The Power of Digital Twins in the Cybersecurity Mesh

EDPACS _ 2023 _ Kevin Lynn McLaughlin, PhD

To cite this article: Kevin Lynn McLaughlin, PhD (2023): The power of digital twins in the cybersecurity mesh, EDPACS, 68(6): 35–39, DOI: 10.1080/07366981.2023.2263214

To link to this article: https://doi.org/10.1080/07366981.2023.2263214

“Digital twins in the Cybersecurity Mesh aren’t just an enhancement; they’re a revolution—transforming real-time monitoring into predictive intelligence and reactive strategies into proactive resilience.” — Kevin Lynn McLaughlin, PhD

My discussions so far have laid out the foundational aspects of the Cybersecurity Mesh and its augmented power through AI. However, an integral component that further boosts the Mesh’s resilience and adaptability is the integration of digital twins. In the evolving landscape of cybersecurity, the advent of the Cybersecurity Mesh augmented by AI is nothing short of transformative. Yet, an often-overlooked meaningful change that elevates the Mesh from robust to near-impregnable is the integration of digital twins. These digital replicas not only provide a lens through which we can monitor, analyze, and optimize physical systems in real-time, but they also amplify the innate capabilities of the Mesh itself. The real brilliance of digital twins comes alive in real-time monitoring and analysis; it’s as if each asset or process in your organization has its own personal bodyguard, constantly vigilant and ready to act. With AI and digital twins working in tandem, we can venture into the realm of predictive maintenance and proactive threat mitigation. It’s not just about catching the bad guys; it’s about anticipating their moves before they make them. When it comes to incident response, imagine having a virtual battleground where you can replicate, dissect, and understand the anatomy of an attack without affecting your live operations (Grasselli et al., 2023). This is what digital twins offer, a unique sandbox to understand our enemy better. Let’s not overlook the role of scenario testing. The ability to virtually enact changes, from software updates to entire policy shifts, enables organizations to measure twice and cut once, optimizing their cyber strategies with unprecedented accuracy. As we navigate through an increasingly complex mesh of digital entities, the holistic visibility provided by digital twins becomes indispensable. It’s like having a bird’s-eye view of a labyrinth, ensuring you’re always aware of your entire cyber ecosystem, leaving no room for blind spots.

Digital twins serve as more than mere copies; they are dynamic models that evolve with real-world counterparts, capturing the state, behavior, and context of an asset. Through the convergence of data analytics, machine learning, and sensor input, digital twins provide actionable insights based on historical data, current conditions, and predictive algorithms (Pirbhulal et al., 2022). The Cybersecurity Mesh, a flexible architecture that decentralizes policy enforcement points and security perimeters, becomes exponentially more capable when digital twins are incorporated. This synergy enables an organization to move beyond merely identifying current threats, extending its capabilities into the realm of predictive security. In the Cybersecurity Mesh, digital twins can interface with a variety of both legacy and modern security tools, facilitating a seamless flow of data. This helps to create a more adaptable security environment, as the digital twins can simulate how different security tools will react to specific vulnerabilities or threats, allowing for more informed decision-making. Moreover, digital twins enable organizations to perform “what-if” analyses. Unlike traditional testing environments, which might disrupt ongoing operations, these analyses take place in a risk-free, virtual space. This enables organizations to simulate various attack vectors, assess potential impacts, and evaluate defensive mechanisms, all before any real-world systems are put at risk. Also, incorporation of digital twins into the Cybersecurity Mesh supports compliance and governance efforts. Because digital twins can simulate different data processing and storage conditions, they can help organizations to understand whether they are meeting regulatory requirements under a variety of scenarios, thus aiding in both planning and auditing processes. Further, integration enhances the concept of “security by design.” Rather than treating cybersecurity as an afterthought, it becomes an integral part of the lifecycle of each digital asset. This lifecycle-oriented approach to cybersecurity ensures that potential risks are addressed not just at the deployment stage but throughout an asset’s existence, from conception to decommissioning. The role of digital twins in the Cybersecurity Mesh goes beyond monitoring and optimization. They serve as enablers for a more strategic, informed, and proactive approach to cybersecurity, adding layers of intelligence, adaptability, and comprehensiveness to an already robust framework.

