{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,20]],"date-time":"2026-07-20T23:41:19Z","timestamp":1784590879228,"version":"3.55.0"},"reference-count":43,"publisher":"MDPI AG","issue":"2","license":[{"start":{"date-parts":[[2023,2,4]],"date-time":"2023-02-04T00:00:00Z","timestamp":1675468800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"German Federal Ministry for Economic Affairs and Climate Action (BMWK)","award":["16KN085725"],"award-info":[{"award-number":["16KN085725"]}]},{"name":"German Federal Ministry for Economic Affairs and Climate Action (BMWK)","award":["DIK0338\/01"],"award-info":[{"award-number":["DIK0338\/01"]}]},{"DOI":"10.13039\/501100020639","name":"Bavarian Ministry of Economic Affairs, Regional Development and Energy (BayStMWi)","doi-asserted-by":"publisher","award":["16KN085725"],"award-info":[{"award-number":["16KN085725"]}],"id":[{"id":"10.13039\/501100020639","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100020639","name":"Bavarian Ministry of Economic Affairs, Regional Development and Energy (BayStMWi)","doi-asserted-by":"publisher","award":["DIK0338\/01"],"award-info":[{"award-number":["DIK0338\/01"]}],"id":[{"id":"10.13039\/501100020639","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Information"],"abstract":"<jats:p>Although there are numerous advantages of the IoT in industrial use, there are also some security problems, such as insecure supply chains or vulnerabilities. These lead to a threatening security posture in organizations. Security analytics is a collection of capabilities and technologies systematically processing and analyzing data to detect or predict threats and imminent incidents. As digital twins improve knowledge generation and sharing, they are an ideal foundation for security analytics in the IoT. Digital twins map physical assets to their respective virtual counterparts along the lifecycle. They leverage the connection between the physical and virtual environments and manage semantics, i.e., ontologies, functional relationships, and behavioral models. This paper presents the DT2SA model that aligns security analytics with digital twins to generate shareable cybersecurity knowledge. The model relies on a formal model resulting from previously defined requirements. We validated the DT2SA model with a microservice architecture called Twinsight, which is publicly available, open-source, and based on a real industry project. The results highlight challenges and strategies for leveraging cybersecurity knowledge in IoT using digital twins.<\/jats:p>","DOI":"10.3390\/info14020095","type":"journal-article","created":{"date-parts":[[2023,2,6]],"date-time":"2023-02-06T05:29:05Z","timestamp":1675661345000},"page":"95","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":44,"title":["Digital-Twin-Based Security Analytics for the Internet of Things"],"prefix":"10.3390","volume":"14","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-7616-5931","authenticated-orcid":false,"given":"Philip","family":"Empl","sequence":"first","affiliation":[{"name":"Chair of Information Systems, University of Regenburg, 93053 Regensburg, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1338-9003","authenticated-orcid":false,"given":"G\u00fcnther","family":"Pernul","sequence":"additional","affiliation":[{"name":"Chair of Information Systems, University of Regenburg, 93053 Regensburg, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2023,2,4]]},"reference":[{"key":"ref_1","unstructured":"ENISA (2021). Threat Landscape for Supply Chain Attacks, ENISA. Technical report."},{"key":"ref_2","unstructured":"Ardagna, C., Corbiaux, S., Sfakianakis, A., and Douligeris, C. (2021). ENISA Threat Landscape, ENISA. Technical report."