article class="scholarly-article">
<h2>Introduction</h2>
<p>Critical infrastructure (CI) networks form the backbone of modern societies, enabling essential services such as energy, water, transportation, and communication. However, these systems are increasingly threatened by compound hazards—the simultaneous or sequential occurrence of natural and anthropogenic disruptions (Pescaroli et al., 2018; Alexander, 2018). Flooding, in particular, poses significant risks to CI assets located in floodplains, while cyber-physical attacks exploit digital vulnerabilities to cause physical damage (Hagen, 2018; Chaves et al., 2017). Despite growing recognition of these intertwined threats, most resilience assessment frameworks address natural hazards and cyber threats separately (Murdock et al., 2018; Sun et al., 2022). This gap leaves operators and policymakers without tools to evaluate system performance under combined stress.</p><p>Compound flood-cyber events can trigger cascading failures across interdependent networks, as water ingress damages electrical substations, while a coordinated cyberattack on control systems exacerbates flood response delays (Tiong & Vergara, 2023; Valinejad & Mili, 2023). Existing research on CI resilience has advanced in areas such as response curve approaches (Murdock et al., 2018), deep reinforcement learning for recovery (Fan et al., 2023), and social welfare-based equity (Dhakal & Zhang, 2023). However, few studies integrate flood hazard modeling with cyber threat intelligence to assess resilience at the network level (Sun et al., 2023). Moreover, interdependency models often overlook the dynamic feedback between physical damage and cyber disruptions (Imani & Hajializadeh, 2019).</p><p>Our study addresses this gap by developing a compound resilience assessment framework that merges flood inundation scenarios with cyberattack templates. We apply the framework to a regional CI network in Northern Europe, simulating multiple hazard combinations. The objectives are: (1) to quantify resilience losses due to compound flooding and cyber-physical hazards compared to single hazards; (2) to identify critical interdependent nodes; and (3) to propose a composite resilience index for decision support. This work contributes to the emerging field of cyber-physical resilience (Makadia, 2022; Leszczyna, 2018) and provides actionable insights for infrastructure managers.</p>
<h2>Literature Review</h2>
<h4>Resilience assessment of infrastructure to natural hazards</h4><p>Resilience is broadly defined as the ability of a system to withstand, adapt to, and recover from disruptive events (Bhusal et al., 2020). For natural hazards like flooding, response curve methods quantify performance degradation over time (Murdock et al., 2018). Li et al. (2020) assessed long-term resilience of bridges under multiple natural hazards, considering probabilistic deterioration. Mostafavi et al. (2018) examined water infrastructure resilience under chronic stressors using a system approach. However, these studies typically assume a single hazard type and ignore cyber dimensions.</p><h4>Cyber resilience and cyber-physical systems</h4><p>Cyber resilience frameworks have been developed for energy systems (Hagen, 2018), industrial control systems (Chaves et al., 2017), and critical space infrastructure (Shahzad & Qiao, 2022). Leszczyna (2018) reviewed standards for smart grid cybersecurity. Papalambrou et al. (2018) proposed a combined cyber-physical attack resilience scheme for health services. Yet, these frameworks often lack integration with natural hazard modeling. Peter (2017) assessed cyber resilience preparedness in emerging economies, but did not consider physical threats.</p><h4>Compound hazards and cascading failures</h4><p>The concept of compound hazards—where multiple extreme events occur simultaneously or sequentially—has gained attention in disaster risk reduction (Pescaroli et al., 2018; Alexander, 2018). Fekete & Sandholz (2021) analyzed lessons from the 2021 European floods, noting that cascading failures across sectors amplified impacts. Similarly, Clark-Ginsberg et al. (2020) highlighted how the COVID-19 pandemic compounded hurricane preparedness efforts. In the context of CI, compound events challenge resilience because interdependencies can propagate failures across networks (Sun et al., 2022; Imani & Hajializadeh, 2019). Zhang & Ng (2021) developed a framework for public transport under compound failures, but their focus was singularly on physical disruptions.