In the brave new world of cybersecurity, the triad of Cybersecurity Mesh, AI, and digital twins brings us from a posture of vigilance to one of dynamic resilience. Each component offers unique capabilities; however, the whole is unquestionably greater than the sum of its parts. Real-time Monitoring and Analysis makes the age of checking logs post-factum as antiquated as the notion that a moat could protect a castle from every invader. Digital twins within the Cybersecurity Mesh aren’t mere watchdogs; they’re more akin to highly trained intelligence officers. They provide a real-time feedback loop that continuously scours for vulnerabilities, operational irregularities, or emerging threats. Imagine having a vigilant sentinel that not only watches but also understands, and makes sense of, the never-ending stream of digital events. This immediate situational awareness allows organizations to pivot from a reactive stance to instant, informed action. As we shift towards Predictive Maintenance and Threat Mitigation, the integration of AI with digital twins is nothing short of revelatory. Gone are the days of ‘if it ain’t broke, don’t fix it.’ In today’s cyber landscape, if you’re not two steps ahead, you’re likely one step behind. The predictive analytics harnessed by the symbiosis between AI and digital twins enable organizations to foresee system inefficiencies and vulnerabilities before they can be weaponized. It’s like having a crystal ball powered by machine learning (ML) and/or AI enabling not just foresight but also proactive decision-making. Now, let’s talk about Enhanced Incident Response. Should a security incident occur, and in this age, it is often a matter of ‘when,’ not ‘if’ digital twins offer a virtual sandbox environment. This environment becomes a forensic lab, enabling cybersecurity professionals to dissect and analyze the incident’s trajectory in real-time. The beauty here is that this analysis happens in a parallel universe, not affecting live operational systems. It is akin to having a cyber war room where you can wargame your response strategies without real-world repercussions. The area of Scenario Testing and Optimization further elevates this game. Whether it is a software update or a more seismic shift in security policy, the ability to test, re-test, and optimize in a digital twin environment allows for a risk-free method of trial and error. Think of it as a cyber flight simulator, providing organizations with a ‘safe failure’ space where they can fine-tune their approach for optimal performance (Francia & Hall, 2021). Lastly, but by no means least, is the facet of Holistic Visibility. The Cybersecurity Mesh architecture inherently spans a broad swath of digital real estate, from endpoints to cloud services to internal networks (Coppolino et al., 2023). When you inject digital twins into this landscape, you get a panoramic, 360-degree view of your entire cyber terrain. This is not just situational awareness; this is situational mastery. It ensures uniform security posture across the organization, leaving no digital stone unturned or unprotected.

Regarding the integration of digital twins within the Cybersecurity Mesh, it’s critical to note that the challenges aren’t solely technical in nature. Indeed, technology often outpaces the organizational and methodological frameworks within which it operates. Particularly in sectors like legacy manufacturing, where the level of automation hasn’t yet caught up to industries such as automotive manufacturing, the human element becomes a significant factor. The state of the art in digital twins technology is often more advanced than the readiness of human teams to implement and manage it. This underscores the notion that the effectiveness of digital twins within the Cybersecurity Mesh isn’t just about overcoming technical hurdles; it’s also about adapting organizational and methodological approaches to catch up with the capabilities that the technology already offers. In this light, advancing the use of digital twins in cybersecurity requires a holistic strategy that addresses not only the technological variables but also the human and organizational factors that contribute to its successful implementation (Kober et al., 2022).

