Applied Science, Faculty of
Engineering, School of (Okanagan)
DSpace
UBCO
Xing, Yuzhen
Master of Applied Science - MASc
University of British Columbia
Cyber security solution for wireless network intends to protect a wireless network from unauthorized and malicious access. The growth in cyber activities presents unprecedented challenges to cyber security at the entrepreneurial and national levels. However, with the rapidly evolving cyber threats and attacks, the existing cyber security solutions struggle to keep up in terms of physical configuration modification and scaling. This thesis proposes a framework for a comprehensive cyber security solution based on the digital twin technology, which generates a virtual representation of a wireless network. We focus on leveraging digital twin technology to deal with most network devices’ security hazards all at once. Users can view and test essential attributes of wireless networks and equipment in a digital twin simulated environment. The security model in the framework can simulate cyber attacks, monitor network security, and set security rules without affecting the live network system.
Cyber Security Digital TwinSimulations for Wireless NetworksbyYuzhen XingB.Sc., The University of British Columbia, 2020A THESIS SUBMITTED IN PARTIAL FULFILLMENT OFTHE REQUIREMENTS FOR THE DEGREE OFMASTER OF APPLIED SCIENCEinTHE COLLEGE OF GRADUATE STUDIES(Electrical Engineering)THE UNIVERSITY OF BRITISH COLUMBIA(Okanagan)April 2023© Yuzhen Xing 2023The following individuals certify that they have read, and recommendto the College of Graduate Studies for acceptance, the thesis entitled:Cyber Security Digital Twin Simulations for Wireless Networkssubmitted by Yuzhen Xing in partial fulfillment of the requirements forthe degree of Master of Applied Science.Dr. Julian Cheng, School of EngineeringSupervisorDr. Qian Chen, School of EngineeringSupervisory Committee MemberDr. Zheng Liu, School of EngineeringSupervisory Committee MemberDr. Ramon Lawrence, Department of Computer Science, Mathematics, Physics and StatisticsUniversity ExamineriiAbstractCyber security solution for wireless network intends to protect a wirelessnetwork from unauthorized and malicious access. The growth in cyberactivities presents unprecedented challenges to cyber security at theentrepreneurial and national levels. However, with the rapidly evolvingcyber threats and attacks, the existing cyber security solutions struggle tokeep up in terms of physical configuration modification and scaling. Thisthesis proposes a framework for a comprehensive cyber security solutionbased on the digital twin technology, which generates a virtualrepresentation of a wireless network. We focus on leveraging digital twintechnology to deal with most network devices’ security hazards all at once.Users can view and test essential attributes of wireless networks andequipment in a digital twin simulated environment. The security model inthe framework can simulate cyber attacks, monitor network security, andset security rules without affecting the live network system.iiLay SummaryIn today’s world, cyber security has become an important issue forbusinesses and the number one priority for many countries. Cyber securitysolution for wireless network intends to protect a wireless network fromunauthorized and malicious access. There are increased security threats incurrent wireless networks; however, the existing cyber security solutionshave their limitations and cannot handle new threats without re-designingthe security detection systems. In this thesis, we collect and summarizerelevant information on cyber security and digital twin and present theadvantages and feasibility of detecting cyber attacks and monitoring thewireless network based on digital twins as a novel cybersecurity solution.On this basis, we design a specific creation and operation process for thecyber security digital twin and conduct system tests for real scenarios.iiiTable of ContentsAbstract . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iiLay Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iiiTable of Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . ivList of Tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viList of Figures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viiAcknowledgements . . . . . . . . . . . . . . . . . . . . . . . . . . . ix1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42.1 Current State of Digital Twin Technology . . . . . . . . . . . 42.2 Benefits of Digital Twin Technology . . . . . . . . . . . . . . 52.2.1 Manufacturing Cost Reduction . . . . . . . . . . . . . 52.2.2 Predictive Analysis and Prediction . . . . . . . . . . . 52.2.3 Remote Monitoring . . . . . . . . . . . . . . . . . . . 52.2.4 The Efficiency and Accuracy of Comprehensive Mea-surements . . . . . . . . . . . . . . . . . . . . . . . . 62.3 Current State of Cyber Security . . . . . . . . . . . . . . . . 62.4 Existing Cyber Security Solutions and Comparison with Dig-ital Twin Technology . . . . . . . . . . . . . . . . . . . . . . 62.5 The Use Cases of the Cyber Security Digital Twin Framework 82.5.1 Base Station Management . . . . . . . . . . . . . . . 82.5.2 Field Service Management . . . . . . . . . . . . . . . 82.5.3 Planning and Design of Network . . . . . . . . . . . . 82.5.4 System Security Testing . . . . . . . . . . . . . . . . 82.5.5 Attack Simulation . . . . . . . . . . . . . . . . . . . . 92.5.6 Intrusion Detection . . . . . . . . . . . . . . . . . . . 9ivTable of Contents3 Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103.1 Overall Structure of the Cyber Security Digital Twin Frame-work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103.2 Wireless Network Simulation . . . . . . . . . . . . . . . . . . 113.2.1 NS-3 Network Simulator Introduction . . . . . . . . . 113.2.2 LTE Network Introduction . . . . . . . . . . . . . . . 123.2.3 The Process of the LTE Simulation Program . . . . . 153.2.4 Header Module Includes . . . . . . . . . . . . . . . . 163.2.5 Ns3 Namespace . . . . . . . . . . . . . . . . . . . . . 173.2.6 Logging Module . . . . . . . . . . . . . . . . . . . . . 173.2.7 Main Function . . . . . . . . . . . . . . . . . . . . . . 173.2.8 Network Topology . . . . . . . . . . . . . . . . . . . . 183.3 Virtual Base Station Model . . . . . . . . . . . . . . . . . . . 253.4 Azure Digital Twin Model . . . . . . . . . . . . . . . . . . . 263.5 3D Digital Twin Display Platform . . . . . . . . . . . . . . . 323.6 Security Model . . . . . . . . . . . . . . . . . . . . . . . . . . 333.6.1 Cyber Attack Detection Model . . . . . . . . . . . . . 343.6.2 Intrusion Detection Model . . . . . . . . . . . . . . . 364 Test Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 384.1 Test scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . 384.2 Result Analysis . . . . . . . . . . . . . . . . . . . . . . . . . 424.2.1 Network Data Analysis . . . . . . . . . . . . . . . . . 424.2.2 Cyber Attack Simulation Data Analysis . . . . . . . . 424.2.3 Digital Twin Results Analysis . . . . . . . . . . . . . 435 Conclusion and Future Plan . . . . . . . . . . . . . . . . . . . 44Bibliography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46vList of Tables4.1 The configuration properties of the simulated LTE networksettings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 384.2 Test results with different numbers of bot users . . . . . . . . 43viList of Figures3.1 Cyber Security Digital Twin Framework Structure . . . . . . 113.2 Basic model of ns-3 simulation network . . . . . . . . . . . . 123.3 3GPP, LTE and 5G global coverage in 2021 and estimatedglobal coverage in 2027 . . . . . . . . . . . . . . . . . . . . . . 143.4 LTE network structure . . . . . . . . . . . . . . . . . . . . . . 153.5 Header files required by the LTE simulation script[21] . . . . 163.6 Ns-3 file namespace [21] . . . . . . . . . . . . . . . . . . . . . 173.7 Ns-3 file logging module[21] . . . . . . . . . . . . . . . . . . . 173.8 Code to enable the logging components[21] . . . . . . . . . . 173.9 Code to create LteHelper[21] . . . . . . . . . . . . . . . . . . 183.10 Code to create MobilityHelper[21] . . . . . . . . . . . . . . . 193.11 Code to add mobility mode to macroEnbs[21] . . . . . . . . 193.12 Code to add mobility mode to homeEnbs[21] . . . . . . . . . 203.13 Code to install NetDevice for the nodes[21] . . . . . . . . . . 203.14 Code to complete EPC preparatory work[21] . . . . . . . . . 213.15 Code to specify the route for EPC[21] . . . . . . . . . . . . . 213.16 Code to configure the LTE UEs for the IP network[21] . . . . 223.17 Code to install the UDP uplink application and downlinkapplication for UEs[21] . . . . . . . . . . . . . . . . . . . . . . 233.18 Code to set the simulation stop time and start the LTE net-work simulation[21] . . . . . . . . . . . . . . . . . . . . . . . . 233.19 Code to set the growth rate of the simulated base stationattributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263.20 BaseStation Azure digital twin model based on DTDL language 283.21 Example of creating a BaseStation Azure digital twin and arelationship edge . . . . . . . . . . . . . . . . . . . . . . . . . 293.22 Example code of ProcessHubToDTEvents . . . . . . . . . . . 313.23 Numerical display plane for 3D models . . . . . . . . . . . . . 333.24 Code to add DDoS attack function to user nodes . . . . . . . 354.1 Azure digital twin graph of LTE network . . . . . . . . . . . 39viiList of Figures4.2 3D display platform of Cyber Security Digital Twin . . . . . 404.3 3D display platform of Cyber Security Digital Twin with theintrusion detection model . . . . . . . . . . . . . . . . . . . . 414.4 The output of LTE neiwork simulation . . . . . . . . . . . . . 42viiiAcknowledgementsI would like to thank my advisor, Professor Julian Cheng for his invaluablementorship, guidance, and support. I would also like to thank my familyfor their support and encouragement.ixChapter 1IntroductionA digital twin is a rapidly evolving emerging technology. Gartner, an ITresearch and consultancy company, has ranked digital twins among thetop-ten emerging technologies [23]. The Industrial Internet Alliance of theUnited States regards digital twins as the core and key technology forimplementing the industrial Internet. Digital twin technology realizes themapping of physical systems to digital models of information and therebycombines the virtual representation of a physical asset with the digitalexpression of production facilities, environment, and processes to achievean intended representation of the real world. This technology uses sensorsarranged in the system to analyze and model physical entities to form amulti-physical simulation process. One emerging example of digital twintechnology for cyber security is the electric power digital twin(EPICTWIN) [15] for cyber security testing.Digital Twin technology is an emerging technology with a promisingfuture. The digital twin can serve a wide range of industries in modernsociety, such as healthcare, manufacturing, and wireless network. Forhealthcare, in the personal health monitoring and management aspect,people can use the medical digital twin to understand the changes in theirbodies more clearly and have early warnings of diseases. Digital twintechnology can significantly reduce the burden and the overall cost ofmedical care. For manufacturing, the digital twin technology can alsosupport equipment diagnosis, chemical production process simulation, andresults