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Mahmood, T., and Afzal, U. (2013, January 11\u201312). Security Analytics: Big Data Analytics for Cybersecurity: A Review of Trends, Techniques and Tools. Proceedings of the 2nd National Conference on Information Assurance (NCIA 2013), Rawalpindi, Pakistan.","DOI":"10.1109\/NCIA.2013.6725337"},{"key":"ref_4","unstructured":"Mori, P., Lenzini, G., and Furnell, S. (2021, January 11\u201313). Bridging Knowledge Gaps in Security Analytics. Proceedings of the Proceedings of the 7th International Conference on Information Systems Security and Privacy, ICISSP 2021, Online Streaming."},{"key":"ref_5","unstructured":"Skouloudi, C., Malatras, A., Naydenov, R., and Dede, G. (2020). Guidelines for Securing the Internet of Things, European Union Agency for Cybersecurity. Technical report."},{"key":"ref_6","unstructured":"Pipikaite, A., Bueermann, G., Joshi, A., Jurgen, J., Bissell, K., Aguirre, C., Browder, T., and Pruitt, J. (2022). Global Cybersecurity Outlook 2022: Insight Report, Technical report; European Union Agency for Cybersecurity."},{"key":"ref_7","first-page":"209","article-title":"Next Generation Digital Twin","volume":"Volume 2018","author":"Horvath","year":"2018","journal-title":"Proceedings of the 12th International Symposium on Tools and Methods of Competitive Engineering (TMCE)"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Biffl, S., Eckhart, M., L\u00fcder, A., and Weippl, E.R. (2019). Security and Quality in Cyber-Physical Systems Engineering, With Forewords by Robert M. Lee and Tom Gilb, Springer.","DOI":"10.1007\/978-3-030-25312-7"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Pokhrel, A., Katta, V., and Colomo-Palacios, R. (July, January 27). Digital Twin for Cybersecurity Incident Prediction: A Multivocal Literature Review. Proceedings of the IEEE\/ACM 42nd International Conference on Software Engineering Workshops, 2020, ICSEW\u201920, Seoul, Republic of Korea.","DOI":"10.1145\/3387940.3392199"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"O\u2019Connor, L. (2022, May 29). Strengthening Security with Digital Cyber Twins. Available online: https:\/\/www.accenture.com\/us-en\/blogs\/technology-innovation\/lisa-oconnor-strengthening-security-with-digital-cyber-twins.","DOI":"10.12968\/S1353-4858(22)70071-2"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"167653","DOI":"10.1109\/ACCESS.2019.2953499","article-title":"A Survey on Digital Twin: Definitions, Characteristics, Applications, and Design Implications","volume":"7","author":"Barricelli","year":"2019","journal-title":"IEEE Access"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Empl, P., Schlette, D., Zupfer, D., and Pernul, G. (2022, January 23\u201326). SOAR4IoT: Securing IoT Assets with Digital Twins. Proceedings of the 17th International Conference on Availability, Reliability and Security (ARES 2022), Vienna, Austria.","DOI":"10.1145\/3538969.3538975"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"1475","DOI":"10.1109\/COMST.2022.3171465","article-title":"Digital Twin: A Comprehensive Survey of Security Threats","volume":"24","author":"Alcaraz","year":"2022","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"11","DOI":"10.1109\/TBDATA.2017.2715335","article-title":"Big Data Based Security Analytics for Protecting Virtualized Infrastructures in Cloud Computing","volume":"4","author":"Win","year":"2018","journal-title":"IEEE Trans. Big Data"},{"key":"ref_15","first-page":"74:1","article-title":"Analytics for the Internet of Things: A Survey","volume":"51","author":"Siow","year":"2018","journal-title":"ACM Comput. Surv."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"74","DOI":"10.1109\/MSP.2013.138","article-title":"Big Data Analytics for Security","volume":"11","author":"Manadhata","year":"2013","journal-title":"IEEE Secur. Priv."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Alguliyev, R., and Imamverdiyev, Y. (2014, January 15\u201317). Big Data: Big Promises for Information Security. Proceedings of the 8th IEEE International Conference on Application of Information and Communication Technologies (AICT), Astana, Kazakhstan.","DOI":"10.1109\/ICAICT.2014.7035946"},{"key":"ref_18","first-page":"3","article-title":"From Data to Wisdom","volume":"16","author":"Ackoff","year":"1989","journal-title":"J. Appl. Syst. Anal."