Available online at www.sciencedirect.

com

ScienceDirect
ICT Express xxx (xxxx) xxx
www.elsevier.com/locate/icte

Explainable AI for cybersecurity automation, intelligence and trustworthiness

in digital twin: Methods, taxonomy, challenges and prospects
Iqbal H. Sarkera,b ,∗, Helge Janickea,b , Ahmad Mohsina,b , Asif Gillc , Leandros Maglarasd
a Centre for Securing Digital Futures, Edith Cowan University, Perth, WA, 6027, Australia
b Cyber Security Cooperative Research Centre, Perth, WA, 6027, Australia
c University of Technology Sydney, Sydney, Australia
d Edinburgh Napier University, Edinburgh, UK

Received 17 February 2024; received in revised form 25 April 2024; accepted 18 May 2024
Available online xxxx

Abstract
Digital twins (DTs) are an emerging digitalization technology with a huge impact on today’s innovations in both industry and research. DTs
can significantly enhance our society and quality of life through the virtualization of a real-world physical system, providing greater insights
about their operations and assets, as well as enhancing their resilience through real-time monitoring and proactive maintenance. DTs also pose
significant security risks, as intellectual property is encoded and more accessible, as well as their continued synchronization to their physical
counterparts. The rapid proliferation and dynamism of cyber threats in today’s digital environments motivate the development of automated
and intelligent cyber solutions. Today’s industrial transformation relies heavily on artificial intelligence (AI), including machine learning
(ML) and data-driven technologies that allow machines to perform tasks such as self-monitoring, investigation, diagnosis, future prediction,
and decision-making intelligently. However, to effectively employ AI-based models in the context of cybersecurity, human-understandable
explanations, and their trustworthiness, are significant factors when making decisions in real-world scenarios. This article provides an extensive
study of explainable AI (XAI) based cybersecurity modeling through a taxonomy of AI and XAI methods that can assist security analysts
and professionals in comprehending system functions, identifying potential threats and anomalies, and ultimately addressing them in DT
environments in an intelligent manner. We discuss how these methods can play a key role in solving contemporary cybersecurity issues in
various real-world applications. We conclude this paper by identifying crucial challenges and avenues for further research, as well as directions
on how professionals and researchers might approach and model future-generation cybersecurity in this emerging field.
© 2024 The Author(s). Published by Elsevier B.V. on behalf of The Korean Institute of Communications and Information Sciences. This is an open
access article under the CC BY license (http://creativecommons.org/licenses/by/4.0/).
Keywords: Cybersecurity; Explainable AI; Machine learning; Data-driven; Automation; Intelligent decision-making; Trustworthiness; Digital twin

1. Introduction also be vulnerable to cyber threats such as unauthorized ac-

cess, data breaches, or other malicious attacks as DTs become
Digital twins (DTs) are a virtual representation of a physical increasingly interconnected with other systems and devices
entity or system that uses data and Artificial Intelligence (AI) through the Internet of Things (IoT) and other smart tech-
to simulate and analyze its behavior, performance, and other nologies, discussed briefly in Section 3. Cybersecurity threats
characteristics [1,2]. DT can be used in a wide range of in- can impact the confidentiality, integrity, and availability of DT
dustries, including manufacturing [3], smart cities [4], critical data, as well as the safety and reliability of the physical system
services [5], healthcare [6], agriculture [7], energy [8], and so being represented by DT. Therefore, it is crucial to take into
on to improve efficiency, optimize processes, and reduce costs. account an automated and intelligent cybersecurity systems
DT can provide organizations with useful insights extracted design that meets today’s needs.
from data about their operations and assets. However, DT can Recent advancements in AI, including machine learning
(ML) methods, significantly changed how we might combine
∗ Corresponding author at: Centre for Securing Digital Futures, Edith
and analyze data, and eventually apply the extracted insights
Cowan University, Perth, WA, 6027, Australia.
E-mail address: [email protected] (I.H. Sarker).
or knowledge for automation and intelligent decision-making
Peer review under responsibility of The Korean Institute of Communica- processes in various real-world application areas [9]. By gath-
tions and Information Sciences (KICS). ering massive amounts of data and effectively analyzing it to
https://doi.org/10.1016/j.icte.2024.05.007
2405-9595/© 2024 The Author(s). Published by Elsevier B.V. on behalf of The Korean Institute of Communications and Information Sciences. This is an
open access article under the CC BY license (http://creativecommons.org/licenses/by/4.0/).