prediction in the virtual space. Companies can use the digital twinto increase the connectivity between devices, improving their products’reliability and performance. Although digital twins are involved in manyindustries, the main part of our thesis is about cyber security[10].In recent years, sensor technology and artificial intelligence have beendeveloped rapidly such that, as a real-world application, digital technologycan be applied to the field of cyber security. Compared with traditionalcyber security solutions, such as asset discovery, testbeds, cyber ranges,and honey pots, new solutions based on digital twin technology have theadvantages of high scalability and easily modifiable live system1Chapter 1. Introductionconfigurations. The scalable digital twin can be combined with othertechnologies to generate different security models such as system securitytesting, attack simulation, intrusion detection, detecting misconfigurations,predictive analytics models, etc. The cyber security models included in thedigital twins allow users to handle multiple cyber security riskssimultaneously and obtain real-time network system feedback.To solve the growing threat of cyber attacks, we attempt to create a newcyber security solution using digital twin technology, and call thiscombined solution as cyber security digital twin. We aim to combine therobust scalability of digital twins with different cybersecurity models toachieve comprehensive protection and risk prediction for cyber security.Although many studies have focused on the prevention, governance, andanalysis of cyber security risks, most of them are about traditionalcybersecurity solutions. For example, Vermeer et al. developed an assetdiscovery framework to ensure that organizations can identify which assetsbelong to the IT infrastructure[26]. These studies can only solve specificproblems arising from cyber security and can not be a comprehensivesolution to different cyber security problems like our cyber security digitaltwin. Existing research on digital twins in cyber security only expoundstheoretical knowledge and provides research directions. Dietz et al.elaborated on the potential of digital twins as an Industry 4.0 technologyto deal with industrial control systems security[5]. Holmes et al.’s article“Digital Twins and Cyber Security – solution or challenge?” explores thepossibility of digital twins as a new cybersecurity solution[19]. Thesestudies do not provide an implementable digital twin framework, realexperimental process and experimental data.The contributions of this thesis are as follows:• We have summarized the existing state of cyber security and digitaltwin technology for readers in detail. This summary ensures thatreaders can understand the current situation of network security,including possible cyber risks and traditional cyber securitysolutions, as well as the specific role and implementation methods ofdigital twins.• We propose a novel cyber security solution implemented using digitaltwin technology, which provides a new solution for cyber securityprofessionals to solve existing cyber security issues. Furthermore,compared with traditional cyber security solutions, the proposedsolution is more flexible, efficient and comprehensive in dealing withcyber security issues.2Chapter 1. Introduction• We have completed the basic framework of cyber security digitaltwin. Through system testing, we have realized the essentialfunctions of the cyber security digital twin and two cyber securitymodels: cyber attack detection and intrusion detection. This systemproves the practicability of our proposed cyber security digital twinand lays the foundation for future research.The structure of the whole thesis is divided into five sections. Section 1describes the introduction of the whole thesis. Section 2 details thebackground and current digital twin technology and cyber security state,the overview of existing cyber security solutions and comparison of cybersecurity solutions with digital twin technology, and the use cases of ourcyber security digital twin framework. Section 3 discusses the generaloverview of the project framework and the establishment details of thecyber security digital twin framework, which includes the simulation ofwireless networks and equipment, the two main safety models (i.e., thesafety rule model and the cyber attack model), the process of uploadingand displaying simulated data on the Azure platform. Section 4 presentsthe specific parameters set during the experiment, demonstratesexperimental results and proof of the feasibility of the cyber securitydigital twin framework, and envisions functions of the framework that willbe added in the future and future research directions. Section 5 concludesthe thesis and recommends potential research activities based on theresults and conclusion from the thesis work.3Chapter 2Background2.1 Current State of Digital Twin TechnologyDespite many companies and organizations being excited about thebenefits and potential of digital twin technology, there is no commonlyagreed industry-recognized definition of digital twins yet. However, a hostof companies and organizations are working to tap into the concept’sindustrial potential. For example, Liu et al.[17] believe that “The digitaltwin is actually a living model of the physical asset or system, whichcontinually adapts to operational changes based on the collected onlinedata and information, and can forecast the future of the correspondingphysical counterpart.” Zheng et al.[30] point out, “A Digital Twin is a setof virtual information that fully describes a potential or actual physicalproduction from the micro atomic level to the macro geometrical level.”Another definition is the National Aeronautical Space Administration(NASA), which believes that “A Digital Twin is an integratedmultiphysics, multiscale, probabilistic simulation of an as-built vehicle orsystem that uses the best available physical models, sensor updates, fleethistory, etc., to mirror the life of its corresponding flying twin” [12][29].The basic feature of digital twin is a two-way virtual reality mapping.Two-way virtual reality mapping means that real and virtual entities of thesame object can interact and influence each other. For example, when areal entity changes, the virtual entity will display the same change processand result in virtual space in real-time, and before changing the real entity,you can perform a simulation test on the virtual entity to get the desiredresult and then follow the correct procedure to change the real entity. Thetwo-way mapping between the physical and digital twin models can berealized by constructing a virtual representation of the physical asset.In general, there are three stages in the development of a digital twin. Thefirst stage is the virtual prototype stage, which involves the initial designof the digital twin and a digital description of the complete mechanicalasset or subsystems. The second stage, the narrow digital twin stage,defines the object as the virtual representation of the physical product and42.2. Benefits of Digital Twin Technologyits entire life cycle. Finally, the generalized digital twin stage extends thescope of coverage from the physical product to a wider variety of fieldsbeyond the product itself [28].2.2 Benefits of Digital Twin Technology2.2.1 Manufacturing Cost ReductionDigital twins help to reduce production time and accelerate riskassessment for the industry. Companies can test and validate products yetto be produced [24]. By creating a copy of the planned production process,the digital twin technology can assist engineers in locating in-process faultsbeforehand. Without terminating the ongoing process, the digital twinsystem can be applied to run simulations and identify the merits anddrawbacks of the proposed procedures, as well as select suitableoptimizations. Digital twins can also assist in reducing maintenance costs.Digital twins will help the companies improve equipment reliability, reducedowntime, extend equipment lifespan, and reduce maintenance costs as aresult [25].2.2.2 Predictive Analysis and PredictionDigital twins can help to provide comprehensive analyses and predictions.The Internet of Things sensors of the digital twin system generates bigdata in real-time, so that companies can proactively analyze their data andlocate problems in the system. This enables companies to schedulepredictive maintenance activities more accurately, thus improving theefficiency of the production line and reducing maintenance costs. It alsoprovides valuable reference data for future decision-making [24].2.2.3 Remote MonitoringDigital twins technology enables real-time remote monitoring andcapturing, in-depth views of large physical assets. Digital twins are easilyaccessible: users can remotely monitor and adjust the performance of thesystem [24].52.3. Current State of Cyber Security2.2.4 The Efficiency and Accuracy of ComprehensiveMeasurementsDigital twins can raise the efficiency and accuracy of comprehensivemeasurements [24]. The design and manufacture of products hinge on themeasurement of physical assets, including the measurement of properties,parameters, and operating conditions. However, traditional measurementmethods can be costly and inaccurate. In this case, digital twin technologyoffers more accurate measurements at a lower cost.2.3 Current State of Cyber SecurityCyber security system protects all types of data from theft and damage.The growth of cyber activities has posed an overwhelming challenge tocyber security at entrepreneurial and national levels. Global economiclosses from cyber-attacks reach US$500 billion annually[16].Network operators’ large-scale user databases and complex networkdistribution place heavy demands on comprehensive cyber securitysolutions. The main hazards faced by network operators are the securitythreats introduced by network upgrades and transformation, hiddensecurity risks of the intelligence of mobile terminals, and the laggingconstruction of safety protection systems.Cyber-attacks typically include malicious software, denial of service, andadvanced persistent threat. Malicious software is a program used to invadethe user’s computer in order to steal and destroy data. Denial of servicelaunches intensive attacks from compromised computers on a specifictarget device and exhausts the target device’s network and systemresources, obstructing services to users who send normal requests. Theadvanced persistent threat is a type of long-lived cyber attack aimed atobtaining confidential information of large organizations[27][1]. In thisthesis, we will primarily focus on detecting denial of services in a wirelessnetwork using the digital twin technology.2.4 Existing Cyber Security Solutions andComparison with Digital Twin TechnologyCyber security solutions are approaches and techniques to protect networkholders and users from cyberattacks. Asset discovery, testbeds, cyberranges, and honey pots are four common cyber security solutions [6]. Asset62.4. Existing Cyber Security Solutions and Comparison with Digital Twin Technologydiscovery refers to tracking, discovering, and analyzing network assets. Interms of data management, asset discovery can help enterpriseorganizations sort out the data storage applications and services currentlyoperating in the network and provide an information foundation for datagovernance and asset management. In terms of security, asset discoverycan identify all unreported