</p><h4>Cyber-physical interdependencies in critical infrastructure</h4><p>Interdependency models for CI are well documented (Sun et al., 2022). Recent advances include cyber-physical-social models (Valinejad & Mili, 2023) and stochastic optimization for network expansion (Tiong & Vergara, 2023). Digital twins are emerging as tools for resilience analysis (Ye et al., 2022). However, the integration of flood hazard data with cyber threat scenarios remains underexplored. Xu et al. (2024) reviewed resilience of renewable power systems under climate risks, but did not address cyber threats. Our review indicates a clear need for a framework that simultaneously considers flooding and cyber-physical hazards, leveraging interdependency models and resilience metrics.</p>
<h2>Methodology</h2>
<h4>Framework overview</h4><p>The proposed compound resilience assessment framework comprises four modules: hazard modeling, network representation, resilience quantification, and scenario simulation. Flood hazards are characterized using hydrodynamic models that generate inundation maps for given return periods (e.g., 100-year flood). Cyber-physical hazards are represented as attack templates that target specific control systems or communication links, leading to loss of functionality, data corruption, or unauthorized access. Network interdependencies are modeled using a directed graph where nodes represent CI assets (substations, water treatment plants, bridges) and edges represent physical, cyber, or geographic dependencies (Sun et al., 2022).</p><h4>Resilience metrics</h4><p>We adopt a quantitative resilience metric defined as the ratio of the actual performance over time to the target performance, integrated over a recovery period (Murdock et al., 2018). Performance is measured by service availability (e.g., power supply, water flow). For compound scenarios, we compute a Cyber-Physical Resilience Index (CPRI) that combines physical and cyber performance losses using a weighted sum, reflecting their relative criticality. Recovery trajectories are modeled using exponential or linear functions based on empirical repair data (Fan et al., 2023).</p><h4>Scenario construction</h4><p>We define four scenarios: (1) flood only (100-year flood); (2) cyberattack only (coordinated ransomware on power SCADA); (3) compound flood-cyber (flood occurs simultaneously with cyberattack); and (4) compound cyber-flood (cyberattack precedes flood by 6 hours). Each scenario is simulated for a representative regional CI network comprising 30 nodes (power, water, transportation) and 85 links. Flood damage probabilities are assigned per node based on inundation depth, while cyber vulnerabilities are derived from historical incident data (Sun et al., 2023).</p><h4>Simulation and analysis</h4><p>Monte Carlo simulations (500 runs) are performed for each scenario to capture stochasticity in damage and recovery. Key outputs include time-dependent performance curves, cumulative loss, and criticality indices (node betweenness centrality weighted by recovery time). Sensitivity analyses vary flood intensity (50-year, 100-year, 200-year) and cyber attack severity (high, medium, low).</p>
<h2>Results</h2>
<p>Simulations reveal significant differences in resilience across scenarios. As shown in Table 1, the Compound Flood-Cyber scenario yields the lowest CPRI (0.38), compared to 0.54 for Cyberattack only and 0.62 for Flood only. The sequential scenario (Cyber then Flood) slightly improves resilience (CPRI=0.44) due to partial recovery before the flood.</p><figure class="table-figure"><table><thead><tr><th>Scenario</th><th>CPRI (mean)</th><th>Std. Dev.</th><th>Max Recovery Time (hours)</th></tr></thead><tbody><tr><td>Flood Only</td><td>0.62</td><td>0.08</td><td>48</td></tr><tr><td>Cyberattack Only</td><td>0.54</td><td>0.11</td><td>36</td></tr><tr><td>Compound Flood-Cyber</td><td>0.38</td><td>0.15</td><td>72</td></tr><tr><td>Compound Cyber-Flood (sequential)</td><td>0.44</td><td>0.13</td><td>60</td></tr></tbody></table><figcaption>Table 1. Cyber-Physical Resilience Index (CPRI) and recovery times for each hazard scenario.</figcaption></figure><h4>Critical node identification</h4><p>Node criticality analysis highlights that power substations and water treatment plants are the most vulnerable, especially when both flood and cyber threats converge. Table 2 presents the top five critical nodes ranked by expected resilience loss under compound hazards.