Please cite this article as: I.H. Sarker, H. Janicke, A. Mohsin et al., Explainable AI for cybersecurity automation, intelligence and trustworthiness in digital twin: Methods, taxonomy, challenges and
prospects, ICT Express (2024), https://doi.org/10.1016/j.icte.2024.05.007.
I.H. Sarker, H. Janicke, A. Mohsin et al. ICT Express xxx (xxxx) xxx

identify harmful patterns and unusual behaviors, AI technolo-

gies have become essential to the cybersecurity industry [10].
However, to use AI-based models effectively in the context of
cybersecurity in DT, human-understandable explanations, and
their trustworthiness, are considered significant factors when
making decisions in real-world scenarios. Thus the key aspects
are:

• Automation: It involves the use of automated processes,

algorithms, and tools to streamline and enhance cyber- Fig. 1. An illustration of the key aspects — Automation (A), Intelligence
security tasks within a digital twin environment. With (I) and Trustworthiness (T) of today’s Cybersecurity (CyberAIT).
the automation of repetitive and time-consuming security
tasks, organizations can detect and respond to security
threats more rapidly, reduce manual work and human 1.1. Related surveys and our contributions
error, and free up staff resources for more strategic
security initiatives. Throughout the last few years, surveys on XAI have been
• Intelligence: Typically, intelligence refers to the capabil- typically conducted with an emphasis on Black-Box models
ity of learning, understanding, and applying knowledge (internal workings and decision-making processes are opaque
for intelligent decision-making to perform tasks that re- and difficult to interpret by humans), e.g., deep neural network-
quire human intelligence. Thus, it includes analyzing based modeling. For instance, Adadi et al. [12] presented
and interpreting enormous amounts of data produced a survey on XAI peeking inside the Black-Box. Similarly,
within the digital twin ecosystem. The discovered knowl- Ibrahim et al. [13], and Guidotti et al. [14] presented XAI fo-
cusing Black-Box systems, methods, and relevant applications
edge from data enables organizations to gain insight into
in their survey. Recently, Dwivedi et al. [15] explored XAI
emerging threats, detect anomalous behavior, identify po-
in terms of approaches, programming frameworks, and soft-
tential vulnerabilities, predict cyber threats, and generate
ware toolkits in more detail. For the academic and industrial
actionable insights to improve security. communities, these surveys offer fundamental knowledge and
• Trustworthiness: This encompasses the reliability, in- valuable lessons. There is still a need for a succinct exposition
tegrity, and credibility of the security mechanisms and of AI’s use in cybersecurity and digital twin, though. There
processes implemented within the digital twin environ- have been some literary efforts regarding XAI for cyberse-
ment. Transparency in implementing and validating cy- curity, although they have tended to concentrate on particular
bersecurity measures, as well as accountability for secu- goals. For example, Capuano et al. [16] and Alcaraz et al. [2]
rity incidents and breaches, contribute to trustworthiness. presented XAI focusing on various cyber threats and ap-
It is crucial to establish trustworthiness in cybersecu- proaches in the context. More related works are summarized
rity within digital twin ecosystems to promote confi- in Table 2. However, an extensive study on AI/XAI-based
dence among stakeholders and ensure their resilience and modeling with their explainable capabilities by taking into
sustainability. account “CyberAIT” needs to be explored to comprehend its
potential real-world use cases in the context of cybersecurity
Overall, the key aspects for cybersecurity modeling in a in the digital twin. Thus we have formulated five key questions
digital twin ecosystem are automation, i.e., reducing manual below to understand the main focus of this paper, which are
efforts with self-learning, intelligence, i.e., informed decision- needed to answer and discuss to make this paper beneficial for
making based extracted insights, and trustworthiness, i.e., the cyber and DT community:
human-interpretable cyber decisions, which enable efficient
and effective protection against evolving threats in increasingly (i) Is modern cybersecurity modeling in DT required to be
automated and intelligent with trustworthy decisions?
complex digital environments. Thus, a trade-off among “Au-
(ii) Does AI-based cybersecurity modeling including ma-
tomation”, “Intelligence”, and “Trustworthiness”, representing
chine learning and data-driven technologies have the
“CyberAIT” in short, is important as shown in Fig. 1. A more
potential to meet today’s diverse security concerns in
transparent and understandable AI model, also known as XAI,
DT?
could therefore make cybersecurity modeling more effective. (iii) What aspects and characteristics do AI and XAI-based
In a DT environment, analysts and security professionals can methodologies have that make the decision-making pro-
use this information to comprehend how the system operates, cess human-understandable and resolve today’s cyber
identify potential vulnerabilities and threats, and ultimately issues in DT more effectively?
make the best actionable decisions to successfully address (iv) What are the diverse real-world usage potentials within
them. A motivational scenario highlighting the significance of the context of cybersecurity in digital twin and how
XAI has also been presented in Fig. 2. Taking into account the AI/XAI-based methods can lead to?
key aspects of “CyberAIT”, this paper focuses on AI and XAI- (v) What are the key challenges of AI-based cyber model-
based methods for cybersecurity modeling with their potential ing, and how can scientists and researchers overcome
real-world applications. the issues in this emerging area of study?
2
I.H. Sarker, H. Janicke, A. Mohsin et al. ICT Express xxx (xxxx) xxx