assets in the customer’s network and discoverpossible security risks in advance. A testbed is an infrastructure testingmethod based on the combination of virtual and physical components.Testbeds are generally used to test the planned infrastructure’sperformance and security. In wireless networking, testbeds can be used tosecure base stations or network equipment. A cyber range is a simulationand reproduction, based on virtualization technology, of the networkarchitecture, system equipment, business process operating status, andoperating environment in cyberspace. Honey pots are the technology todeceive attackers. Hosts, network services or information can be arrangedas bait to induce attacks, which can then be captured and analyzed. Honeypots can interpret the tools and methods used by attackers, infer attackintentions and motivations, inform defenders of the security threats theyface and enhance the security protection capabilities of existing systems.Although traditional cyber security solutions usually play a role in networkprotection and governance, they only focus on specific security issues. Forexample, asset discovery only focuses on the security of IP-enabled deviceson the network. Testbeds specialize in the security of plannedinfrastructures, such as base stations and servers. Cyber ranges focus onimproving IT infrastructures’ security, stability, and performance. Theusage of honey pots mainly aims at extracting attack methodologies.Comprehensive network security protection via traditional methods entailsthe combination of multiple solutions, which greatly increases the use andmaintenance cost of the protection. In contrast, the cyber solutions thatemploy digital twin technology have robust scalability and extensibility:they can be combined with other technologies to generate different securitymodels such as system security testing, attack simulation, intrusiondetection, detecting misconfigurations, and predictive analytics models.Security models are the extra functions added to the original digital twin’sbasic framework and realize almost all the functionalities of the traditionalsolutions. Therefore, the digital twin cyber security solution with strongscalability can solve most of the common cyber security issues and providereal-time feedback to users[6][8].72.5. The Use Cases of the Cyber Security Digital Twin Framework2.5 The Use Cases of the Cyber Security DigitalTwin FrameworkWe applied the digital twin technology to the wireless network domain andthus proposed a new solution named cyber security digital twin frameworkfor wireless network security. We have listed below six use cases of oursystem for wireless networks to demonstrate the value and usefulness ofour system. Among the six use cases, the cyber security digital twinframework system we designed is mainly concerned with base stationmanagement, attack simulation, and intrusion detection.2.5.1 Base Station ManagementCyber security digital twin framework allows base station owners toremotely monitor and control the primary properties of a base station, nomatter where they are located. Remote sensors on the base station cancollect data on temperature, humidity, electricity usage, PM2.5 levels, etc.,assess whether these data are within normal ranges using the deep learningalgorithms, and transmit these data to the base station’s digital twin.2.5.2 Field Service ManagementThe digital twin equipped with the cyber security digital twin frameworkallows users to promptly obtain critical information and find solutionswhen problems occur on the wireless network without a physical visit.Thus, the delay in wireless network-related information is avoided, thetime required for network maintenance is greatly reduced, and the staff’swork efficiency is increased.2.5.3 Planning and Design of NetworkDeployed wireless network configurations may require changes or upgradesover time and equipment generations. The digital twin framework allowsusers to attempt modifications and upgrades on the existing network in avirtual backup without affecting the real network’s operation [19].2.5.4 System Security TestingThe cyber security digital twin framework can simulate the securityconfiguration of network systems in a virtual space and investigatepotential misconfigurations and security risks in the network. Users can82.5. The Use Cases of the Cyber Security Digital Twin Frameworkalso set specific security rules for the network. As soon as the digital twinframework detects a violation of security rules, it will notify the user of thecyber security digital twin [6][13][5].2.5.5 Attack SimulationThe cyber security digital twin framework can simulate the existingnetwork under different cyber attacks. This allows operators to bettermaintain and arrange their network systems and use simulated parametersto predict network attacks.2.5.6 Intrusion DetectionThe cyber security digital twin will monitor various important networksystem data in real-time and analyze whether the data is within areasonable range to check signs of cybersecurity policy violations or cyberattacks in the network [7][22].9Chapter 3Methodology3.1 Overall Structure of the Cyber SecurityDigital Twin FrameworkDue to time and equipment issues, we chose to use a virtual networkenvironment to build our cyber security digital twin framework. The entiredigital twin project is thus divided into five parts. The first part is asuitable simulated wireless network using NS-3, a discrete event networksimulator. The reason for choosing NS-3 as the network simulator for thecyber digital twin framework project is that NS-3 has more comprehensivemodels in several popular research areas, such as LTE and WiFi models.The second part is a virtual base station model based on the simulatednetwork. The base station model can contain the basic environment andinternal data required by users, such as the base station’s temperature,humidity, and output power. After the basic network system is built, thethird part is the first draft of the network digital twin set up on the Azureplatform. After uploading the collected data of the simulated networks andbase stations to the cloud in real-time, we create the digital twin models ofthe entire network system on the Azure platform and connect the modelsto the cloud data. The fourth part is a 3D digital twin display platform. Inthe fourth part, a 3D model of the network bound to the digital twinmodel is required to display the collected data of the network in a visualform. The last part is the security model for the cyber security digital twinframework. Each security model has a different function and needs to beprogrammed separately before being installed on the draft of the networkdigital twin on the Azure platform.103.2. Wireless Network SimulationFigure 3.1: Cyber Security Digital Twin Framework Structure3.2 Wireless Network Simulation3.2.1 NS-3 Network Simulator IntroductionWireless network simulation and data collection are the top priorities forthe cyber security digital twin framework. The simulated wireless networkwill be formed based on the NS-3 network simulator. NS-3 [21] is anopen-source project written in C++, whose main operating platform isGNU/Linux. NS-3 can simulate network structures of various types andscales in the physical world on a single computer. Unfortunately, NS-3does not have a graphical user interface. Therefore, users need to gothrough four basic steps to perform network simulation: download andcompile the source code, and write and run the simulation script. Notably,the trace generation function of NS-3 enables users to perform dataanalysis on the data generated by NS3 through third-party software.In NS-3, nodes, channels, and network devices that connect channels innodes are abstracted into three C++ classes: Node, Channel, andNetDevice. Different types of channels correspond to different NetDeviceand Channel subclasses. In addition to Node, Channel, and NetDevice,NS-3 also features the main classes Application and Topology Helper. The113.2. Wireless Network SimulationNode class mainly represents basic computer equipment in NS-3, includinghosts, routers, etc. Although a single node can represent a computer withvarious functions, the Node requires additional network cards, protocolstacks, and applications to work properly. Application class refers to a userprogram that performs certain activities. Application is attached to Nodeand is used to simulate the scenario where the application runs on a node.In NS-3, the channel class represents the basic communication subnet.Channel class provides various methods to manage communication subnetobjects and connected nodes. The NetDevice class represents hardwaredevices and software drivers. NetDevice needs to be installed on each Nodeto enable communication through channels. The Topology Helper classfacilitates the creation of simulated networks. Topology Helper reduces thecomplex and tedious steps required to create a simulated network into onesimple operation. For example, through Topology Helper, users can easilyconnect Net Device to Node and Channel or configure Netdevice andChannel on the network.Figure 3.2: Basic model of ns-3 simulation network3.2.2 LTE Network IntroductionThe simulated network type selected for the experiment is the LTEnetwork. We originally planned to use the 5G template to create a123.2. Wireless Network Simulationsimulated network at the beginning because 5G is the newest generation ofbroadband cellular networks. However, 5G is an emerging technology,which means the simulation of 5G’s network functions in the NS-3 networksimulator is incomplete, so it is challenging to obtain highly reliablesimulation data. Therefore, we decided to use the LTE network, which hashigher popularity than the 5G network and is more feature-complete in theNS-3 simulator, as the simulated network template of the cyber securitydigital twin framework.Statistics from Ericsson show that in 2021, LTE networks covered nearly86% of the world’s regions [9]. LTE, or Long Term Evolution, is atransition between 3G and 4G technology. LTE adopts a single-layerstructure composed of Node B, which helps to simplify the network, andreduce the delay; LTE supports flexible bandwidth deployment,high-quality service, and seamless mobility of packet-switched traffic. LTEimproves the air access technology of 3G and adopts OFDM and MIMO asthe only standards for its wireless network evolution. Compared with 3Gtechnology, LTE improves communication rate, spectrum efficiency, andcell boundary bit rate, and through the Quality of Service (QoS)mechanism, the QoS mechanism ensures service quality and reduceswireless network delay [18][20].133.2. Wireless Network SimulationFigure 3.3: 3GPP, LTE and 5G global coverage in 2021 and estimated globalcoverage in 2027LTE network is mainly composed of User Equipment (UE), EvolvedUniversal Mobile Telecommunications System Terrestrial Radio AccessNetwork (E-UTRAN), and Evolved Packet Core (EPC). The userequipment is mobile equipment that uses either Universal MobileTelecommunications System (UMTS) or Global System for MobileCommunications (GSM) internally. The E-UTRAN structure willgenerally contain several eNodeBs. The bottom layer between eNodeBsadopts IP transmission and is connected to each other with the X2interface. Such a structure can ensure seamless user handovers andsupport UEs’ mobility in the entire network. Furthermore, the eNodeBsincluded in the E-UTRAN can be connected to the Mobility ManagementEntity (MME) through the S1 interface. On this basis, the control anduser plane of the S1 interface are S1-MME and S1-U, respectively. For theEPC side, the whole EPC in LTE is composed of MME, Serving Gateway(S-GW), and (Packet Data Network Gateway) P-GW, where MME is usedfor mobility management, P-GW is used to link the Internet, and S-GW isused as a user access network for routing selection, resource allocation, etc.The main functions of MME include paging, handover, roaming,143.2. Wireless Network Simulationauthentication, etc. The S-GW is mainly responsible for transmitting datainformation between the base station and the public data gateway andproviding buffering for downlink data packets. The P-GW is a gatewayconnected to an operator’s external or internal packet network, and it is aunified access point of all 3GPP system or non-3GPP system packetnetworks. The P-GW is set up to facilitate the introduction of packetnetworks other than the LTE system so as to minimize the number ofinterfaces introduced into LTE by multiple systems. [18][20].Figure 3.4: LTE network structure3.2.3 The Process of the LTE Simulation ProgramBecause NS-3 is supposed to run on a Linux system, users need to useC++ to program the network simulation script. Our LTE simulationprogram adopts the deployment method of a heterogeneous network, whereconventional macrocells and microcells are deployed in a mixed manner.The advantage of a heterogeneous network is that it can greatly improvenetwork performance because the low-power nodes deployed in themacrocell blind area increase network coverage, and deploying low-powernodes in macrocell hotspot cells enhance link quality and increase systemcapacity. The microcell type in our LTE network framework is indoor basestations (home eNB). In the 3GPP LTE standard, eNB stands for an153.2. Wireless Network SimulationEnhanced Node. Home eNBs are generally aimed at families or smallbusinesses, so in most cases, home eNBs are privately owned, whichrequires them to decide whether to provide services based on user identity.In view of this situation, the home eNBs adopt the concept of ClosedSubscriber Group (CSG) mode to identify users. CSG refers to a specificgroup of users that are allowed to access the network by home eNB. A usercan belong to multiple CSGs, and each CSG has its unique CSG ID. Onlyusers with CSG IDs recognized by the home eNBs can access the network.Users without a CSG ID recognized by the home eNBs can only performdata communication with the macro eNB. The creation of LTE simulationprogram can be divided into nine steps.3.2.4 Header Module IncludesThe first step to creating the LTE simulation program is to find and addthe required header at the top of the simulation file. Each header stores ahuge number of include files of the same group. Adding the proper headerscan help users grasp the dependencies needed to create LTE networks.Specifically, there are the following 20 header files used to simulate theLTE framework.#include <ns3/core−module .h>#include <ns3/network−module .h>#include <ns3/mobility−module .h>#include <ns3/ internet−module .h>#include <ns3/ lte−module .h>#include <ns3/config−store−module .h>#include <ns3/buildings−module .h>#include <ns3/point−to−point−helper .h>#include <ns3/applications−module .h>#include <ns3/ log .h>#include <iomanip>#include <ios>#include <string>#include <vector>#include <ns3/csma−helper .h>#include <ns3/nstime .h>#include <ns3/point−to−point−module .h>#include <ns3/applications−module .h>#include <ns3/ipv4−global−routing−helper .h>#include <ns3/netanim−module .h>Figure 3.5: Header files required by the LTE simulation script[21]163.2. Wireless Network Simulation3.2.5 Ns3 NamespaceThe second step is to add the namespace ns3 to the script. All NS-3projects are done in a C++ namespace called ns3. The ns3 namespace ismainly to protect the NS-3 source code, and the ns3 namespace canseparate NS-3 projects and non-NS-3 projects and is beneficial for theintegration of the NS-3 project with other code.using namespace ns3 ;Figure 3.6: Ns-3 file namespace [21]3.2.6 Logging ModuleThe third step is optional, to add a logging module to the script. Thelogging module will start running by adding anNS LOG COMPONENT DEFINE entry, which will allow the use ofmacros in the log system to print auxiliary information in the script.Auxiliary information will aid in the code debugging and simulationprocess.NS_LOG_COMPONENT_DEFINE ("LTEScript");Figure 3.7: Ns-3 file logging module[21]3.2.7 Main FunctionThe fourth step is to complete the preparation of the script’s mainfunction. The main part of the entire LTE simulated network should beincluded in the main function, so the necessary preparations in the mainfunction should be completed before writing the LTE network architecture.Enabling the logging components is a necessary preparation before writingthe network framework. The code for enabling can be seen in Figure 3.8.LogComponentEnable("UdpEchoClientApplication",LOG_LEVEL_INFO);LogComponentEnable("UdpEchoServerApplication",LOG_LEVEL_INFO);Figure 3.8: Code to enable the logging components[21]173.2. Wireless Network Simulation3.2.8 Network TopologyCompleting the network topology is the main part of the LTE networkscript. In the physical network, network topology consists of several nodesand channels that link the nodes. In NS-3, creating network topologiesrequires using different types of subclasses of the Node, Channel, andNetDevice classes.NodeContainer ClassThe first step in completing a network topology is to create network nodes.The abstraction of a node represents a computer that can add protocolstacks, applications, etc. In NS-3, node objects can be created using theNodeContainer class. The topology generator of NodeContainer provides asimple and convenient approach to create and manage all node objects.Because the heterogeneous network includes macro eNBs and home eNBs,and users also need to exist as nodes, four types of nodes need to becreated: home eNBs (homeEnbs), macro eNBs (macroEnbs), home user(homeUes), and macro user (macroUes). In the 3GPP LTE standard, UEsstand for mobile User Equipment. We declare three NodeContainersnamed homeEnbs, macros, and homeUes, then use the Create method inNodeContainer to create nodes for those three NodeContainers.LteHelper ClassCreating a LteHelper object is the second step of completing the networktopology. LteHelper is mainly used to facilitate the creation andconfiguration of basic properties of LTE entities. LteHelper can help usersto create various LTE objects such as channels, eNBs and UEs and arrangethem together to form the entire LTE system. Figure 3.9 shows thesimplest method of creating LteHelper in NS-3. The detailed settings inLteHelper can be changed according to user requirements.Ptr <LteHelper> lteHelper = CreateObject<LteHelper> ();Figure 3.9: Code to create LteHelper[21]MobilityHelper ClassIn order to create a simulated network close to the real one, both the basestation and the user should have clear location and movement settings. In183.2. Wireless Network SimulationNS-3, MobilityHelper is a helper class that assigns position and mobilitymodels to nodes. It facilitates the construction of virtual networkscenarios. Figure 3.10 shows the code needed to create the MobilityHelper.MobilityHelper mobility;mobility.SetMobilityModel ("ns3::ConstantPositionMobilityModel");Figure 3.10: Code to create MobilityHelper[21]Mobility mode needs to be installed in different types of nodes successively.The first is to add mobility mode to macroEnbs and change the basicproperties of the macroEnbs node, such as beamwidth, max attenuation,etc., through lteHelper.mobility.Install (macroEnbs);BuildingsHelper::Install (macroEnbs);lteHelper->SetEnbAntennaModelType ("ns3::ParabolicAntennaModel");lteHelper->SetEnbAntennaModelAttribute ("Beamwidth",DoubleValue (Beamwidth));...Figure 3.11: Code to add mobility mode to macroEnbs[21]The next step is to add mobility mode to the homeEnbs node. Thedifference between this step and the last is that users need to create anduse a PositionAllocator to allocate rooms to the homeEnbs, and addexclusive CSG ID to homeEnbs through LteHelper. The PositionAllocatorclass can be used to allocate position information to nodes. The first twolines of code in Figure 3.12 show the process of creating aPositionAllocator and using the PositionAllocator to assign eachhomeEnbs to a random location in a different buildingPtr<PositionAllocator> positionAlloc = CreateObject<RandomRoomPositionAllocator> ();mobility.SetPositionAllocator (positionAlloc);mobility.Install (homeEnbs);BuildingsHelper::Install (homeEnbs);193.2. Wireless Network SimulationlteHelper->SetEnbAntennaModelType ("ns3::IsotropicAntennaModel");...Figure 3.12: Code to add mobility mode to homeEnbs[21]The third step is to allocate the location for homeUes by usingPositionAllocator and setting the correct CSG Id. The allocation patternof homeUes is sequentially configured in each room with homeEnbs.The final step is to randomly assign positions to macroUes within auser-specified range.NetDeviceAfter assigning mobility mode to all nodes, the next step is to installNetDevice for the nodes. In NS-3, the user can use the Install method ofLteHelper to create the required NetDevice for the nodes. Before creatingNetDevices, users need to create NetDeviceContainer and add the nodeswhose NetDeviceContainer needs NetDevices installed. The LteHelper willinstantiate a network device for each node stored in NetDeviceContainer.NetDeviceContainer macroEnbDevs = lteHelper->InstallEnbDevice (macroEnbs);NetDeviceContainer homeEnbDevs = lteHelper->InstallEnbDevice (homeEnbs);NetDeviceContainer homeUeDevs = lteHelper->InstallUeDevice (homeUes);NetDeviceContainer macroUeDevs = lteHelper->InstallUeDevice (macroUes);Figure 3.13: Code to install NetDevice for the nodes[21]EPCAn essential step to complete a simulated LTE network is theestablishment of an EPC. EPC is primarily intended to enable the use ofIPv4 networks with NS-3 applications and sockets. In order to create afully functional EPC, an additional EpcHelper class is preferred. The mainfunction of EpcHelper is to help create EPC entities and network203.2. Wireless Network Simulationtopologies. However, EpcHelper is an abstract base class, so users need touse EpcHelper’s PointToPointEpcHelper subclass that provides differentEPC topology implementations and informs LteHelper that the script willuse EPC.Ptr<PointToPointEpcHelper> epcHelper;epcHelper = CreateObject<PointToPointEpcHelper> ();lteHelper->SetEpcHelper (epcHelper);Figure 3.14: Code to complete EPC preparatory work[21]For the EPC of the LTE network to function properly, we need to create aPacket Data Network Gateway (PGW) through EpcHelper, tweak it forproper handling of traffic from the LTE network, and then connect thePGW to other IPv4 networks. The next step is to create a singleRemoteHost using InternetStackHelper and an Internet usingPointToPointHelper and Ipv4AddressHelper. The role ofPointToPointHelper is to build a set of devices for a point-to-point networklink and to set key parameters such as the data rate of the point-to-pointchannel and the transmission delay value. The role of Ipv4AddressHelperis to set the IP address for the device on the node, usually starting from1.0.0.0 and assigning the address with the subnet mask of 255.0.0.0.After the completion of the network creation, the next step is to specifythe route. In this case, we create Ipv4StaticRoutingHelper