Monitoring, Investigation and Response to cyber-attacks with an Adaptive digital twiN moDel for Agile services over the computing continuum

The growing level of interconnectedness of digital services and infrastructures creates tight and recursive security interdependencies between their providers, which are challenging to address due to the fragmentation of cybersecurity operations. This requires each provider to improve the security posture of its suppliers. However, existing practice, largely based on human interaction for disclosing vulnerabilities, reporting alerts, and suggesting remediations, demonstrates to be largely ineffective and risky.The MIRANDA project aims at operationalising awareness and remediation controls for service supply chains, by addressing feasibility, acceptance, and compliance issues. To this purpose, MIRANDA develops a Cybersecurity Digital Twin (CDT) to model and capture the security posture of such interconnected systems, which is used to detect, hunt, and remediate threats and attacks. The CDT will feature: i) functional and topological representation of digital services; ii) bidirectional control/monitoring data flow with real systems; iii) modelling and behavioural prediction of individual components and whole systems; iv) opaque representation of suppliers’ assets based on confidentiality and privacy requirements. The framework also encompasses the necessary security controls to safely exchange data and controls between providers. On top of the CDT abstraction, MIRANDA builds adaptive and automated processes for threat hunting, detection of lateral movements, and eradication of the root causes of attacks.Validation of individual components and the overall MIRANDA platform will be conducted in three relevant Use Cases, covering different platforms for Smart City services. The purpose will be to demonstrate the adaptability to the evolving context and the effectiveness to stop latest-generation cyber kill-chains and lateral movements across digital chains. The Project will also consider the new business and operational models that are required to run the platform.