A Digital Twin System for Replaying Cyber Mission Data

The Persistent Cyber Training Environment (PCTE), developed by the Department of Defense, provides a single training environment for cyberspace operations. PCTE offers a closed network that supports individual training as well as mission rehearsal and post-operation analysis. However, it does not have the ability to replay near real-time events as training scenarios, nor to ingest other network events as scenarios. Replaying cyber mission data on a digital twin network in PCTE would enable more realistic near real-time operator training, as well as supporting development and testing for cyberspace operations. This requires extracting target network specifications from a cyber mission data set. This research developed a prototype tool to extract the network specifications necessary to instantiate a digital twin network within PCTE from cyber mission data. A key contribution of this work is the ability, upon sending recorded network data to the tool, to create a high-fidelity network, and scenario for training purposes. This contribution enables a significant decrease in the time from detection of a problem on a live network to the creation of relevant training scenarios that address the detected problem.