A Digital Twin and SOAR-Based Cybersecurity Testbed for Automated Threat Detection and Response in Smart Ships
Abstract
As maritime vessels undergo digitalization, cybersecurity vulnerabilities in smart ship systems have grown. This paper proposes a smart ship cybersecurity testbed that integrates digital twin technology with automated threat detection and response. The testbed operationalizes four IACS UR E26 phases (IDENTIFY through RESPOND) within a digital twin environment, achieving 85.7% (12/14) sub-requirement coverage including 100.0% (3/3) for RESPOND, in which containment is fully automated and restoration only partially so; the deliberately sequenced RECOVER phase remains partial (33.3%, 1/3), bringing five-phase coverage to 76.5% (13/17). The testbed offers a reference architecture for pre-deployment verification that yields evidence relevant to compliance assessment rather than formal classification approval. It combines Electronic Chart Display and Information System (ECDIS) modeling, real-time threat detection, and Security Orchestration, Automation, and Response (SOAR) with five maritime-specific playbooks, linked through a hybrid on-premises/cloud architecture via Kafka pipelines spanning nine topic categories. Under a structured, literature-based eight-criterion comparison, the proposed system reached 36/40 versus 10/40 for the two highest-scoring of six existing testbeds—an upper-bound gap, since prior testbeds were scored from public documentation. Evaluation on a physical testbed (158 detection trials, 500 playbook executions, 300 network-isolation path measurements) demonstrated a 91.8% overall detection rate (145/158, pooled across two heterogeneous tracks: 85.1% for attack-scenario injections and 94.6% for a deployment-specific 111-sample malware corpus) and, under controlled testbed conditions, a 100.0% SOAR playbook completion rate (500/500) with a 99.3% reduction in mean automated playbook completion time (2.4 s vs. a representative 348.0 s manual baseline, estimated rather than empirically sampled).