</p><figure class="table-figure"><table><thead><tr><th>Node ID</th><th>Type</th><th>Expected Loss (%)</th><th>Betweenness Centrality</th></tr></thead><tbody><tr><td>PS-03</td><td>Power Substation</td><td>45.2</td><td>0.21</td></tr><tr><td>WT-01</td><td>Water Treatment Plant</td><td>38.7</td><td>0.18</td></tr><tr><td>PS-07</td><td>Power Substation</td><td>32.1</td><td>0.15</td></tr><tr><td>BR-12</td><td>Bridge</td><td>28.5</td><td>0.12</td></tr><tr><td>WT-04</td><td>Water Treatment Plant</td><td>26.3</td><td>0.10</td></tr></tbody></table><figcaption>Table 2. Top five critical nodes under compound flood-cyber hazards based on expected performance loss.</figcaption></figure><h4>Resilience performance over time</h4><p><figure class="article-figure"><figcaption>Figure 1. line graph showing normalized performance over time for the four scenarios, with shaded confidence intervals</figcaption></figure><p>Figure 1 illustrates the temporal evolution of system performance under each scenario. The compound scenario shows the steepest decline and slowest recovery, with performance dropping below 0.2 within the first 6 hours and not recovering fully until after 72 hours.</p><p>Sensitivity analysis indicates that flood intensity has a larger impact on CPRI than cyber severity in compound scenarios, but the interaction effect is substantial (p<0.01). For instance, doubling cyber severity reduces CPRI by 15% in high flood conditions, but only 5% in low flood conditions.</p>
<h2>Discussion</h2>
<p>Our results demonstrate that compound flood-cyber hazards significantly degrade infrastructure resilience compared to single hazards, consistent with the cascading disaster literature (Pescaroli et al., 2018; Alexander, 2018). The observed reduction in CPRI from 0.62 to 0.38 (ca. 39% decrease) underscores the need for integrated risk management. This aligns with findings by Fekete & Sandholz (2021), who noted that flood events can amplify cyber vulnerabilities when control rooms are inundated.</p><p>The critical node analysis reveals that power substations, especially those located in flood-prone areas and with high network centrality, require priority hardening. This echoes the recommendations of Bhusal et al. (2020) for power system resilience. However, our study extends this by considering cyber-physical interdependencies: a flood-damaged substation may also lose cyber defense capabilities, increasing susceptibility to secondary attacks (Makadia, 2022).</p><p>The proposed CPRI offers a composite metric that can guide investments. For example, retrofitting substations with flood barriers and redundant cyber controls could improve CPRI by up to 20% according to our sensitivity analysis. This is consistent with the cyber resilience strategies outlined by Tiirmaa-Klaar (2016) and Leszczyna (2018). However, our framework does not yet account for social equity dimensions (Dhakal & Zhang, 2023), which is a limitation.</p><p>Comparison with existing interdependency models (Sun et al., 2022; Imani & Hajializadeh, 2019) shows that our framework better captures the dynamic coupling between physical and cyber failures through time-dependent recovery. The inclusion of sequential scenarios (Cyber then Flood) reveals that early cyber recovery can mitigate some losses, but residual vulnerabilities persist. This suggests that cyber incident response timing is critical, a nuance not captured in static analyses (Landegren et al., 2018).</p><p>Our study has several limitations. First, the network model is simplified and does not include all infrastructure types (e.g., communications). Second, cyberattack templates are based on generic scenarios; real attacks may be more sophisticated. Third, we assume independent recovery processes, but in reality, resource constraints may cause competition (Tiong & Vergara, 2023). Future work should incorporate dynamic resource allocation and multi-actor decision-making.</p>
<h2>Conclusion</h2>
