Methodology for information security threat analysis using digital twins - Kotenko, Igor V.; Saenko, Igor B.; Mityakov, Evgenii S.; Kochyn, Victar P. (Journal of the Belarusian State University. Mathematics and Informatics, 2026)
This paper presents a methodology for analysing information security threats in cyber-physical systems based on digital twins. The proposed approach involves formalising the system and threat space through a multi-layered structure, including technical, process, functional, organisational and sectoral layers. Next, dynamic threat modelling is conducted in a secure virtual environment of the digital twin, enabling the reproduction of attack scenarios and generation of synthetic data to train threat indicator detection algorithms. To identify anomalies, frequency analysis, machine learning and clustering methods are applied, ensuring adaptive and accurate detection of both known and previously unknown attacks. The methodology is verified using a smart grid example, demonstrating the effectiveness of training and testing algorithms on synthetic data that reflect normal and emergency operating modes. The results show the potential for creating self-adjusting information security systems with a high degree of adaptability and threat detection accuracy. The presented methodology provides iterative feedback between stages, enhancing the quality of threat modelling and detection.