The very concept of combining the digital twin technology and the improvement of cyber security techniques is in its essence sensational. The possibilities of creating digital twins of various processes (technological, economic, technical, etc.) in the information systems of companies, corporations, financial and public institutions are constantly growing due to technological advances in the development and applicability of information technologies ICT and Industry 4.0. On the other hand, the importance of improving cybersecurity systems and managing the risk of potential negative effects of cybercrime has been growing recently. Recently, the practice of cybercriminal activity with the use of ransomware viruses and malware distributed in fake e-mails and cybercriminal techniques based on the phishing formula, hacking of personal and sensitive data from social networks, etc. many companies operating in key, strategic sectors of the economy have been successfully attacked using these cybercriminal techniques. Therefore, there is now a high priority and a need to improve cybersecurity techniques and systems and to improve risk management systems for the potential effects of cybercrime. The creation of systems enabling simulations of cybercriminal attacks on information systems, on Internet platforms of specific enterprises and institutions as part of the digital twins of these systems being built, is a very good solution. However, the question arises whether it is possible to build such a complex, multi-faceted, multi-factor simulation structure of these systems within the framework of digital twin information systems, Internet platforms of specific enterprises and institutions, which will faithfully present the actual and real state of these systems? This is my proposal for a research question on this issue.
any Digital Twin (DT) can be used to increase the security of its Physical Twin (PT). For example, the immune system of his PT can be continuously monitored. This enables a kind of "Cybersecurity Incident Prediction (CIP)". The CIP can be implemented in such a way that the DT is specifically infected with Malware of various types in order to test the effects on the PT.
In this way, the resistance of PTs can be tested, e.g. in the event of cyber attacks and, if necessary, also improved. The result is a gain in security for the PT, which is thus armed against attacks from the Internet. A kind of CIP is thus possible.
This literature resource may be able to help you:
Abhishek Pokhrel, Vikash Katta, Ricardo Colomo-Palacios: „Digital Twin for Cybersecurity Incident Prediction: A Multivocal Literature Review“; ICSEW'20: Proceedings of the IEEE/ACM 42nd International Conference on Software Engineering; June 2020, DOI: 10.1145/3387940.3392199 https://dl.acm.org/doi/10.1145/3387940.3392199 https://researchr.org/publication/PokhrelKP20
Nan Sun, Jun Zhang, Paul Rimba, Shang Gao, Leo Yu Zhang, Yang Xiang: „Data-Driven Cybersecurity Incident Prediction: A Survey“; IEEE Communications Surveys & Tutorials, Vol. 21, Issue: 2, Secondquarter 2019; DOI: 10.1109/COMST.2018.2885561 https://ieeexplore.ieee.org/document/8567980