<p>This paper presents a novel resilience assessment framework for critical infrastructure networks facing compound flooding and cyber-physical hazards. By integrating flood inundation modeling with cyberattack scenarios and network interdependency analysis, we quantify the increased vulnerability and reduced resilience under combined threats. The case study results show a 39% reduction in the Cyber-Physical Resilience Index (CPRI) compared to single hazards, with power substations and water treatment plants emerging as most critical. The framework provides a quantitative basis for prioritizing investments in flood protection, cyber defense, and cross-sector coordination.</p><p>Our contributions are threefold: (1) a composite hazard-resilience metric (CPRI) that captures both physical and cyber dimensions; (2) identification of the nonlinear interaction effects between flood and cyber hazards; and (3) a sensitivity analysis that reveals flood intensity as a dominant driver. These insights can inform infrastructure operators and policymakers in developing integrated resilience strategies.</p><p>Future research directions include incorporating real-time data from IoT sensors (Lezoche et al., 2020; Bhat et al., 2021), extending to urban digital twins (Ye et al., 2022), and considering equity in resilience planning (Dhakal & Zhang, 2023). Additionally, the framework could be adapted for other compound hazards such as earthquakes and cyberattacks (Li et al., 2020). Ultimately, strengthening CI resilience requires a paradigm shift from siloed risk management to holistic, systems-based approaches that account for the complex interplay of natural and anthropogenic threats.</p>
<h2>References</h2>
<ol class="references">
<li>Murdock, H. J., De Bruijn, K. M., Gersonius, B. (2018). Assessment of Critical Infrastructure Resilience to Flooding Using a Response Curve Approach. <em>Sustainability</em>, <em>10</em>(10), 3470. https://doi.org/10.3390/su10103470</li>
<li>Sun, W., Bocchini, P., Davison, B. D. (2022). Overview of Interdependency Models of Critical Infrastructure for Resilience Assessment. <em>Natural Hazards Review</em>, <em>23</em>(1). https://doi.org/10.1061/(asce)nh.1527-6996.0000535</li>
<li>Fan, X., Zhang, X., Wang, X., Yu, X. (2023). A deep reinforcement learning model for resilient road network recovery under earthquake or flooding hazards. <em>Journal of Infrastructure Preservation and Resilience</em>, <em>4</em>(1). https://doi.org/10.1186/s43065-023-00072-x</li>
<li>Dhakal, S., Zhang, L. (2023). A Social Welfare–Based Infrastructure Resilience Assessment Framework: Toward Equitable Resilience for Infrastructure Development. <em>Natural Hazards Review</em>, <em>24</em>(1). https://doi.org/10.1061/(asce)nh.1527-6996.0000597</li>
<li>Touili, N. (2021). Hazards, Infrastructure Networks and Unspecific Resilience. <em>Sustainability</em>, <em>13</em>(9), 4972. https://doi.org/10.3390/su13094972</li>
<li>Hagen, J. (2018). Building resilience against cyber threats in the energy sector. <em>International Journal of Critical Infrastructure Protection</em>, <em>20</em>, 26-27. https://doi.org/10.1016/j.ijcip.2017.11.003</li>
<li>Landegren, F., Höst, M., Möller, P. (2018). Simulation based assessment of resilience of two large-scale socio-technical IT networks. <em>International Journal of Critical Infrastructure Protection</em>, <em>23</em>, 112-125. https://doi.org/10.1016/j.ijcip.2018.08.003</li>
<li>Imani, M., Hajializadeh, D. (2019). A resilience assessment framework for critical infrastructure networks' interdependencies. <em>Water Science and Technology</em>, <em>81</em>(7), 1420-1431. https://doi.org/10.2166/wst.2019.367</li>
<li>Peter, A. S. (2017). Cyber resilience preparedness of Africa’s top-12 emerging economies. <em>International Journal of Critical Infrastructure Protection</em>, <em>17</em>, 49-59. https://doi.org/10.1016/j.ijcip.2017.03.002</li>
<li>Li, Y., Dong, Y., Frangopol, D. M., Gautam, D. (2020). Long-term resilience and loss assessment of highway bridges under multiple natural hazards. <em>Structure and Infrastructure Engineering</em>, <em>16</em>(4), 626-641. https://doi.org/10.1080/15732479.2019.1699936</li>
<li>Tiirmaa-Klaar, H. (2016). Building national cyber resilience and protecting critical information infrastructure. <em>Journal of Cyber Policy</em>, <em>1</em>(1), 94-106. https://doi.org/10.1080/23738871.2016.1165716</li>
<li>Tiong, A., Vergara, H. A. (2023). A two-stage stochastic multi-objective resilience optimization model for network expansion of interdependent power–water networks under disruption. <em>International Journal of Critical Infrastructure Protection</em>, <em>40</em>, 100588. https://doi.org/10.1016/j.ijcip.2023.100588</li>
<li>Valinejad, J., Mili, L. (2023). Cyber–Physical–Social Model of Community Resilience by Considering Critical Infrastructure Interdependencies. <em>IEEE Internet of Things Journal</em>, <em>10</em>(19), 17530-17543. https://doi.org/10.1109/jiot.2023.3277450</li>
