Threat intelligence using Digital Twin honeypots in Cybersecurity

Abstract

Digital Twins have been deployed for multiple purposes in Cybersecurity. Cyber-Physical Systems and similar systems are benefited from teaming with this technology. The goal of protecting the main systems or devices is easily reached as Digital Twins are known for their success and flexibility in multitasking and can provide adaptability to any device they clone. honeypots are excellent filtering and protection cyber tools capable of investigating and logging malicious activity around a network or device. This cyber tool mimics any network device or system and lures the attacker into a protected surveillance environment. It is not yet given the freedom, though, to act independently other than managing a few tasks and necessitates human intervention to change tactics or configuration. The framework proposed in this paper combines these two technologies, Digital Twins and honeypot, to fill this gap. The DiTwinIHon framework makes the physical honeypot easily adaptable in any network situation while enhancing its Threat Intelligence and providing additional features for detecting and investigating various threats, such as Advanced Persistent Threats.