Fig. 2. A motivational scenario highlighting Black-Box AI modeling (internal workings and decision-making processes are opaque and difficult to interpret
by humans) vs XAI-based cyber modeling from the perspective of a cyber user (adopted from Sarker et al. [11]).

In this paper, we aim to answer these important ques- 1.2. Article organization
tions from the perspective of AI and XAI-based cybersecurity
modeling with their potentiality in various real-world use The remainder of this article is structured as follows. The
cases, which builds the foundation of our contribution. To background in related technologies, such as digital twins,
the best of our knowledge, this study is the first effort to cybersecurity, and artificial intelligence, is summarized in Sec-
provide a thorough synthesize, analysis, and discussion about tion 2, along with the scope of this work and existing literature.
the AI/XAI-based cybersecurity modeling exploring multi- Cybersecurity resilience and potential threats and anomalies in
aspects intelligence such as machine learning, deep learning, the various functional layers of the digital twin are explored
data-driven, rule discovery, semantic knowledge, as well as in Section 3. Section 4 presents a comprehensive analysis
multimodal intelligence for future enhancements of cyberspace of AI/XAI approaches for cybersecurity modeling along with
their taxonomy building. Different real-world usage scopes
by taking into account CyberAIT.
are presented in the context of cybersecurity modeling in
Overall, our specific contributions are as follows:
DT in Section 5, along with a discussion of the potential
• We survey and compare the existing literature to iden- contributions of these techniques. Section 6 provides a list
tify the scope of our paper regarding cybersecurity au- of research problems and prospects that indicate possible
tomation, intelligence, and trustworthiness in the DT directions. Several key points are outlined in Sections 7 and
environment. 8 concludes this paper. In addition, Table 1 contains a list of
acronyms and their definitions.
• We emphasize DT for enhancing cyber resilience. We
also highlight possible threats and anomalies in DT that
2. State-of-the-art
are needed to mitigate. For this, we explore diverse func-
tional layers from the physical to the application layer of We begin by exploring the background of digital twins
a digital twin with associated cyber issues and the neces- (Section 2.1), cybersecurity in digital twins (Section 2.2), and
sity to employ AI/XAI-based cybersecurity modeling. AI-enhanced cybersecurity (Section 2.3). Then, we review the
• We present a taxonomy of AI/XAI-based cybersecurity related surveys within the scope of our study (Section 2.4) to
modeling methods and discuss their computing capabili- identify the study gap.
ties and potential. Our discussion also focuses on making
them human-understandable in a cybersecurity context. 2.1. Digital twin
• We explore how AI/XAI-based cybersecurity models can
be used in real-world applications, ranging from anomaly A “Digital Twin” is a digital representation of a physical
detection to mitigation. In addition, we discuss how these product, system, or process that typically serves as its virtually
methods can be used to make cyber systems automated, identical digital counterpart to simulate and analyze its behav-
ior and performance. DT can be characterized with three main
intelligent, and trustworthy as necessary.
spaces [2] -
• Our study identifies and summarizes several key chal-
lenges and research issues that need to be addressed • Physical space: It includes operational technologies
for further improvement. In addition, we discuss possi- (OTs) that are used in real-world settings, including sen-
ble next-generation cyber modeling directions within the sors, actuators, and controllers like remote terminal units
context of digital twins. (RTUs) and programmable logic controllers (PLCs).
3
I.H. Sarker, H. Janicke, A. Mohsin et al. ICT Express xxx (xxxx) xxx