},{"key":"ref_19","unstructured":"Gupta, M., Abdelsalam, M., and Mittal, S. (2021, January 28). A Flexible Security Analytics Service for the Industrial IoT. Proceedings of the 2021 ACM Workshop on Secure and Trustworthy Cyber-Physical Systems, Virtual Event, Charlotte, NC, USA."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"87","DOI":"10.1016\/j.cose.2017.10.009","article-title":"A comparative analysis of incident reporting formats","volume":"73","author":"Menges","year":"2018","journal-title":"Comput. Secur."},{"key":"ref_21","unstructured":"Lie, D., and Mannan, M. (2018, January 19). A Specification-based State Replication Approach for Digital Twins. Proceedings of the 2018 Workshop on Cyber-Physical Systems Security and PrivaCy, CPS-SPC@CCS 2018, Toronto, ON, Canada."},{"key":"ref_22","unstructured":"Volkamer, M., and Wressnegger, C. (2020, January 25\u201328). Integrating Digital Twin Security Simulations in the Security Operations Center. Proceedings of the 15th International Conference on Availability, Reliability and Security, Dublin, Ireland. ARES \u201920."},{"key":"ref_23","first-page":"25","article-title":"A Digital Twin Architecture for Security, Privacy and Safety","volume":"2018","year":"2018","journal-title":"ERCIM News"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"1604","DOI":"10.1109\/TVCG.2014.2346481","article-title":"Knowledge Generation Model for Visual Analytics","volume":"20","author":"Sacha","year":"2014","journal-title":"IEEE Trans. Vis. Comput. Graph."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Preut, A., Kopka, J.P., and Clausen, U. (2021). Digital Twins for the Circular Economy. Sustainability, 13.","DOI":"10.3390\/su131810467"},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"102425","DOI":"10.1016\/j.ipm.2020.102425","article-title":"EtherTwin: Blockchain-based Secure Digital Twin Information Management","volume":"58","author":"Putz","year":"2021","journal-title":"Inf. Process. Manag."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"1016","DOI":"10.1016\/j.ifacol.2018.08.474","article-title":"Digital Twin in Manufacturing: A Categorical Literature Review and Classification","volume":"51","author":"Kritzinger","year":"2018","journal-title":"IFAC-PapersOnLine"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"20","DOI":"10.1109\/MSEC.2019.2961650","article-title":"Unleashing the Digital Twin\u2019s Potential for ICS Security","volume":"18","author":"Dietz","year":"2020","journal-title":"IEEE Secur. Priv."},{"key":"ref_29","first-page":"281","article-title":"A Distributed Ledger Approach to Digital Twin Secure Data Sharing","volume":"Volume 11559","author":"Foley","year":"2019","journal-title":"Proceedings of the Data and Applications Security and Privacy XXXIII\u201433rd Annual IFIP WG 11.3 Conference, DBSec 2019"},{"key":"ref_30","unstructured":"Lin, S.W., Miller, B., Durand, J., Joshi, R., Didier, P., Chigani, A., Torenbeek, R., Duggal, D., Martin, R., and Bleakley, G. (2015). Industrial Internet Reference Architecture, Industry IoT Consortium. Technical report."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Akbarian, F., Fitzgerald, E., and Kihl, M. (2020, January 17\u201319). Intrusion Detection in Digital Twins for Industrial Control Systems. Proceedings of the 2020 International Conference on Software, Telecommunications and Computer Networks (SoftCOM), Split, Croatia.","DOI":"10.23919\/SoftCOM50211.2020.9238162"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Atalay, M., and Angin, P. (2020, January 3\u20135). A Digital Twins Approach to Smart Grid Security Testing and Standardization. Proceedings of the 2020 IEEE International Workshop on Metrology for Industry 4.0 & IoT, Roma, Italy.","DOI":"10.1109\/MetroInd4.0IoT48571.2020.9138264"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"4733","DOI":"10.1109\/TII.2020.3019788","article-title":"Real-world