Industrial Control Systems have become increasingly reliant on networked communications for proper operations and maintenance, increasing efficiency and reducing operator workload.  Reliance on networked communications also adds potential vulnerability to cyber physical attacks that, if successful, could cause significant impact to mission performance and network survivability.  Digital twin simulation modeling of Industrial Control Systems in conjunction with operator processes and procedures offers significant value for assessment of cyber resilience of Cyber Physical System (CPS) infrastructure, identifying and mitigating risk of unacceptable consequences while simultaneously reducing expenditures for unnecessary cybersecurity capabilities.

In order for the network digital twin technology to be useful, the simulator and the modeling approach used must satisfy the following important requirements:

• Fidelity – The model must capture the specific configuration, topology, traffic load and dynamics of the CPS systems-of-systems infrastructure at sufficient fidelity such that it can accurately reproduce the behavior of the physical network infrastructure. In particular, packet-level network simulations that can accurately capture network dynamics are critical to providing the needed fidelity. Examples include competition for link bandwidth and buffer space amongst traffic whose source offers different quality of service as well as the impact of denial of service attacks on system controllers.
• Ease of use – Creation and maintenance of high fidelity digital twins can be a resource intensive process. The modeling software must include the ability to create a representative model of CPS systems-of-systems using intermediate representations of the network topology and configuration that are preferably generated in an automated manner (e.g. by network management software) using standardized formats (e.g. Visio).
• Scalability – As the network digital twin must scale to be able to accurately model the entire CPS system-of-systems, it is essential that the modeling tool used have a demonstrated ability to scale up to a large number of network and infrastructure devices as well as the ability to simulate end-to-end traffic transmission.
• Comprehensive device and cyber physical model library – The simulator used to construct the network digital twin must provide a rich set of pre-constructed device models such that the Industrial Control System model(s) can be configured rapidly, preferably using automated or semi-automated tools. The simulator must also support the capability to both model and launch a variety of cyber physical attacks to assess cyber resiliency of the CPS systems-of-systems in a variety of operating conditions.
• Integration with live software/hardware components – The ability to integrate with live software (e.g. network manager or physical component controller) and/or traffic traces will allow the CPS systems-of-systems model to be used to assess realistic operational scenarios. Similarly, the ability to include a subset of the live network and cyber physical defense components CPS system-of-systems will significantly improve fidelity and greatly facilitate model verification & validation.
• Integration with live operators/maintainers – To accurately measure the benefits and risks of people and processes on the CPS systems-of-systems cyber resiliency, the network digital twin must enable interaction with live system operators and maintainers whose actions (keystrokes, clicks, screenshots, voice communications) are recorded. Controlled experimentation with properly trained operators, including logging of attack progression, actual data exchange among systems and their timing, packet drop or modification, and system service availability will enable the specific contributions of each cyber resiliency factor (defense technologies, procedures, human actions) to be accurately quantified, thus creating CPS systems-of-system metrics that can be leveraged for informed investment and planning decisions.

Safely Relying On Digital Twin Technology

Scalable Network Technologies (SNT) is leveraging its experience in network and cyber emulation technologies to model CPS systems, people and processes to evaluate their cyber resiliency.  SNT developed a highly specialized kernel to exploit contemporary multi-core architectures for faster than real-time execution of large-scale, high fidelity models.  SNT can digitally represent the entire cyber physical system network, the various protocol layers, application layer, physical layer, and devices. SNT’s technology includes a low-skew synchronization kernel to connect with live applications, which run on the digital twin just as they would run on real networks. Our network emulation can also interoperate, at one or more protocol layers, with network management and CPS monitoring tools, live applications as well as live routers, firewalls, and other network devices.  SNT’s technologies “mimic” the functions of a real CPS network so that the model appears, interacts, and behaves like the real CPS network. The emulator provides an exact, high quality, reproduction of external behavior so that the emulated system is indistinguishable from the real system and can serve as a lab based system integration, analysis and test tool. It includes the capabilities to collect, report, and visualize a comprehensive set of statistical data that can be used to derive appropriate Measures of Performance (MOPs) from the emulated network under various operating conditions, including when exposed to cyber physical threats.

To learn more about Network Digital Twin Simulation Models, visit www.scalable-networks.com or follow SCALABLE on LinkedIn.