Integrated Cybersecurity Architecture for Critical Information Infrastructure Based on Digital Twins and Cyber Ranges

Abstract

This paper presents a comparative analysis of architectural models for cybersecurity of critical information infrastructure facilities, which differ in the degree of integration between digital twins and cyber ranges. The models are evaluated against seven criteria: testing safety, threat modeling realism, proactivity, situational awareness, flexibility and scalability, personnel training support, and architectural isolation. It is shown that traditional approaches without digital modeling, as well as isolated use of either digital twins or cyber ranges alone, have significant limitations. The most functionally complete architectures are those that combine a digital twin with a cyber range. To validate the findings, an experiment was conducted. A multi-step cyberattack was simulated against a virtual copy of an industrial controller within two types of integrated environments. In the architecture with a digital twin and an embedded cyber range simulator, attack detection was moderately complete, response time was noticeable, but computational load remained within acceptable limits. In the architecture with a digital twin and an external isolated cyber range, detection completeness was substantially higher and response time significantly lower, yet computational resource consumption increased. The results confirm that full architectural isolation improves realism and response efficiency, while the compromise solution remains justified under resource-constrained conditions. Based on the experiment and comparative analysis, recommendations are formulated for selecting an architectural model depending on the digital maturity of the infrastructure and available resources. The paper highlights the need for further formalization of evaluation methods and the development of a regulatory framework for integrated solutions.