to add staticrouting protocols for IP version 4 stacks. Ipv4StaticRoutingHelper willautomatically assign an IP address to LTE UEs.Ipv4StaticRoutingHelper ipv4RoutingHelper;Ptr<Ipv4StaticRouting> remoteHostStaticRouting =ipv4RoutingHelper.GetStaticRouting (remoteHost->GetObject<Ipv4> ());remoteHostStaticRouting->AddNetworkRouteTo (Ipv4Address ("7.0.0.0"), Ipv4Mask ("255.0.0.0"), 1);Figure 3.15: Code to specify the route for EPC[21]The final step is to configure the LTE UEs for the IP network. We storethe NetDevice of UEs and UEs in two different NodeContainers and install213.2. Wireless Network Simulationthe IP stack on the UEs. Then we connect the NetDevice of UEs to eNBsand create Radio Resource Control (RRC) connections between them.NodeContainer ues;NetDeviceContainer ueDevs;Ipv4InterfaceContainer ueIpIfaces;ues.Add (homeUes);ues.Add (macroUes);ueDevs.Add (homeUeDevs);ueDevs.Add (macroUeDevs);internet.Install (ues);ueIpIfaces = epcHelper->AssignUeIpv4Address (NetDeviceContainer (ueDevs));lteHelper->Attach (macroUeDevs);lteHelper->Attach (homeUeDevs);Figure 3.16: Code to configure the LTE UEs for the IP network[21]ApplicationThe next step is to install the application on UEs. Before installing theapplication, we need to configure the UEs for the IP network. We set adefault gateway for UEs with the help of Ipv4StaticRouting.Then we install the User Datagram Protocol (UDP) uplink application anddownlink application for UEs. UDP is a connectionless transport protocol.The main features of UDP are connectionlessness, best-effort delivery,packet-orientedness, no congestion control, and support for one-to-one,one-to-many, many-to-one, and many-to-many interactive communication.Although UDP does not guarantee reliable delivery, meaning that thetransmitted data may contain errors, losses, or duplicates, UDP has amore advanced default model than other protocols in the ns-3 networksimulator. Therefore, we chose to use UDP in our simulated network toensure the accuracy of the simulation. Moreover, since our framework isstill in the initial stage and not integrated with the physical network, thechoice of UDP will not significantly affect the test results. We useUdpClientHelper and PacketSinkHelper to help us install client and serverapplications of UDP applications.ApplicationContainer clientApps;ApplicationContainer serverApps;223.2. Wireless Network SimulationUdpClientHelper dlClientHelper (ueIpIfaces.GetAddress(u), 1000);clientApps.Add (dlClientHelper.Install (remoteHost));PacketSinkHelper dlPacketSinkHelper ("ns3::UdpSocketFactory", InetSocketAddress (Ipv4Address::GetAny (), 1000));serverApps.Add (dlPacketSinkHelper.Install (ue));UdpClientHelper ulClientHelper (remoteHostAddr, 2000);clientApps.Add (ulClientHelper.Install (ue));PacketSinkHelper ulPacketSinkHelper ("ns3::UdpSocketFactory", InetSocketAddress (Ipv4Address::GetAny (), 2000));serverApps.Add (ulPacketSinkHelper.Install (remoteHost));Figure 3.17: Code to install the UDP uplink application and downlink ap-plication for UEs[21]The next step of creating a network topology is to set up a dedicatedbearer for the application on the UEs communicating on ports 1000 and2000. Our approach is to create an Evolved Packet System (EPS) bearertraffic template (TFT), which is a collection of all packet filters associatedwith an EPS bearer and to set up a dedicated EPS bearer with theActivateDedicatedEpsBearer method that comes with LteHelper.The last step is to set the application start time and start the program.Simulation Output and ControlThe last step of creating a Network Topology is to set the simulation stoptime and start the LTE network simulation, and then collect thesimulation data. The user can set the stop time of the LTE networksimulation through the first line of code in Figure 3.18 and start thecompleted LTE network simulation script through the second line of code.Simulator::Stop (Seconds (simTime));Simulator::Run ();Figure 3.18: Code to set the simulation stop time and start the LTE networksimulation[21]233.2. Wireless Network SimulationUsers can collect PHY, MAC, RLC and PDCP level Key PerformanceIndicators (KPIs) with LteHelper. Both RLC and PDCP KPIs are dividedinto two types of data: one is uplink, and the other is downlink. They arestored in different ASCII files. Because RLC KPIs contain all the dataneeded to complete data twinning at this stage, only the main componentsof PLC KPIs are shown here.1. Start time of measurement interval in seconds since the start ofsimulation2. End time of measurement interval in seconds since the start ofsimulation3. Cell ID4. Unique UE ID (IMSI)5. Cell-specific UE ID (RNTI)6. Logical Channel ID7. Number of transmitted RLC PDUs8. Total bytes transmitted9. Number of received RLC PDUs10. Total bytes received11. Average RLC PDU delay in seconds12. Standard deviation of the RLC PDU delay13. Minimum value of the RLC PDU delay14. Average RLC PDU size, in bytes15. Standard deviation of the RLC PDU size16. Minimum RLC PDU size17. Maximum RLC PDU size[21]243.3. Virtual Base Station Model3.3 Virtual Base Station ModelTo fully simulate the LTE wireless network ecosystem, the creation ofvirtual network base station facilities is indispensable. During the signaltransmission process of the wireless network, the signal may encountermany obstacles, such as changes in ambient temperature, shelters, etc. Inthis case, we not only install a 3D model for the virtual base station butalso use C to add dynamic data to the simulated base station, similar tothe real base station.We choose the temperature, humidity, output power, and PM2.5concentrations as the dynamic variables that the virtual base stationsimulates because these four attributes significantly impact the operationof the base station and signal propagation. Regarding the numerical rangeof outdoor temperature, humidity, and PM2.5 concentration simulated bythe virtual base station, reference is made to Dr. Shilpa Choudhary’sexperiments [4] on the relationship between changes in atmosphericconditions and LTE base station signal strength. Experiments have provedthat the optimal transmission signal conditions of the LTE base station areonly satisfied when the atmosphere temperature, relative humidity, and airquality index for PM2.5 are 13.10°C, 31.30 %, and 52.10, respectively.Therefore, we set the initial values of the virtual base station’stemperature, humidity, and PM2.5 concentration to the optimal values of13.10°C, 31.30 %, and 52.10, respectively, and set the variable range of thethree attributes as 12°C-48°C, 25%-75%, and 50-500, respectively. Theanalog range setting reference for output power is “LTE; Evolved UniversalTerrestrial Radio Access (E-UTRA); Base Station (BS) radio transmissionand reception,” published by the European Telecommunications StandardsInstitute (ETSI) [14]. We choose Local Area BS, which has one transmitantenna port as the template of our virtual base station, so the basestation rated output power should be set to be less than or equal to24dBm, and the amplitude should not exceed 2dB.To produce changes in the four dynamic data of the base stations, thevirtual base station will update the data every second, and each updatewill generate a random number between 0.0 and 1.0 called rand. Theformula for the variation range of each data will be shown in Figure 3.19.double currentTemperature = Temperature + randA.NextDouble() * 4 - 3;253.4. Azure Digital Twin ModelFigure 3.19: Code to set the growth rate of the simulated base stationattributes3.4 Azure Digital Twin ModelWe decided to create our digital twin model based on the Microsoft AzureDigital Twin platform [2]. Azure Digital Twin is a new service fromMicrosoft that is both a platform and a tool. Azure Digital Twin helpsusers digitize their physical assets by providing digital modelling tools.Azure Digital Twin can also be used in conjunction with other services tooffer more functions and conveniences, such as anomaly detection, dataprocessing platform, digital modelling, etc. Azure Digital Twin allows usto model relationships between people, places, and devices through spatialintelligence graphs. Azure Digital Twin allows us to run custom functionson incoming device data to generate automated actions based on the datareceived while being contextual and spatially aware. Azure Digital Twinssimplifies the development of complex models and provides new, moremature capabilities for traditional IoT solutions.In Azure Digital Twins, digital entities of physical assets and locations areoften defined using models. Models are written in the Digital TwinsDefinition Language (DTDL), a JSON-LD-based modelling languagedeveloped by Microsoft for digital twin instances. The purpose ofdeveloping DTDL is to help designers create more complete and realisticsystem models. Models created in DTDL language can incorporate thephysical properties of objects and the conditions under which objectsoperate in the real world. Compatibility between a DTDL model and anAzure Digital Twin instance needs to meet four conditions. The firstcondition is that the DTDL elements contained in the model need to be ofinterface type. The second condition is that the DTDL model used inAzure digital twin cannot define any commands. The third condition isthat any interface used as a component in a DTDL model cannot have anycomponents. The fourth condition is that each interface in a DTDL modelneeds to have its own unique ID so that when an interface wants to includeother interfaces through inheritance, the first interface can directly refer tothe interface ID.Each digital twin model represents physical entities in a virtualenvironment by setting state properties, telemetry events, components, andrelationships. The created digital twin model can be used as a template toset up the digital twin of a specific entity. For example, a digital twin263.4. Azure Digital Twin Modelmodel of an LTE base station can be created and used as a template to setup multiple different digital twins (base station a, base station b). Inmodel creation, it is necessary to define the relationship between themodels so that the models can be connected to form a conceptual map.Creating an IoT Hub based on the Azure platform and connecting thesolution to IoT devices enables Azure Digital Twins to be a real-time,up-to-date representation of the real world.The first step in completing an Azure LTE network digital twin is to createa basic model of the network and base stations. The basic models requiredby the Azure LTE network digital twin can be divided into BaseStation,MacrocellSites, and LTEnetwork. BaseStation, MacrocellSites, andLTEnetwork represent the individual base station in the LTE network, thearea served by a given base station, and the entire LTE network, includingall base stations. The figure 3.20 shows an example of the LTEnetworkmodel.