The impact of incorporating digital twins into the Cybersecurity Mesh framework is truly transformative. The union of these two advanced technologies does more than just add another layer to the cybersecurity onion; it creates a multifaceted, dynamic ecosystem where real-time analysis and predictive intelligence coalesce. The notion of cybersecurity transforms from being a static, perimeter-based concept to an ever-evolving, proactive strategy that’s as fluid as the threats it aims to counteract. By acting as a bridge between the physical and digital worlds, digital twins offer a uniquely comprehensive vantage point. Digital twins enable organizations to not only protect their digital assets but also to safeguard the very infrastructure that powers these assets. This level of granular security is an unprecedented advancement, amplifying the Cybersecurity Mesh’s inherent capabilities for adaptability and resilience. The addition of AI Overlay as part of this ecosystem is another quantum leap, introducing learning algorithms that continuously adapt and improve, effectively creating a cybersecurity strategy that learns from each interaction, threat, and vulnerability (Kharchenko et al., 2020). This self-improving mechanism makes your cybersecurity stance not just formidable today, but increasingly robust over time. As we forge ahead into a future fraught with ever-more sophisticated digital risks, the need for a holistic, integrated approach to cybersecurity becomes not just a strategic advantage but a business imperative. Companies must be prepared to defend against multi-vector attacks that can come from any point in their operational framework, at any time. The synergistic amalgamation of Cybersecurity Mesh, AI, and digital twins offers a fortified, intelligent defense mechanism poised for just such challenges. In the grand scheme of things, integrating digital twins is not merely another line item in the cybersecurity budget or an optional feature. Rather, it represents a change in thinking, re-engineering how we conceptualize and implement digital security. In a world where the only constant is change, the trio of Cybersecurity Mesh, AI Overlay, and digital twins grants organizations the agility to adapt, the intelligence to preempt, and the resilience to withstand the relentless evolution of cyber threats. With these integrated technologies at the helm, organizations are not just weathering the digital storm; they are navigating through it with foresight and preparedness.

References

Coppolino, L., Nardone, R., Petruolo, A., Romano, L., & Souvent, A. (2023). Exploiting Digital Twin technology for Cybersecurity Monitoring in Smart Grids Proceedings of the 18th International Conference on Availability, Reliability and Security, 

Francia, G., & Hall, G. (2021). Digital Twins for Industrial Control Systems Security 2021 International Conference on Computational Science and Computational Intelligence (CSCI), 

Grasselli, C., Melis, A., Girau, R., & Callegati, F. (2023). A Digital Twin for Enhanced Cybersecurity in Connected Vehicles 2023 23rd International Conference on Transparent Optical Networks (ICTON), 

Kharchenko, V., Illiashenko, O., Morozova, O., & Sokolov, S. (2020). Combination of Digital Twin and Artificial Intelligence in Manufacturing Using Industrial IoT 

Kober, C., Fette, M., & Wulfsberg, J. P. (2022). Challenges of Digital Twin Application in Manufacturing 2022 IEEE International Conference on Industrial Engineering and Engineering Management (IEEM), 

Pirbhulal, S., Abie, H., & Shukla, A. (2022). Towards a Novel Framework for Reinforcing Cybersecurity using Digital Twins in IoT-based Healthcare Applications 2022 IEEE 95th Vehicular Technology Conference: (VTC2022-Spring), 

“Interweaving the Strands of AI and SOAR onto the cybersecurity mesh: A Deep Dive into the Cybersecurity Mesh and its Role in Modern Digital Defense Strategies”

Abstract:

This article explores the concept of Cybersecurity Mesh, its criticality in defending digital assets, and how the integration of AI could transform this mesh into an intelligent, proactive, and resilient cybersecurity shield. As the digital world grows exponentially, so does the need for robust, scalable, and flexible security solutions. The Cybersecurity Mesh represents an innovative step in this direction, poised to become a cornerstone in modern digital defense strategies. Incorporating AI adds a new layer of sophistication, amplifying its detection, prediction, and response capabilities. This combination emerges as a promising strategy to combat evolving cybersecurity threats, highlighting the importance of technological interplay in the realm of digital defense.