Anomaly Detection by Using Digital Twin Systems and Weakly Supervised Learning","volume":"17","author":"Castellani","year":"2021","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Murillo, A., Taormina, R., Tippenhauer, N., and Galelli, S. (2020, January 8). Co-simulating Physical Processes and Network Data for High-fidelity Cyber-security Experiments. Proceedings of the Sixth Annual Industrial Control System Security (ICSS) Workshop, 2020, ICSS 2020, Austin, TX, USA.","DOI":"10.1145\/3442144.3442147"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Saad, A., Faddel, S., and Mohammed, O. (2020). Iot-based Digital Twin for Energy Cyber-physical Systems: Design and Implementation. Energies, 13.","DOI":"10.3390\/en13184762"},{"key":"ref_36","unstructured":"Suhail, S., Jurdak, R., Matulevicius, R., and Seon Hong, C. (2021). Securing Cyber-physical Systems through Blockchain-based Digital Twins and Threat Intelligence. arXiv."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Chukkapalli, S.S.L., Pillai, N., Mittal, S., and Joshi, A. (2021, January 2\u20133). Cyber-physical System Security Surveillance Using Knowledge Graph Based Digital Twins\u2014A Smart Farming Usecase. Proceedings of the 2021 IEEE International Conference on Intelligence and Security Informatics (ISI), Antonio, TX, USA.","DOI":"10.1109\/ISI53945.2021.9624688"},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Danilczyk, W., Sun, Y.L., and He, H. (2021, January 11\u201313). Smart Grid Anomaly Detection Using a Deep Learning Digital Twin. Proceedings of the 2020 52nd North American Power Symposium (NAPS), Tempe, AZ, USA.","DOI":"10.1109\/NAPS50074.2021.9449682"},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Patel, A., Schenk, T., Knorn, S., Patzlaff, H., Obradovic, D., and Halblaub, A.B. (2021, January 26\u201328). Real-time, Simulation-based Identification of Cyber-security Attacks of Industrial Plants. Proceedings of the 2021 IEEE International Conference on Cyber Security and Resilience (CSR), Virtual.","DOI":"10.1109\/CSR51186.2021.9527938"},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"107261","DOI":"10.1016\/j.anucene.2019.107261","article-title":"Secure Embedded Intelligence in Nuclear Systems: Framework and Methods","volume":"140","author":"Garcia","year":"2020","journal-title":"Ann. Nucl. Energy"},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"T\u00e4rneberg, W., Skarin, P., Gehrmann, C., and Kihl, M. (2021, January 10\u201312). Prototyping Intrusion Detection in an Industrial Cloud-native Digital Twin. Proceedings of the International Conference on Industrial Technology, Valencia, Spain.","DOI":"10.1109\/ICIT46573.2021.9453553"},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"21","DOI":"10.1007\/978-3-030-88381-2_2","article-title":"Enhancing Industrial Control System Forensics Using Replication-based Digital Twins","volume":"Volume 612","author":"Peterson","year":"2021","journal-title":"Advances in Digital Forensics XVII"},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Dietz, M., Schlette, D., and Pernul, G. (July, January 27). Harnessing Digital Twin Security Simulations for systematic Cyber Threat Intelligence. Proceedings of the 2022 IEEE 46th Annual Computers, Software, and Applications Conference (COMPSAC), Los Alamitos, CA, USA.","DOI":"10.1109\/COMPSAC54236.2022.00129"}],"container-title":["Information"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2078-2489\/14\/2\/95\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T18:24:04Z","timestamp":1760120644000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2078-2489\/14\/2\/95"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,2,4]]},"references-count":43,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2023,2]]}},"alternative-id":["info14020095"],"URL":"https:\/\/doi.org\/10.3390\/info14020095","relation":{},"ISSN":["2078-2489"],"issn-type":[{"value":"2078-2489","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,2,4]]}}}