Digital twins for incident response in critical infrastructure

To that end, this thesis investigates the application of DTs in critical infrastructure domains. Firstly, the thesis examines how DTs can be integrated into existing IR procedures to provide new information and assurances for an organisation, thus increasing response efficiency and the likelihood of successful threat eradication. Secondly, the thesis demonstrates a novel method for utilising DTs for producing data for a range of conditions that may not be safe to produce in the real- world system.

This data is used in the training, validation, and testing of an ML-based cyber security model. Finally, the thesis presents a critical-infrastructure-appropriate architecture for implementing DTs, utilising varying levels of automation for IR activities. Crucially, the stakeholders within critical infrastructure are considered throughout this thesis, to ensure that the contributions are able to be appropriately applied in the real world.<br><br>The impact of DTs on IR activities is demonstrated both on a procedural level – through the integration of DTs in existing IR processes – and at a technical level – through the improvement of cyber security models and the development of a novel DT architecture.<br><br><i>Thesis is embargoed until 31 December 2026.</i>