Table 1
List of key acronyms.
Acronyms Meaning
DT Digital Twin
AI Artificial Intelligence
XAI Explainable Artificial intelligence
AIT Automation, Intelligence, and Trustworthiness
ML Machine learning
DL Deep learning Fig. 3. An understanding of digital twin comparing with digital model and
DNN Deep Neural Network digital shadow by taking into account the data flow between physical and
CNN Convolutional Neural Network digital object.
RNN Recurrent Neural Network
GAN Generative Adversarial Network
AE Autoencoder from the physical world to the shadow, but not from the
DBN Deep Belief Network
shadow to the physical world. Overall, digital models, digital
KDD Knowledge Discovery from Data
MLP Multi-layer Perceptron shadows, and digital twins can be differentiated based on their
NLP Natural Language Processing data flow architectures as well as their intended uses. Digital
LLM Large Language Model shadows are more capable than digital models but less capable
SHAP SHapley Additive exPlanations than digital twins.
LIME Local Interpretable Model-Agnostic Explanations
Overall, DT technology involves creating a virtual replica
CIA Confidentiality, Integrity and Availability
CPS Cyber-Physical Systems of a physical system or device to improve efficiency, re-
DDoS Distributed Denial-of-service duce costs, enhance performance, and enable innovation by
DoS Denial-of-service allowing organizations to better understand and manage their
IDS Intrusion Detection System physical assets and processes in a virtual environment. In
IoT Internet-of-Things
QoS Quality-of-Services
terms of cyber threats and security, DT technology raises new
SIEM Security Information and Event Management challenges and opportunities in real-world application areas,
SOC Security Operation Centre discussed in the following.
SOAR Security, Orchestration, Automation, Response
2.2. Cybersecurity and digital twin