{"@id": "dtmi:example:BaseStation;1","@type": "Interface","displayName": "BaseStation","@context": "dtmi:dtdl:context;2","contents": [{"@type": "Property","name": "Humidity","schema": "double"},{"@type": "Property","name": "PM25","schema": "double"},{"@type": "Property","name": "OutputPower","schema": "double"},{273.4. Azure Digital Twin Model"@type": "Property","name": "Temperature","schema": "double"},{"@type": "Property","name": "Warning","schema": "string"},{"@type": "Relationship","name": "contained","displayName": "contained"}]}Figure 3.20: BaseStation Azure digital twin model based on DTDL languageThe second step in completing an Azure LTE network digital twin is tomake the Azure digital twin graph based on the DTDL model. Creating aseparate Azure digital twin requires assigning values to each property inthe DTDL model and establishing relationships between connected digitaltwins. Figure 3.21 is a simple example of establishing a base station digitaltwin and its relationship.await cl.CommandCreateDigitalTwin(new string[42]{"CreateTwin", "dtmi:example:BaseStation;1", "BaseStation1","Temperature", "double", "0","Humidity", "double", "0","PM25", "double", "0","OutputPower", "double", "0","Warning", "string", @""" """,});await cl.CommandCreateRelationship(new string[5]{"CreateEdge", "MacrocellSites1", "contains", "BaseStation1", "283.4. Azure Digital Twin ModelMacrocellSites1_to_BaseStation1",});Figure 3.21: Example of creating a BaseStation Azure digital twin and arelationship edgeFor the Azure digital twin to receive and update data in real-time, it firstneeds to create an authenticated digital twin instance on the Azureplatform and install and configure Azure Cloud Shell. Azure Cloud Shell isa tool that helps users configure digital twin environments. Then thefinished DTDL model should be associated with the Azure digital twininstance through the Digital Twin ID and set local Azure credentials.Next is to create a pre-set digital twin model, scenarios, and logicalrelationships in the Azure Digital Twin instance. Then we program twofunctions, ProcessHubToDTEvents, and ProcessDTRoutedData, to processexternal data. ProcessHubToDTEvents is responsible for processing thedata transmitted from the IoT hub to the digital twin.ProcessDTRoutedData is responsible for the data updated by the digitaltwin and will automatically update the parent twin of the digital twin thatchanges the data. Between the two functions, ProcessHubToDTEvents ismore valuable for Azure digital twin.public class ProcessHubToDTEvents{private static readonly HttpClient httpClient =new HttpClient();private static string adtServiceUrl =Environment.GetEnvironmentVariable("ADT_SERVICE_URL");[FunctionName("ProcessHubToDTEvents")]public async void Run([EventGridTrigger]EventGridEvent eventGridEvent, ILogger log){var credentials = new DefaultAzureCredential();DigitalTwinsClient client = newDigitalTwinsClient(293.4. Azure Digital Twin Modelnew Uri(adtServiceUrl), credentials, newDigitalTwinsClientOptions{ Transport = new HttpClientTransport(httpClient) });log.LogInformation($"ADT service clientconnection created.");if (eventGridEvent != null && eventGridEvent.Data != null){log.LogInformation(eventGridEvent.Data.ToString());JObject deviceMessage = (JObject)JsonConvert.DeserializeObject(eventGridEvent.Data.ToString());string deviceId = (string)deviceMessage["systemProperties"]["iothub-connection-device-id"];var temperature = deviceMessage["body"]["Temperature"];var Humidity = deviceMessage["body"]["Humidity"];var PM25 = deviceMessage["body"]["PM25"];var OutputPower = deviceMessage["body"]["OutputPower"];var updateTwinData = newJsonPatchDocument();updateTwinData.AppendReplace("/Temperature", temperature.Value<double>());updateTwinData.AppendReplace("/Humidity", Humidity.Value<double>());updateTwinData.AppendReplace("/PM25",PM25.Value<double>());updateTwinData.AppendReplace("/OutputPower", OutputPower.Value<double>());await client.UpdateDigitalTwinAsync(deviceId, updateTwinData);}303.4. Azure Digital Twin Model}}Figure 3.22: Example code of ProcessHubToDTEventsAfter completing the ProcessHubToDTEvents and ProcessDTRoutedDatafunctions, we upload the file to Azure Cloud Shell and publish it to thefunction app in Azure. The specific steps are first to create an Azurestorage user and function applications, then to upload the two functions tothe Azure Cloud Shell and deploy them to the Azure function application,and finally to configure the access role for the Azure digital twin instance.This step mainly aims to protect data security and control the number ofusers who can access or modify the Azure digital twin instance.Next, in order for the Azure digital twin to receive the analog telemetrydata in real-time, IoT hub devices need to be connected to Azure DigitalTwins. First, we create an IoT hub instance and connect the previouslycreated ProcessHubToDTEvents function to the IoT hub so that the datareceived by the IoT hub can flow out to the Azure digital twin through thefunction. Transferring the data obtained by the simulation program of theLTE network and the base station to the IoT hub requires registering thesimulated device with the IoT hub and associating the simulated devicewith the prepared network and base station simulation program. Thenetwork and base station simulators need to be inserted with the IoT Hubconnection string and the device connection string obtained through theAzure Cloud Shell in order to connect to the IoT Hub.The final step is to allow Azure Digital Twins to update data internally–inother words, to enable parent and child models in Azure Digital Twins toupdate each other. For example, the relationship between theMacrocellSites model and the BaseStation model is ”contained”– that is,they are the parent-child model relationship, so we need to update theBaseStation model data contained in the MacrocellSites modelsynchronously when the BaseStation model data is updated. Completingthe internal update functionality requires creating an Event Grid topic,endpoint, and route. The event grid is an event broker provided by theAzure platform, the main function of which is to connect solutions usingan event-driven architecture, so that the changing events can becommunicated to other applications. The main purpose of the event gridendpoint is to enable the Azure digital twin to connect to the event gridtopic. The route represents the Azure Digital Twins route, the channel313.5. 3D Digital Twin Display Platformbetween the Azure digital twin and the event grid endpoint. Then thetelemetry data is sent to the ProcessDTRoutedData function through theevent grid topic and subsequently passed to the Azure digital twin tocomplete the data update. After implementing the above operations, wecan observe whether the data are updated in real-time on the Azureplatform or our simulation program and see the complete data twindiagram.3.5 3D Digital Twin Display PlatformThe Azure digital twin model was initially presented to the user in 2D.However, the flat display platform is not highly interactive, and userscannot recognize important information at first glance. Therefore,developing a 3D display model is necessary to improve the user experienceand the digital twin’s accuracy.The first step to completing the 3D display platform is to make a 3Dmodel of the LTE base station. Unity is a suitable platform for making 3Dmodels. Unity is the world’s leading real-time 3D content development andoperation platform. Unity has a great influence in the fields of videogames, media, entertainment, construction, automobile transportation, andmanufacturing. The advantage of creating 3D models based on unity isthat the operation of Unity is relatively simple and has a large group ofdevelopers. The base station model is divided into equipment andplatform. The device and platform sections display data from thesimulated base station and the simulated LTE network, respectively.The model of the LTE network can produce 3D scenes through the AzureDigital Twins Explorer. We connect the 3D model and the previouslycreated Azure Digital Twin through the digital twin instance URL and setthe global view to accurately identify the LTE base station’s geographiclocation. After the 3D scene is loaded, a scene element needs to be created.The function of the scene element is to associate the digital twin modelcomponent and the 3D model component. For example, we have created aBaseStation1 scene element to associate one of the base station digital twinmodels with a base station 3D model, and the data contained in theselected base station digital twin model, such as temperature, humidity,etc., can be displayed in the 3D model display board. The next step is tocreate behaviours for each scene element. The behaviour contains foursettable properties: elements, status, alerts, and widgets. The elementsproperty defines which scene elements are related to this behaviour. There323.6. Security Modelis no limit to the number of selected scene elements. In the statusattribute, the user can select single or multiple attribute values containedin the selected scene element and add a colour visualization for the valuefluctuation range of the attribute value. For example, when thetemperature in the selected BaseStation1 is 12-48 °C, the 3D model ofBaseStation1 will display green. The alerts property is used to set warninglines for properties contained in environmental elements. For example, ifthe temperature of BaseStation1 exceeds 48°C, a warning sign of a specificcolour will be displayed. The widgets property is an additional functionthat optimizes visualization for properties contained in selectedenvironment elements. For example, it is capable of optimizing thenumerical display panel of the 3D model or adding a URL link. Alloptimized visualization information will appear in the State panel of the3D model, and native data will be displayed in the properties panel.Figure 3.23: Numerical display plane for 3D models3.6 Security ModelThe security model serves mainly to supplement the deficiencies of thebasic digital twin for system security detection and maintenance. Eachsecurity model should be responsible for a different aspect of cyber attacks333.6. Security Modelor threats and operate independently. The two security models we chooseto develop are cyber attack detection and intrusion detection.3.6.1 Cyber Attack Detection ModelFirst of all, for the cyber attack detection model, we choose distributeddenial-of-service(DDoS) attacks as the simulation and detection object.DDoS attacks exhaust network resources through a large number of uselessrequests. DDoS attackers employ an assembly of multiple computers indifferent locations as an attack platform to launch attacks on one or moretargets, thereby multiplying the attack power. DDoS attacks can causeserious network congestion and server downtime, which exacts a heavy tollon small businesses. We choose the DDoS attack as the experimentaltarget because the DDoS attack is one of the world’s most common andmost threatening cyber-attacks. There were approximately 1,392 DDoSattacks per day worldwide in 2021, up by 25% compared to 2020 [11]. Theease of use and low cost of DDoS attacks are the main reasons for theincrease in the number of attacks [3].The entire DDoS attack detection model is divided into two parts, DDoSattack simulation and DDoS attack detection. The DDoS attacksimulation function allows users to understand the pattern and process ofthe DDoS attack and to detect whether the existing network protectionmeasures can effectively protect against DDoS attacks. Parametersobtained from DDoS attack simulation can be used to develop DDoSattack detection and protection. The DDoS attack simulation is written inC++, based on the simulated LTE network we created on the NS-3. Theprinciple of the simulated DDoS attack is to command the originalsimulated users to send many invalid requests to the base station andoccupy network resources. Under normal circumstances, a large number ofinvalid requests that exceed the acceptable limit of the network will hinderthe normal transmission of network data and the operation of