“Interweaving AI and SOAR, to protect our organizations, we encounter the Cybersecurity Mesh, a decentralized, dynamic, and flexible defense network. It’s designed for strategic protection in our diverse distributed digital ecosystems and is set to become the cornerstone of modern digital defense strategies.” – Kevin Lynn McLaughlin, PhD.

As we embrace the digital frontier, our cybersecurity perimeter is no longer confined to traditional boundaries; it has become decentralized, dynamic, and flexible. This ever-evolving landscape has given rise to the concept of a Cybersecurity Mesh. The cybersecurity mesh is a strategic approach that enables a more modular, responsive security strategy, tailored to meet the demands of today’s diverse digital ecosystems (Wendland & Banse, 2018). As we dive into this article, we will explore what this concept is all about, how it is transforming our approach to cybersecurity, and why it is set to become a cornerstone of modern cybersecurity strategy.

Imagine a spider web glistening in the early morning light. It is a complex, intricate structure that the spider has painstakingly woven, each strand carefully positioned to create a network designed for a specific purpose – to capture its prey. In many ways, this is what a Cybersecurity Mesh is like. The Cybersecurity Mesh is a complex network of interconnected security tools and policies that collectively work to protect an organization’s digital assets. The individual strands of the web can be thought of as the various security measures – firewalls, intrusion detection systems, antivirus software, and more – woven together to create comprehensive protective layers. Just as a spider’s web spans across a defined area, the Cybersecurity Mesh extends over an organization’s entire digital landscape, encompassing various devices, networks, remote end points, cloud services, and even the growing Internet of Things (IoT) (Axon et al., 2022). The cybersecurity mesh ensures that no matter where data resides or where transactions take place, they are within the purview of the security measures. An interesting aspect of the spider’s web is its center – the hub where the spider usually resides, ready to react when a prey gets caught in the web. In the Cybersecurity Mesh, this center or hub can be compared to the central cybersecurity management system where all security alerts and activities are monitored. Like the spider that swiftly responds to captured prey, the central management system enables rapid response to any detected threats or anomalies. Another fascinating analogy lies in the spider web’s flexibility. Despite its delicate appearance, the web is incredibly resilient. It bends with the wind, stretches with the pull of heavier catches, yet retains its integrity. Similarly, the Cybersecurity Mesh is flexible and adaptable, designed to scale up or down depending on the organization’s needs, without compromising cybersecurity posture. In the way that each strand of the spider web contributes to its overall strength and function, each component in the Cybersecurity Mesh adds to the organization’s cybersecurity posture.

In the cybersecurity mesh whether it is an AI-powered anomaly detection system or a simple access control measure, every element plays a role in creating a fortified, resilient, and effective security environment. The web’s purpose is not only to catch prey but also to alert the spider of potential threats. If the web is disturbed, the spider can feel the vibrations and react accordingly. Similarly, the Cybersecurity Mesh is not just about blocking threats but also about providing visibility into potential security incidents, thereby allowing timely response and mitigation. Like the spider weaves its web, integrating multiple strands to create an effective trap and a protective home, an organization weaves its Cybersecurity Mesh, integrating multiple cybersecurity tools and policies to create an effective shield against cyber threats. Just as each strand in the web has a role, each component of the Cybersecurity Mesh adds a layer of protection, together forming a strong, flexible, and comprehensive security architecture.