• Digital space: To represent physical assets using digital Cybersecurity typically involves numerous measures and
assets, it mimics the states or situations, circumstances, technologies that ensure the confidentiality, integrity, and avail-
and configurations while making decisions about the ability of data, and safeguard digital assets [31]. Cybercrimi-
physical space. nals have become increasingly sophisticated in the real world
• Communication space: It bridges the physical and digital of cyberspace, and the evolution of computer crime towards
worlds, allowing the DT to control information flows and the use of ICT and AI technologies can be summarized as
production processes. cybercrime, computer crime, and AI crime [10,11,32].
With advancements in technologies like AI, machine learn- Digital twins and cybersecurity can be characterized into
ing, and data analytics, digital twins are becoming more ad- two different but related perspectives such as “DT for cyber-
vanced and are expected to play a significant role in driv- security” which is about DT technology as a tool or solution
ing digital transformation across various industries in the fu- to enhance cybersecurity resilience in a system or organi-
ture [17,18]. DTs can be used in various industries and critical zation [33]. This means leveraging the capabilities of DT
infrastructures, such as manufacturing, healthcare, business, technology to simulate, model, and analyze potential cyber
transportation, energy, water, defense, smart cities, and so on threats, vulnerabilities, and attack scenarios to proactively
to gain insights, optimize operations, and make data-driven identify and mitigate cybersecurity risks. Another perspective
decisions [1,2,19]. Data from the physical object is collected could be “Cybersecurity for DT”, which is about implement-
in real time and used to update the digital twin, which in ing cybersecurity measures to protect DT environments from
turn provides insights, analytics, and visualization to better potential cyber threats [34]. This means implementing appro-
understand and manage the physical counterpart. The relevant priate cybersecurity controls, practices, and technologies to
terms “Digital Model” and “Digital Shadow” can be distin- safeguard the digital twin environments from potential cyber
guished according to the data flow and interaction between threats, such as unauthorized access, data breaches, or other
the physical and digital entities, as shown in Fig. 3. A digital malicious activities. To mitigate today’s cyber threats, indus-
model does not include any automated data flows between tries, and businesses need to move towards a more proactive
the digital and physical worlds, is more or less static (unless and predictive approach, which can be achieved by using
manually updated), and exists in isolation. On the other hand, a digital twins. As mentioned earlier, DT has the such capability
digital twin has a connection between the digital and physical to provide organizations with better decision-making insights
worlds with fully integrated data exchanges in both directions. to enhance the cybersecurity resilience of their infrastructure.
A digital shadow lies in between with automated data flowing However, it is also crucial to ensure the security of DT itself
4
I.H. Sarker, H. Janicke, A. Mohsin et al. ICT Express xxx (xxxx) xxx

Table 2
Previous survey comparison by taking into account ten key aspects relevant to this paper.
Papers Aspects

Future Directions and Prospects

Challenges and Research Issues
Explainable Cyber Decisions

AI/XAI based Cyber Usage

ML/DL-based Cyberlearning
AI-based Cybersecurity
Exploring DT Threats

AI/XAI Taxonomy
CyberAIT Aspects

XAI Methods

Remarks
Alcaraz et al. [2], 2022 x ✓* x x x x x x * ✓ An extensive study on security threats in digital twin
Rathore et al. [19], 2021 x x x x x x * x * ✓ Exploring AI, ML, big data in digital twin
Kaloudi et al. [10], 2020 x x ✓ ✓ x x x ✓ * * Presented AI-based cyber threat landscape
Hu et al. [20], 2022 x x ✓ ✓ x x x ✓ * * Presented AI-threats and countermeasures
Kaur et al. [21], 2022 x x x x ✓ x ✓ x ✓ ✓ Presented a review on trustworthy AI
Guidotti et al. [14], 2018 x x x x ✓ x x x * * Presented a brief summary of XAI for black box systems
Kuzlu et al. [22], 2021 x x ✓ ✓ * x x ✓ * * Explored the role of AI in the IoT cybersecurity
Samtani et al. [23], 2020 * x ✓ ✓ * x x ✓ * * Offered a multi-disciplinary AI for Cybersecurity
Alazab et al. [24], 2021 * x * * x x x * ✓ ✓ An extensive study on federated learning for cybersecurity
Dwivedi et al. [15], 2021 x x x x ✓* x ✓ * * * An extensive study on XAI techniques and tools
Arrieta et al. [25], 2020 x x x x ✓ x ✓ x ✓ ✓ Presented an extensive study on XAI
Capuano et al. [16], 2022 x x * ✓ ✓ ✓ * ✓ * * Presented an extensive study on XAI in cybersecurity
Seale et al. [26], 2022 x x * ✓ ✓ ✓ ✓ * * * Exploring X-IDS methods in cybersecurity
Rawal et al. [27], 2022 x x x x ✓ x ✓ x ✓ ✓ Presented recent advances in trustworthy XAI
Charmet et al. [28], 2022 x x * ✓ * * * x * ✓ A study on XAI in cybersecurity
Ahmed et al. [29], 2022 x x ✓ ✓ ✓ x * x ✓ ✓ Presented a study form AI to XAI in Industry 4.0
Ibrahim et al. [13], 2023 x x x x ✓ x ✓ x ✓ ✓ Presented Explainable CNN focused XAI
Saeed et al. [30], 2023 x x x x ✓ x ✓ x ✓ ✓ Presented a systematic meta-survey on XAI
This paper (Sarker et al.) ✓* ✓* ✓* ✓* ✓* ✓* ✓* ✓* ✓* ✓* An extensive study on AI/XAI for cybersecurity
focusing diverse cyber issues in DT, taxonomies,
multi-dimensional cyber usage scopes, challenges
research directions from the perspective of Cyber
AIT (Automation-Intelligence-Trustworthiness).