the network.In our simulation, we first select the existing users as the controlled usersto create an attacker. Then, we choose UDP OnOff Sender as our attackapplication and install the attacker application for each user. Next, we usethe OnOff Helper to generate the OnOff Application. The OnOffApplication is a traffic generator; after the traffic generator is turned on,the on and off states will appear alternately. Two variable values, onTimeand offTime, can be set to control the duration of each state. When thestatus of the OnOff Application is on, controllable CBR traffic will begenerated, and when the status is off, no traffic will be generated. The343.6. Security Modelnext step is to install the created attack application on the controlled usersand set the application start and end times.for (uint32_t u = 0; u < 10; ++u){OnOffHelper of("ns3::UdpSocketFactory", Address(InetSocketAddress(ueIpIfaces.GetAddress(u), dlPort)));of.SetConstantRate(DataRate(number));of.SetAttribute("OnTime", StringValue("ns3::ConstantRandomVariable[Constant=1]"));of.SetAttribute("OffTime", StringValue("ns3::ConstantRandomVariable[Constant=0]"));ApplicationContainer OF[10];for (int i = 0; i < 5; ++i){OF[i] = onoff.Install(macroUes.Get(k));OF[i].Start(Seconds(0));OF[i].Stop(Seconds(simTime));}Figure 3.24: Code to add DDoS attack function to user nodesWe need to add DDoS vigilance to the LTE network digital twin for DDoSattack detection. It would be easier to set appropriate network resourcecaps and alerts for simulated LTE networks. Unfortunately, NS-3 has alimitation in setting the upper limit of LTE network resources. In thiscase, we decide to use the average throughput of the LTE network todetermine whether the network resource occupancy rate exceeds thestandard. Due to the virtual machine’s performance, we uniformly set theupper limit of downlink (DL) and uplink (UP) throughput to 2500kbps. Ifthe average detected throughput exceeds 2500kbps, it is determined that aDDoS attack is likely. The specific value of average throughput needs to beobtained by processing the received RLC PDUs data. The exact number ofreceived RLC PDUs can be found in the collected RLC layer data. Thespecific calculation formula is shown in Equations (3.1) and (3.2). LTrepresents LTE Throughput, TR represents total bytes received, TTrepresents total time, and RB represents Rx bytes.LT = TR/TT (3.1)353.6. Security ModelTR = 8 ∗n∑i=1RB (3.2)Because the LTE simulated network needs to use NS-3, which runs on theLinux system, and the Azure digital twin functions exclusively on theWindows system, how to convert the collected network data about DDoSattacks across systems in real-time is also one of the main problems. Thisthesis chooses to use a virtual machine on Windows to run the Linuxsystem so as to facilitate the transfer of data across systems. It isnecessary to create a file that can be saved across systems on a Linuxvirtual machine and rewrite the simulated data through the file stream tothe cross-system file. Once a new simulation is started, the simulation datagenerated by NS-3 will be continuously updated, and the cross-system filewill also be updated with the NS-3 simulation data and will not overwritethe old data. The Windows side uses FileSystemWatcher to read thecontents of the cross-system file efficiently. FileSystemWatcher canimmediately execute the action of reading the changed data when theselected file changes, such as adding or reducing data. The network datatransmitted from NS-3 will be processed to obtain the parameters requiredby the attack prediction model, such as throughput, and then transmittedto the Azure digital twin framework.3.6.2 Intrusion Detection ModelThe Intrusion Detection Model protects the digital twin from internal orexternal threats and checks for suspicious actions. To develop acomprehensive intrusion detection model, it is necessary to use large andwell-developed datasets that include base station and network data. Dueto limitations in time and equipment, we are unable to achieve all aspectsof the intrusion detection model. Therefore, we have decided to prioritizethe development of the alerting system in the intrusion detection model.Our alerting system distinguishes suspicious behaviour or system error bycomparing the data collected by the digital twin model in real-time withthe normal LTE network and base station data collected. The inspectionmethod of the Intrusion Detection Model is divided into two parts. Thefirst part compares and checks when the simulated device transmits datato the IoT center by modifying the ProcessHubToDTEvents file. AWarning attribute will be added to the Azure Digital Twin if an abnormalsituation occurs. The Warning attribute is a text-formatted warningmessage, such as the base station temperature may exceed the warningstandard, please check the base station, etc. The second part is a363.6. Security Modelsecondary check of whether the network and base station data displayed onthe digital twin 3D display model is within a reasonable range. Suppose avalue is beyond the reasonable range, then the display platform willpresent a warning statement to remind the user, such as showing that theLTE throughput is not within a reasonable range.37Chapter 4Test ResultsTo test the full functionality and effect of the Cyber Security Digital Twin,we conducted a functional test of substituting the Cyber Security DigitalTwin into a specific real-world scenario and analyzed the data obtainedfrom the test.4.1 Test scenarioThe simulation scenario selected for the experiment is a total of 7 macrosites deployed in a hexagon, that is, the six vertices and the center point ofthe hexagon. The distance between macro sites is 500m. Each macro sitehas three independent LTE base stations: A, B, and C. A total of 48 userdevices will be randomly distributed in the surrounding areas of all macrosites, and each user device will connect with the closest macro site. Thistest does not consider the femtocell case; homeEnbs and homeUes are notincluded. The optical transmitter output power of the designed macroEnbsis 46 dBm. The main data to be collected are RLC level KPIs, and thecollected data will be stored in a specific txt file. The configurationproperties of the simulated LTE network are shown in Table 4.1.Intersite Distance (m) 500MacroEnb Tx Power (dBm) 46HomeEnb Tx Power (dBm) 20MacroEnb Dl Earfcn 100HomeEnb Dl Earfcn 100MacroEnb Bandwidth (num RBs) 25HomeEnb Bandwidth (num RBs) 25Sounding Reference Signal Periodicity 80Table 4.1: The configuration properties of the simulated LTE network set-tingsEach macro site has a simulated base station program. The simulated384.1. Test scenarioproperties included in the simulated base station program are temperature,humidity, PM2.5 concentration, and output power. Because each macrosite uses three separate base stations, the simulation base station programwill randomly calculate a single attribute three times to obtain threedifferent values of A, B, and C to represent three different base stations.Different random numbers are selected for the floating values of the threebase station attributes of A, B, and C, so there will be no repetition ofattribute values.Because the properties included in the simulation base station programincrease, it is necessary to modify the Azure digital twin model andincrease the number of default properties of the template. We created atotal of 8 IoT devices and used the devices ID to connect with thecorresponding seven macro sites and an overall LTE network. Devicesbelonging to the macro site will store all the independent attributes of thethree base stations included in the IoT center. Devices belonging to theoverall LTE network will store all the parameters of the LTE network inthe IoT center. The next step is to create the Azure digital twin graph,which consists of an LTEnetwork component, an overall MacrocellSitescomponent, 7 BaseStation components created with the modified andrefined model and 8 Relationship edges. The eight Relationship edgesinclude one edge of the ”contains” relationship between the LTE networkand the overall MacrocellSites, and seven edges of the ”contains”relationship between the overall MacrocellSites and BaseStation1-7.Figure 4.1: Azure digital twin graph of LTE networkThe location of the tested 3D LTE digital twin display model is selected in394.1. Test scenariothe global view as Kelowna’s geographic location, which is longitude49.882114 and latitude −119.477829. The seven base station modelsrestore the LTE network plan we designed on the 3D display platform. Tovisualize the interface clearly and tidily, we use a base station model torepresent the three base stations of the same macro site. All attributes ofthe three base stations will be displayed on the same base station modelthrough A, B, and C. We created a total of 14 Elements, including 7BaseStation Elements corresponding to the seven macro sites IoT devicescreated and 7 LTEnetwork Elements corresponding to the overall LTEnetwork IoT devices created. A total of 11 Behaviors were created,including four basic attributes of base station temperature, humidity,PM2.5 concentration, and output power, and the throughput of 7 macrosites in their respective areas. The Behaviors of the base station’s fourbasic attributes are associated with 7 BaseStation Elements, and the seventhroughput Behaviors are respectively associated with 7 LTEnetworkElements. The main functions used are Alerts, and Widgets Alerts areused to set the safety range of each parameter and alarms that exceed thewarning line. Widgets are used to optimize the display panel for displayingvalues.Figure 4.2: 3D display platform of Cyber Security Digital TwinIn the attack simulation part of the DDoS attack detection model, 5, 10,and 20 users out of 48 users are chosen as bot users for comparative404.1. Test scenarioexperiments. Bot users will continue to send useless requests and data tothe nearest macro site to occupy network resources. In order todifferentiate bot users from ordinary users, we increase the data transferspeed of zombie users to 104857kb/s. In this way, network parameters withdifferent types of users can be clearly distinguished in subsequent dataanalysis.The intrusion detection model sets the safety range to 12°C-48 °C tosimulate the temperature properties of the base station. The safety rangeof humidity is set at 25%-75%. The safety range of PM2.5 concentration isset at 50-500. The safety range of Output power is set to 2dBm-24dBm.Every time before uploading to the Azure IoT center, the data will bechecked. If data are beyond the safety range, a Warning attribute will beadded to the IoT center, and a warning statement will be stored. In orderto identify whether it is under a DDoS attack, a security range of networkthroughput is set. After testing the simulated LTE network in normaloperation ten times, the average throughput of the normal network isaround 60, so we set the security line of DDoS attack to no more than 100.The intrusion detection model will check the throughput of each macro sitearea separately. If the throughput of a macro site exceeds the safety range,the colour of this macro site’s 3D display model will change to red, and awarning sign will be displayed.Figure 4.3: 3D display platform of Cyber Security Digital Twin with theintrusion detection model414.2. Result Analysis4.2 Result AnalysisData analysis is divided into three parts: network data analysis, networkattack simulation data analysis, and