In the sprawling expanse of the digital universe, the Cybersecurity Mesh is carving out a new norm, pushing the boundaries of what we have come to understand as cybersecurity. The mesh is the core of the Cybersecurity Mesh. It is a framework that defines the security perimeter around the identity of a person or an object, thereby freeing it from the confines of a specific place. Yet, the Cybersecurity Mesh is not just a blueprint for architectural change; it presents an approach promoting modular cybersecurity. This concept implies that individual cybersecurity measures, much like nodes in a mesh network, each play a unique, integral role while simultaneously cooperating with the other nodes, culminating in a comprehensive security shield. This vibrant and intricate network of security measures spans across a wide variety of domains – from people and devices to the ever-expanding realm of online services. The fundamental role of the Cybersecurity Mesh in bolstering cybersecurity teams cannot be emphasized enough. Traditional cybersecurity models found themselves ill-equipped to address the challenges brought on by remote workforces, IoT devices, and cloud platforms. The integration of these new elements amplifies the threat landscape (Dzogovic et al., 2022). The Cybersecurity Mesh directly counters these challenges by decentralizing policy enforcement and cybersecurity checks, allowing for more tailored security levels whilst ensuring comprehensive coverage.

In this intricate landscape of cybersecurity, teams must recognize the indispensable role of machine learning and generative AI (Zurowski et al., 2022), especially when it comes to implementing and leveraging the Cybersecurity Mesh. In today’s cybersecurity landscape, where the threats are increasing not only in number but also in sophistication (Axon et al., 2022), AI and machine learning have emerged as powerful allies. When integrated into the Cybersecurity Mesh, these technologies can function as an “AI Overlay” – a powerful, intelligent layer superimposed on the cybermesh that significantly enhances its capabilities across multiple domains, including data analytics, incident response, trend identification, and vulnerability management. To understand this concept of an AI overlay, imagine an advanced digital radar system superimposed on the Cybersecurity Mesh. This radar is designed not just to monitor and scan the landscape continuously, but also to intelligently analyze, predict, and respond to potential threats. Just as a radar system uses advanced technology to detect, identify and track objects, the AI overlay uses artificial intelligence and machine learning algorithms to detect, identify, and track potential cyber threats. It provides a holistic view of the cybersecurity landscape, enabling rapid searches, quick identification of abnormal events, and swift response times.

Similar to the AlphaSOC project work, where the use of state of the art decision making methods to automate response is being used (Silva et al., 2022) the concept of integrating the AI overlay with the concept of the cybersecurity “kill chain” adds another dimension to the mesh’ effectiveness. The kill chain framework details the stages that a cyber threat actor must complete to achieve their objective, whether that’s data theft, system disruption, or another malicious goal. By mapping the AI overlay’s functionalities onto these stages, organizations can disrupt the chain at multiple points, thwarting the attacker’s progress. For instance, during the reconnaissance stage of the kill chain, the AI overlay can identify and flag unusual scanning activity, potentially halting an attack before it even truly begins. During the weaponization and delivery stages, the AI overlay can detect anomalies in system behavior or communication patterns, allowing the cybersecurity team to neutralize threats before they infiltrate the system. In terms of data analytics, the AI overlay sifts through massive volumes of data generated across various nodes of the mesh, intelligently categorizing, correlating, and interpreting this data. By looking for patterns, correlations, and anomalies coordinated with the stages of the kill chain, it can effectively pinpoint potential threats, significantly enhancing its predictive and protective capabilities. When it comes to cyber incident response, the AI overlay is invaluable. By understanding where a detected incident falls within the kill chain, security teams can quickly respond and strategize their countermeasures effectively. Even better, the AI overlay can automate this process, triaging incidents and alerting the right teams based on severity and potential harm, thereby reducing response times, and mitigating potential damage. Moreover, the AI overlay’s proficiency in identifying and tracking trends is augmented by the kill chain model. By continuously monitoring and analyzing cyber activities across the mesh in the context of the kill chain stages, the AI overlay can identify emerging threat patterns, behaviors, and techniques. This knowledge helps cybersecurity teams to stay ahead of potential threats and adjust their defenses proactively. The AI overlay, coupled with the kill chain concept, may even bring a fresh approach to vulnerability management. Conceptually, it can identify recently detected vulnerabilities, and based on the potential impact and the stage in the kill chain they affect, prioritize them for the security teams. This fusion of AI overlay and kill chain within the mesh allows for a more robust, focused, and timely response to vulnerabilities, significantly improving an organization’s defensive capabilities.