Symbol Used: High Coverage (✓*), Mid Coverage (✓), Low Coverage (*) and No Coverage (x).

to protect against cyber threats that could compromise the classify or predict the output for new data points accord-
integrity and effectiveness of the DT system and the physical ingly, e.g., intrusion or anomaly detection, identifying
counterpart it represents, discussed briefly in Section 3. suspicious activities, etc.
• Hybrid AI — typically focuses on solving more complex
2.3. AI-enhanced cybersecurity in digital twin problems that require both generative and discrimina-
tive approaches, e.g., incident response by identifying
The widespread usage of DTs raises several concerns about the source and nature of a cyber attack and generating
responses to mitigate.
cybersecurity that need to be addressed to utilize the full po-
tential of DT in our real-world application areas. AI-enhanced The choice of which approach to use depends on the
cybersecurity plays a critical role in protecting digital twin specific task and the nature of the data involved. For exam-
environments from cyber threats, and making the systems ple, a hybrid cyber model could use a generative model for
automated and intelligent. In Section 1, we defined these key anomalous patterns of network traffic, and a discriminative
terms automation, intelligence as well as trustworthiness. AI model to classify the type of attack that is being carried
is typically involved with training machines to think in such out. Machine learning techniques including deep learning are
a way that requires intelligence to enable machines to carry broadly used in such AI modeling processes which typically
out certain jobs. AI systems can be of different types like an- allow computers to automatically learn from data and to solve
alytical, functional, interactive, textual, and visual depending a particular cyber issue [36,37]. Thus, the cybersecurity as-
on the nature of the problem and data [9,18]. Similar to deep pects of a DT can be enhanced and automated using AI.
learning taxonomy, presented by Sarker et al. [35], AI can also In our context of study the term “Explainable” focuses on
be categorized into generative, discriminative, and hybrid by high-performance AI models with the capability of human-
taking into account the modeling type and outcome, defined understandable decision-making. Researchers often use the
below - terms “explainability”, “interpretability”, “trustworthy”, “reli-
ability”, and so on interchangeably in different contexts. This
• Generative AI — typically focuses on modeling the can also be considered as the foundation of “Responsible AI”
underlying data distribution and generating new content aiming to ensure that AI technologies are developed and used
or data accordingly, e.g., to generate realistic synthetic in ways that benefit individuals, communities, and society as a
data, simulating attacks, etc. whole. Hence, we broadly take into account these phrases as a
• Discriminative AI — typically focuses on finding a de- problem under the category of explainable AI. Various types of
cision boundary given a set of input features and to AI techniques for cybersecurity modeling and their explainable
5
I.H. Sarker, H. Janicke, A. Mohsin et al. ICT Express xxx (xxxx) xxx