digital twin results analysis.4.2.1 Network Data AnalysisWe tested the LTE network based on NS-3 simulation more than ten timesunder the same conditions and found that the obtained simulationparameters were consistent. The output of each test of the LTE network iswithin the normal range, and there is no unique situation. Because eachsimulated user’s location and linked macro sited are random, we set thefirst simulated user information as the default user information forsubsequent tests to ensure the test’s accuracy.Figure 4.4: The output of LTE neiwork simulation4.2.2 Cyber Attack Simulation Data AnalysisIn terms of DDoS attack simulation, we conducted a comparative test toobserve whether controlling different numbers of bot users will significantlyimpact DDoS attack prediction. We tried three cases of 5, 10 and 20 botusers, and the average network parameters and throughput for each caseare shown in Table 4.2. Table 4.2 shows that the network throughputincreases visibly in proportion to the number of bot users. Because thecalculated network throughput is the main criterion for the intrusiondetection model for DDoS attacks, the greater the number of controlled424.2. Result Analysisbot users, the higher the accuracy of DDoS attack detection. The intrusiondetection model is highly sensitive and accurate to the DDoS attack wesimulated, and it can accurately determine which macro site is under aDDoS attack.Bots User DL Throughput UL Throughput5 3611 kbps 3542 kbps10 12267 kbps 13030 kbps15 17931 kbps 20248 kbpsTable 4.2: Test results with different numbers of bot usersAfter passing all functional tests, the alerting system in the intrusiondetection model performs as expected. The alerting system sends awarning message and changes the color of the 3D model to notify the userif the wireless network or the base station has violated the predefinedsecurity rules or if the security data exceeds the set limit.4.2.3 Digital Twin Results AnalysisThe entire cyber security digital twin performed well in different stages ofdata transfer during the testing process without data loss or errors. Wefound that there will be a delay of about 3-4 seconds in the data update ofthe data generated by the simulated base station and the 3D display modelof the digital twin, but it does not affect the normal operation of theprogram and the normal usage. We tested the full range of functionality ofthe cyber security digital twin, and the results show that all functionswork. The final 3D model of the cyber security digital twin shows nodiscrepancy between the values displayed by the platform and thoseproduced by the simulated network and base stations. This indicates thatthe cyber security digital twin fully meets our expectations.43Chapter 5Conclusion and Future PlanIn this thesis, we introduced the basic concepts and current state of digitaltwin technology and discuss the application methods and developmentprospects of digital twin technology in network security. On this basis, wehave developed the Cyber Security Digital Twin, a new network securitysolution. We expound the operation concept and development process ofCyber Security Digital Twin in the thesis and prove the feasibility of CyberSecurity Digital Twin as a network security solution through practicaltests. At this stage, the Cyber Security Digital Twin we have completed isonly in the initial stage. We created our digital twin system and displayinterface by simulating the network and base station as the physical entityof the digital twin combined with the Azure platform. We chose not to usereal wireless networks as physical twins due to several challenges, such asthe time and equipment required, the need for a comprehensive dataset,and the complexities of working with carriers. Furthermore, since ourframework is still in the initial stage, our primary objective is to proposethe framework construction and demonstrate its feasibility. Therefore, wehave opted to use a simulated network for the first stage of testing. Thereare four main aspects of the future development plan. The first aspect is torealize the application of Cyber Security Digital Twin on the real wirelessnetwork and ensure all functions’ integrity and accuracy. The second partis to increase the types of security models to expand Cyber SecurityDigital Twin’s protection and maintenance functions for network security.For example, increasing the types of network attacks that can be simulatedand detected. The third part is to further optimize the 3D displayplatform and user experience. The fourth aspect is to explore thecorrelation between the wireless network user experience and our digitaltwin, with the goal of enhancing the quality of our services. Userexperience is crucial for wireless communication companies and networkoperators, so it is essential to integrate it with our digital twin framework.However, the user experience is not our primary focus at this stage. Weplan to address the user experience aspect in our future works.Digital twin technology today is diverse. The potential of digital twin44Chapter 5. Conclusion and Future Plantechnology is not yet widely understood. To address potential cybersecurity risks and threats in wireless networks, the digital twin technologynot only can be used for cyber security inspection and instructiondetection but also to improve the cyber security resilience of wirelessnetwork infrastructures to mitigate cyber security risks.45Bibliography[1] Ijaz Ahmad, Tanesh Kumar, Madhusanka Liyanage, Jude Okwuibe,Mika Ylianttila, and Andrei Gurtov. Overview of 5g securitychallenges and solutions. IEEE Communications Standards Magazine,2(1):36–43, 2018.[2] Microsoft Azure. Microsoft azure: Cloud computing services, 2022[Online].[3] Juan Fernando Balarezo, Song Wang, Karina Gomez Chavez, AkramAl-Hourani, and Sithamparanathan Kandeepan. A survey ondos/ddos attacks mathematical modelling for traditional, sdn andvirtual networks. Engineering Science and Technology, anInternational Journal, 31:101065, 2022.[4] Shilpa Choudhary, Abhishek Sharma, Shradha Gupta, andDr. Hemant Purohit. Use of rsm technology for the optimization ofreceived signal strength for lte signals under the influence of varyingatmospheric conditions. Evergreen, 7:500–509, 12 2020.[5] Marietheres Dietz and Gunther Pernul. Unleashing the digital twin’spotential for ics security. IEEE Security Privacy, 18(4):20–27, 2020.[6] Marietheres Dietz, Manfred Vielberth, and Gu¨nther Pernul.Integrating digital twin security simulations in the security operationscenter. In Proceedings of the 15th International Conference onAvailability, Reliability and Security, ARES ’20, New York, NY, USA,2020. Association for Computing Machinery.[7] Matthias Eckhart and Andreas Ekelhart. Towards security-awarevirtual environments for digital twins. In Proceedings of the 4th ACMWorkshop on Cyber-Physical System Security, CPSS ’18, page 61–72,New York, NY, USA, 2018. Association for Computing Machinery.46Bibliography[8] Matthias Eckhart and Andreas Ekelhart. Digital Twins forCyber-Physical Systems Security: State of the Art and Outlook, pages383–412. Springer International Publishing, Cham, 2019.[9] Ericsson. Network coverage outlook, May. 2022 [Online].[10] Aidan Fuller, Zhong Fan, Charles Day, and Chris Barlow. Digitaltwin: Enabling technologies, challenges and open research. IEEEAccess, 8:108952–108971, 2020.[11] Akshat Gaurav, Brij B. Gupta, and Prabin Kumar Panigrahi. A novelapproach for ddos attacks detection in covid-19 scenario for smallentrepreneurs. Technological Forecasting and Social Change,177:121554, 2022.[12] Edward Glaessgen and David Stargel. The Digital Twin Paradigm forFuture NASA and U.S. Air Force Vehicles.[13] David Holmes, Maria Papathanasaki, Leandros Maglaras,Mohamed Amine Ferrag, Surya Nepal, and Helge Janicke. Digitaltwins and cyber security – solution or challenge? In 2021 6thSouth-East Europe Design Automation, Computer Engineering,Computer Networks and Social Media Conference(SEEDA-CECNSM), pages 1–8, 2021.[14] European Telecommunications Standards Institute. LTE; EvolvedUniversal Terrestrial Radio Access (E-UTRA); Base Station (BS)radio transmission and reception (3GPP TS 36.104 version 9.4.0Release 9), 2010.[15] Nandha Kumar Kandasamy, Sarad Venugopalan, Tin Kit Wong, andLeu Junming Nicholas. EPICTWIN: an electric power digital twin forcyber security testing, research and education. CoRR,abs/2105.04260, 2021.[16] Hamdi Kavak, Jose J. Padilla, Daniele Vernon-Bido, Saikou Y. Diallo,Ross Gore, and Sachin S. Shetty. Simulation for cybersecurity: stateof the art and future directions. J. Cybersecur., 7, 2021.[17] Zheng Liu, Norbert Meyendorf, and Nezih Mrad. The role of datafusion in predictive maintenance using digital twin. AIP ConferenceProceedings, 1949(1):020023, 2018.47Bibliography[18] Hyung G Myung. Technical overview of 3gpp lte. PolytechnicUniversity of New York, 2008.[19] Huan X. Nguyen, Ramona Trestian, Duc To, and Mallik Tatipamula.Digital twin for 5g and beyond. IEEE Communications Magazine,59(2):10–15, 2021.[20] Ronit Nossenson. Long-term evolution network architecture. In 2009IEEE International Conference on Microwaves, Communications,Antennas and Electronics Systems, pages 1–4, 2009.[21] nsnam. ns-3 — a discrete-event network simulator for internetsystems, 2011 [Online].[22] Abhishek Pokhrel, Vikash Katta, and Ricardo Colomo-Palacios.Digital twin for cybersecurity incident prediction: A multivocalliterature review. In Proceedings of the IEEE/ACM 42ndInternational Conference on Software Engineering Workshops,ICSEW’20, page 671–678, New York, NY, USA, 2020. Association forComputing Machinery.[23] Qinglin Qi, Fei Tao, Ying Zuo, and Dongming Zhao. Digital twinservice towards smart manufacturing. Procedia CIRP, 72:237–242,2018. 51st CIRP Conference on Manufacturing Systems.[24] Adil Rasheed, Omer San, and Trond Kvamsdal. Digital twin: Values,challenges and enablers from a modeling perspective. IEEE Access,8:21980–22012, 2020.[25] Eric VanDerHorn and Sankaran Mahadevan. Digital twin:Generalization, characterization and implementation. DecisionSupport Systems, 145:113524, 2021.[26] Mathew Vermeer, Jonathan West, Alejandro Cuevas, Shuonan Niu,Nicolas Christin, Michel Van Eeten, Tobias Fiebig, Carlos Gan˜a´n, andTyler Moore. Sok: A framework for asset discovery: Systematizingadvances in network measurements for protecting organizations. In2021 IEEE European Symposium on Security and Privacy (EuroSP),pages 440–456, 2021.[27] Dimitrios Vozikis, Eleni Darra, Tanel Kuusk, Dimitrios Kavallieros,Aare Reintam, and Xavier Bellekens. On the importance ofcyber-security training for multi-vector energy distribution systemoperators. pages 1–6, 08 2020.48Bibliography[28] L.-Y Yang, S.-Y Chen, Xiao Wang, J. Zhang, and C.-H Wang. Digitaltwins and parallel systems: State of the art, comparisons andprospect. Zidonghua Xuebao/Acta Automatica Sinica, 45:2001–2031,11 2019.[29] Haiyuan Yao, Dachuan Wang, Mengchao Su, and Yue Qi. Applicationof digital twins in port system. Journal of Physics: Conference Series,1846(1):012008, mar 2021.[30] Yu Zheng, Sen Yang, and Huanchong Cheng. An applicationframework of digital twin and its case study. Journal of AmbientIntelligence and Humanized Computing, 10, 03 2019.49
Thesis/Dissertation
eng
Electrical Engineering
Vancouver : University of British Columbia Library
Attribution-NonCommercial-NoDerivatives 4.0 International
Graduate
Cheng, Julian
Cyber security digital twin simulations for wireless networks
Text