Nowadays, cyber-physical systems are ubiquitous and present in most of our everyday life. Their usage is spread over many applications, like industrial control systems, modern buildings, and critical infrastructures. Recently such systems are becoming more interconnected and smart, by means of the Internet of Things (IoT) concept, making them accessible through both physical and remote connections. Furthermore, end users can configure and customize their own systems, but this flexibility generally implies an unaware sharing of private data over the underlying IoT. The attack surface is thus much wider and more heterogeneous. Determining the potential threats in these smart systems and to provide an adequate amount of protection becomes a very complex and hard process.