At its core, the AI overlay on the Cybersecurity Mesh operates much like an ever-vigilant sheepdog guarding its flock. This sheepdog, gifted with keen instincts and relentless dedication, is always on duty, ensuring the safety of its charges. When weaved together with the systematic strategy of the kill chain model, it represents an additional line of defense that is not only intelligent and adaptive but also forward-looking in its approach. This combined methodology dramatically strengthens the organization’s cybersecurity fortifications, much like a well-trained sheepdog enhances the protection of its herd. It sheds light on intricate data analytics, sharpens the response to security incidents, and strengthens vulnerability management, establishing itself as an essential tool in the sophisticated cybersecurity toolkit of today. As the digital threats continue to morph and escalate in complexity, the urgency of integrating an AI overlay into the Cybersecurity Mesh is becoming progressively more evident. Just as a shepherd relies on the sharp senses and swift response of a sheepdog to protect the flock from ever-present dangers, so too can organizations lean on the AI overlay within the Cybersecurity Mesh to navigate the treacherous terrain of cyber threats with increased confidence and competence.

              Security Orchestration, Automation, and Response (SOAR) technologies can provide an invaluable contribution to solidifying an organization’s cybersecurity mesh, functioning as a unified conductor that brings together the distinct security measures to work in unison, while maximizing efficiency through automation (Wendland & Banse, 2018). The application of automation rules through SOAR can dramatically enhance the detection of attack activity at the early stages of the kill chain. Let us look at specific examples of these rules to understand how they enhance incident detection and response.

  1. Indicator of Compromise (IoC) Detection: SOAR platforms can automate the process of scanning for IoCs across numerous data sources within the cybersecurity mesh. When a potential IoC, such as suspicious IP addresses, URLs, or file hashes, is identified, the SOAR platform can autonomously generate an alert and initiate a predefined incident response process.
  2. Suspicious User Behavior: SOAR solutions can monitor user behavior across the cybersecurity mesh and establish a baseline of normal activities. Any deviations from this baseline, such as a sudden surge in data transfer or an unusual login attempt, can prompt an automatic response, such as blocking the user or requiring additional authentication.
  3. Threat Intelligence Enrichment: Upon detection of a new threat, SOAR platforms can automatically enrich the alert with threat intelligence data. This might involve correlating the threat with known threat actors, identifying common attack vectors, and linking it to previous incidents. This rich contextual data can equip security teams with the necessary insight to respond to the threat swiftly and accurately.
  4. Automated Vulnerability Response: When a new vulnerability is detected, SOAR platforms can trigger a predefined vulnerability management process. This process could include automatically correlating the vulnerability with existing threat intelligence, prioritizing it based on its potential impact, and initiating patch management procedures if necessary.
  5. Identity Management: SOAR can be programmed to monitor and control access rights across the cybersecurity mesh. If unusual activity is detected, such as a user trying to access resources they do not typically use, the system can automatically revoke access rights or request additional authentication, minimizing potential exposure to threats.
  6. Response to Deception Technology Triggers: Deception technology, which creates decoys to lure and trap attackers, is another critical area where SOAR can provide rapid response. When a deception trap is triggered, the SOAR system can immediately alert the security team and provide valuable data about the attacker. This data can then be used to further enhance security measures and counteract the attempted breach (Islam & Al-Shaer, 2020).

In identifying concerning trends, SOAR platforms can analyze data over time to pinpoint anomalies that may indicate a developing threat. For example, a sudden increase in a specific type of security alert might suggest an ongoing attack campaign. Multiple failed logins attempted from the same IP address could signal a brute-force attack attempt. By deploying automation rules and employing SOAR capabilities, organizations can enhance their cybersecurity mesh’s ability to detect and respond to threats. This not only increases the effectiveness and efficiency of their cybersecurity operations but also allows their security teams to focus on complex issues that require human intervention, rather than being bogged down with routine manual tasks. As the cybersecurity landscape evolves, the importance of SOAR in an effective cybersecurity mesh architecture is only set to grow.

