1 — Adaptive cyber situational awareness using multi-resolution digital twins

Problem: How to build digital twins that represent networked systems at multiple resolutions (device ↔ subsystem ↔ enterprise) and update in real time to support decision-making? Why it’s open: Current twins are either static/slow or too coarse; bridging scale + timeliness is hard. Approach: hybrid ABM + data-driven components (streaming telemetry → Bayesian filters / particle filters for state estimation). Use AnyLogic to model host-level agents and a higher-level twin for business processes. Evaluation: ability to detect/respond to simulated attacks (detection lag, false positives), resource cost, scalability. Sample title: Multi-resolution digital twins for real-time cyber situational awareness: an agent-based and data-driven hybrid approach.

2 — Modeling attacker–defender co-evolution with agent-based digital twins

Problem: Design ABM frameworks that capture how attackers adapt to defensive changes (and vice versa) in a simulated twin of a cyber-physical environment. Why it’s open: Many simulations use fixed attacker strategies; adaptive co-evolution (learning attackers) is less explored. Approach: Implement attacker agents with reinforcement learning policies; defender agents apply layered defenses (IPS, patching, deception). Study equilibrium behaviors, cascade effects. Evaluation: attack success rates over time, defense cost vs. mitigation, emergent strategies, robustness. Sample title: Co-evolutionary agent-based modeling of attacker–defender dynamics in cyber-physical digital twins.

3 — Intrusion prevention systems tuned via simulation-driven transfer learning

Problem: Can we train IPS models in simulated environments (digital twins / ABM) and transfer them to real networks with minimal labeled data? Why it’s open: Simulation-to-reality gap limits usefulness of synthetic data. Transfer learning and domain adaptation for cybersecurity is an active need. Approach: Generate labeled attack/benign traces with ABM-based digital twin; apply domain-adaptation (adversarial or importance weighting) to real telemetry. Evaluation: detection performance pre/post transfer on real datasets, reduction in required labeling. Sample title: Simulation-to-reality transfer for IPS: bridging synthetic digital twins and operational networks.

4 — Simulation-based evaluation of automated intrusion response policies (RL + constraints)

Problem: How to synthesize safe, effective automated response policies that respect operational constraints (availability, safety) using simulations? Why it’s open: RL policies can be effective but unsafe; real networks resist naive automation. Approach: Constrain RL with safety layers (shielding, formal constraints) in AnyLogic twins that model business impact. Incorporate human-in-the-loop decision points. Evaluation: comparative cost/benefit under different attack scenarios, incidents avoided, human override rates. Sample title: Safe reinforcement learning for automated intrusion response evaluated in agent-based digital twins.

5 — Cyber threat intelligence enrichment and fusion using simulated adversary campaigns

Problem: How to use simulation-generated adversary campaigns to improve threat intelligence (TTP enrichment, correlation) and feed SIEM/CTI systems? Why it’s open: CTI datasets are fragmented and sparse; simulations could create ground truth campaigns but need to be realistic. Approach: Model adversary playbooks as agent workflows; generate observables across layers (network, host, application). Test CTI pipelines for detection and attribution. Evaluation: improvement in triage times, detection of multi-stage campaigns, fidelity vs. known threat reports. Sample title: Using agent-based adversary campaign simulation to enhance cyber threat intelligence fusion.

6 — Quantifying uncertainty in situational awareness via ensemble digital twins

Problem: How to quantify and present uncertainty (confidence intervals) in situational awareness outputs coming from imperfect/partial telemetry? Why it’s open: Operators need not just alerts but calibrated uncertainty to make decisions. Approach: Use ensemble simulations (varying initial conditions, attacker models) and probabilistic inference (Bayesian model averaging). Visualize uncertainties for SOC workflows. Evaluation: calibration metrics (Brier score), operator decision tests (simulated), robustness to missing data. Sample title: Ensemble digital twins for calibrated cyber situational awareness under partial observability.

7 — Economic-aware intrusion response modeled with ABM

Problem: Optimize response policies when defenders must trade off economic costs (downtime, mitigation costs) against security outcomes. Why it’s open: Most IRS research ignores the realistic cost models and business context. Approach: Couple IT-system agents with economic agents (departments, customers). Use game theory + ABM to study incentive-compatible responses. Evaluation: total expected loss, ROI of defensive investments, policy stability. Sample title: Agent-based economic modeling of intrusion response strategies for cost-aware cybersecurity.

8 — Scalable evaluation frameworks for deception (honeypots/honeynets) in digital twins

Problem: When and where does deception provide measurable network-level benefits? Need scalable evaluation in realistic contexts. Why it’s open: Deception effectiveness is contextual; few large-scale empirical studies exist. Approach: Model network topology, normal user behavior, and attacker reconnaissance in ABM; deploy virtual deception nodes and measure lure/success metrics. Evaluation: attacker time-to-compromise, detection improvement, false attraction impact. Sample title: Evaluating deception efficacy at scale with agent-based digital twin simulations.

9 — Modeling insider threats with socio-technical agent-based simulations

Problem: Integrate human behavioral models (motivation, access patterns) with technical systems to simulate insider threats realistically. Why it’s open: Insider threat modeling often separates human factors from technical models. Approach: Use cognitive/behavioral models for employee agents, simulate policy, monitoring, and interventions. Calibrate using surveys/empirical logs (if available). Evaluation: detection lead time, false positives, intervention effectiveness. Sample title: A socio-technical agent-based framework for insider threat simulation and mitigation.

10 — Digital-twin-driven vulnerability prioritization under constrained remediation budgets

Problem: Prioritize patching/mitigation across assets using impact-aware simulations rather than static CVSS-based ranking. Why it’s open: Static scores ignore business-context and dynamic attacker behavior. Approach: Simulate attacker exploitation likelihood and business impact in a twin; run optimization to choose patches under budget constraints. Evaluation: reduction in expected loss vs. baseline strategies, sensitivity analysis. Sample title: Impact-aware vulnerability prioritization using agent-based digital twins and constrained optimization.

11 — Real-time federated simulation for multi-organization cyber situational awareness

Problem: How to run federated digital twins across organizations (sharing minimal data) to detect cross-organizational campaigns while preserving privacy? Why it’s open: Collaboration is valuable but privacy and data sharing constraints are major barriers. Approach: Federated learning/simulation with secure aggregation, differential privacy; simulate collaborative detection scenarios. Evaluation: detection improvement, privacy leakage metrics, communication overhead. Sample title: Federated digital twins for privacy-preserving cross-organization cyber situational awareness.

12 — Automated generation of realistic attack scenarios for red-team/blue-team training using ABM

Problem: Generate diverse, realistic adversary scenarios automatically for training and evaluation of SOC teams. Why it’s open: Manual scenario generation is time-consuming and may lack diversity. Approach: Combine adversary-agent libraries with environment parametrization to compose scenarios focused on specific goals (espionage, ransomware). Integrate with training platforms. Evaluation: trainee performance improvement, scenario novelty metrics, ease of generation. Sample title: Procedural generation of adversary scenarios through agent-based modeling for SOC training.