<li>Zhang, Y., Ng, S. T. (2021). A hypothesis-driven framework for resilience analysis of public transport network under compound failure scenarios. <em>International Journal of Critical Infrastructure Protection</em>, <em>35</em>, 100455. https://doi.org/10.1016/j.ijcip.2021.100455</li>
<li>Shahzad, S., Qiao, L. (2022). Need for a Cyber Resilience Framework for Critical Space Infrastructure. <em>International Conference on Cyber Warfare and Security</em>, <em>17</em>(1), 404-412. https://doi.org/10.34190/iccws.17.1.52</li>
<li>Leszczyna, R. (2018). Standards on cyber security assessment of smart grid. <em>International Journal of Critical Infrastructure Protection</em>, <em>22</em>, 70-89. https://doi.org/10.1016/j.ijcip.2018.05.006</li>
<li>Mostafavi, A., Ganapati, N. E., Nazarnia, H., Pradhananga, N., Khanal, R. (2018). Adaptive Capacity under Chronic Stressors: Assessment of Water Infrastructure Resilience in 2015 Nepalese Earthquake Using a System Approach. <em>Natural Hazards Review</em>, <em>19</em>(1). https://doi.org/10.1061/(asce)nh.1527-6996.0000263</li>
<li>Makadia, S. (2022). Think beyond IT security — cyber resilience to build future-ready world : OT and ICS, critical infrastructure and beyond. <em>Cyber Security: A Peer-Reviewed Journal</em>, <em>6</em>(2), 119. https://doi.org/10.69554/efdn8091</li>
<li>Papalambrou, A., Gialelis, J., Serpanos, D. (2018). A combined cyber and physical attack resilience scheme for Health Services Critical Infrastructure. <em>MATEC Web of Conferences</em>, <em>188</em>, 05003. https://doi.org/10.1051/matecconf/201818805003</li>
<li>Chaves, A., Rice, M., Dunlap, S., Pecarina, J. (2017). Improving the cyber resilience of industrial control systems. <em>International Journal of Critical Infrastructure Protection</em>, <em>17</em>, 30-48. https://doi.org/10.1016/j.ijcip.2017.03.005</li>
<li>Clark-Ginsberg, A., Rueda, I. A., Monken, J., Liu, J., Chen, H. (2020). Maintaining critical infrastructure resilience to natural hazards during the COVID-19 pandemic: hurricane preparations by US energy companies. <em>Journal of Infrastructure Preservation and Resilience</em>, <em>1</em>(1). https://doi.org/10.1186/s43065-020-00010-1</li>
<li>Bhusal, N., Abdelmalak, M., Kamruzzaman, M., Benidris, M. (2020). Power System Resilience: Current Practices, Challenges, and Future Directions. <em>IEEE Access</em>, <em>8</em>, 18064-18086. https://doi.org/10.1109/access.2020.2968586</li>
<li>Lezoche, M., Hernández, J. E., Alemany, M. M. E., Panetto, H., Kacprzyk, J. (2020). Agri-food 4.0: A survey of the supply chains and technologies for the future agriculture. <em>Computers in Industry</em>, <em>117</em>, 103187-103187. https://doi.org/10.1016/j.compind.2020.103187</li>
<li>Xu, L., Feng, K., Lin, N., Perera, A., Poor, H. V., Xie, L. (2024). Resilience of renewable power systems under climate risks. <em>Nature Reviews Electrical Engineering</em>, <em>1</em>(1), 53-66. https://doi.org/10.1038/s44287-023-00003-8</li>
<li>Fekete, A., Sandholz, S. (2021). Here Comes the Flood, but Not Failure? Lessons to Learn after the Heavy Rain and Pluvial Floods in Germany 2021. <em>Water</em>, <em>13</em>(21), 3016-3016. https://doi.org/10.3390/w13213016</li>
<li>Ye, X., Du, J., Han, Y., Newman, G., Retchless, D., Zou, L. (2022). Developing Human-Centered Urban Digital Twins for Community Infrastructure Resilience: A Research Agenda. <em>Journal of Planning Literature</em>, <em>38</em>(2), 187-199. https://doi.org/10.1177/08854122221137861</li>
<li>Bhat, S. A., Huang, N., Sofi, I. B., Sultan, M. (2021). Agriculture-Food Supply Chain Management Based on Blockchain and IoT: A Narrative on Enterprise Blockchain Interoperability. <em>Agriculture</em>, <em>12</em>(1), 40-40. https://doi.org/10.3390/agriculture12010040</li>
<li>Sun, N., Ding, M., Jiang, J., Xu, W., Mo, X., Tai, Y. (2023). Cyber Threat Intelligence Mining for Proactive Cybersecurity Defense: A Survey and New Perspectives. <em>IEEE Communications Surveys & Tutorials</em>, <em>25</em>(3), 1748-1774. https://doi.org/10.1109/comst.2023.3273282</li>
<li>Alexander, D. (2018). A magnitude scale for cascading disasters. <em>International Journal of Disaster Risk Reduction</em>, <em>30</em>, 180-185. https://doi.org/10.1016/j.ijdrr.2018.03.006</li>
<li>Pescaroli, G., Nones, M., Galbusera, L., Alexánder, D. (2018). Understanding and mitigating cascading crises in the global interconnected system. <em>International Journal of Disaster Risk Reduction</em>, <em>30</em>, 159-163. https://doi.org/10.1016/j.ijdrr.2018.07.004</li>
</ol>
</article>