A Digital Twin-Based Cyber Range for SOC Analysts - Data and Applications Security and Privacy XXXV Access content directly
Conference Papers Year : 2021

A Digital Twin-Based Cyber Range for SOC Analysts

Manfred Vielberth
  • Function : Author
  • PersonId : 1135150
Magdalena Glas
  • Function : Author
  • PersonId : 1135151
Marietheres Dietz
  • Function : Author
  • PersonId : 1059365
Günther Pernul
  • Function : Author
  • PersonId : 1024075

Abstract

Security Operations Centers (SOCs) provide a holistic view of a company’s security operations. While aiming to harness this potential, companies are lacking sufficiently skilled cybersecurity analysts. One approach to meet this demand is to create a cyber range to equip potential analysts with the skills required. The digital twin paradigm offers great benefit by providing a realistic virtual environment to create a cyber range. However, to the best of our knowledge, tapping this potential to train SOC analysts has not been attempted yet. To address this research gap, a concept of a digital twin-based cyber range for SOC analysts is proposed and implemented. As part of the virtual training environment, several attacks against an industrial system are simulated. Being provided with a SIEM system that displays the real-time log data, the trainees solve increasingly complex tasks in which they have to detect the attacks performed against the system. Thereby, they learn how to interact with a SIEM system and create rules that correlate events aiming to detect security incidents. To evaluate the implemented cyber range, a comprehensive user study demonstrates a significant increase of knowledge within SIEM-related topics among the participants. Additionally, it indicates that the cyber range was subjectively perceived as a positive learning experience by the participants.
Fichier principal
Vignette du fichier
513274_1_En_17_Chapter.pdf (1.37 Mo) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-03677035 , version 1 (24-05-2022)

Licence

Attribution

Identifiers

Cite

Manfred Vielberth, Magdalena Glas, Marietheres Dietz, Stylianos Karagiannis, Emmanouil Magkos, et al.. A Digital Twin-Based Cyber Range for SOC Analysts. 35th IFIP Annual Conference on Data and Applications Security and Privacy (DBSec), Jul 2021, Calgary, AB, Canada. pp.293-311, ⟨10.1007/978-3-030-81242-3_17⟩. ⟨hal-03677035⟩
37 View
10 Download

Altmetric

Share

Gmail Facebook X LinkedIn More