The deployment process of the Cybersecurity Mesh begins with identifying the organization’s most critical digital assets, including data servers, workstations, cloud services, and IoT devices. If not already in place, a critical step is to implement a robust Identity and Access Management (IAM) framework, given the importance of identity as the security perimeter in a cybersecurity mesh architecture. Following this, an integration of various security tools and solutions – including machine learning, generative AI, and SOAR technologies – should take place within the mesh framework. These different components, from firewalls and antivirus programs to intrusion detection systems and security incident and event management systems, should not only coexist but also seamlessly cooperate with one another. This approach creates a highly coordinated and powerful defense network, with SOAR technologies acting as the orchestration layer, improving the speed and efficiency of the mesh’s response to threats. A striking feature of the Cybersecurity Mesh is its adaptability and scalability. The mesh should be scaled up or down based on an organization’s needs, offering the flexibility to start small, focusing initially on the most critical assets, and gradually expanding to cover the entire digital ecosystem.

To maximize the efficacy of the Cybersecurity Mesh, a risk-based approach is recommended. This method involves prioritizing cybersecurity protection based on the significance of assets and potential threats they face. With machine learning and generative AI technologies working in harmony with SOAR solutions within the mesh, organizations can respond to threats dynamically, allowing for efficient resource allocation and more robust security outcomes. The incorporation of the Cybersecurity Mesh, augmented with machine learning, generative AI, and SOAR technologies, marks a significant shift from the traditional location-centric security approach to a more people- and identity-centric model. Its profound potential impact on modern cybersecurity is hard to overstate. As organizations continue to navigate the complex digital era, the Cybersecurity Mesh, equipped with these advanced tools, approaches, and an AI overlay provides a powerful and flexible solution to ensure corporate cybersecurity mesh strategies are robust, effective, resilient, and future ready.

Axon, L., Fletcher, K., Scott, A. S., Stolz, M., Hannigan, R., Kaafarani, A. E., Goldsmith, M., & Creese, S. (2022). Emerging Cybersecurity Capability Gaps in the Industrial Internet of Things: Overview and Research Agenda. Digital Threats: Research and Practice, 3(4), 1-27. https://doi.org/10.1145/3503920

Dzogovic, B., Santos, B., Hassan, I., Feng, B., Do, V. T., Jacot, N., & Van Do, T. (2022). Zero-Trust Cybersecurity Approach for Dynamic 5G Network Slicing with Network Service Mesh and Segment-Routing over IPv6 2022 International Conference on Development and Application Systems (DAS), 

Islam, M. M., & Al-Shaer, E. (2020). Active Deception Framework: An Extensible Development Environment for Adaptive Cyber Deception 2020 IEEE Secure Development (SecDev), 

Silva, R., Hickert, C., Sarfaraz, N., Brush, J., Silbermann, J., & Sookoor, T. (2022). AlphaSOC: Reinforcement Learning-based Cybersecurity Automation for Cyber-Physical Systems 2022 ACM/IEEE 13th International Conference on Cyber-Physical Systems (ICCPS), 

Wendland, F., & Banse, C. (2018). Enhancing NFV Orchestration with Security Policies Proceedings of the 13th International Conference on Availability, Reliability and Security , articleno = 45 , numpages = 6,  https://doi.org/10.1145/3230833.3233253

Zurowski, S., Lord, G., & Baggili, I. (2022). A Quantitative Analysis of Offensive Cyber Operation (OCO) Automation Tools Proceedings of the 17th International Conference on Availability, Reliability and Security , articleno = 42 , numpages = 11,  https://doi.org/10.1145/3538969.3544414

Kevin Lynn McLaughlin (https://orcid.org/0009-0009-8367-5292)