capabilities within the context of our study are discussed in challenges that have been identified and suggesting possible
Section 4. study avenues for further cyber research and development in
DT. We cover all ten key aspects, including CyberAIT, which
2.4. Related surveys and study scope makes our survey unique compared with other studies in this
emerging field.
The development trend of the DT research is growing
rapidly highlighting the formation stage, incubation state, and 3. Cybersecurity resilience and threats in digital twin
growth stage [38]. A comparison of related surveys is pre-
sented in Table 2. We base our position on ten relevant key Digital twins can be used to improve cybersecurity re-
aspects, as shown in Table 2. The scope of the study and the silience, but it is also important to consider the potential
contributions of our work are then highlighted by a comparison security threats that may arise in digital twin systems [34].
with earlier surveys from the viewpoint of these key aspects. To explore this, we first formulate two questions “How does
Three main attributes are used in this survey, i.e., AI, cyberse- digital twin enhance cybersecurity resilience using AI?” and
curity, and digital twins. Thus, we mainly use a combination of “What are the potential security threats of digital twin, and
the search keywords “Cybersecurity”, “Artificial Intelligence”, how AI can help to address these issues?” In this section, we
“AI”, “Explainable AI”, “Machine Learning”, “Data Science”, answer these two questions and discuss the need and potential
“Digital Twin” etc. while searching relevant papers. Peer- of AI to address this.
reviewed scientific journals, conferences, and books published
between 2010 and 2024 are taken into consideration. In terms 3.1. Enhancing cyber resilience
of databases, we consider several popular repositories such as
“Google Scholar”, “Science Direct”, “Springer Nature”, “Sco- Digital twin technology can enhance cybersecurity resi-
pus”, “ACM”, and “IEEE Explore”. Through our review of the lience by providing a virtual representation of a physical
articles’ abstracts, introductions, discussions, and conclusions, system or object, which can be used for testing, monitoring,
we assess the paper’s relevance to our study in this paper. and analysis of cybersecurity threats [33]. Hence we summa-
Eventually, we have listed 142 papers to support our study, rize how digital twin technology can enhance cybersecurity
18 of which are survey papers comparing our study listed resilience using AI technologies:
in Table 2. Some surveys concentrate on DT but have no
exploration to do with AI-enhanced cybersecurity [1,2,17]. For • To simulate cyber attacks and test the security of a
instance, Barricelli et al. [1] present a DT survey focusing on system before it is deployed. AI-based algorithms can
definitions, characteristics, applications, and design implica- be used to create realistic attack scenarios and test the
tions. Alcaraz et al. [2] analyze the current state of the DT effectiveness of cybersecurity measures. By analyzing
paradigm and their associated security threats. Wagg et al. [17] large amounts of data in real-time, AI algorithms can
present the state-of-the-art prospects of DT for engineering dy- identify anomalies and potential security threats more
namics applications. Similar to this, some surveys concentrate quickly and accurately than human analysts [36].
on AI but ignore the potential of trustworthiness in decision- • To monitor physical systems in real-time, providing early
making [12,19]. For instance, Rathore et al. [19] present a warning of cyber attacks or anomalies. AI algorithms can
review of the role of AI, machine learning, and big data in be used to analyze data from sensors and identify patterns
digital twinning. Some surveys like [14,16,29] concentrate on that may indicate a security breach.
XAI methods, particularly focusing on black-box modeling. • To analyze historical data and predict future security
In addition to black-box modeling, some other works have threats using AI technologies through identifying pat-
been conducted with additional techniques in the context of terns and trends. This can enable organizations to take
cybersecurity [39]. In general, the choice between black box proactive measures to prevent cyber attacks before they
and white box models depends on the application’s specific re- occur.
quirements, including transparency, interpretability, accuracy, • To automate incident response, enabling digital twins
and regulatory compliance. A list of related works and their to quickly and effectively respond to security threats.
key objectives can be found in Table 2. The lack of a compre- For example, AI-powered digital twins can automatically
hensive study of AI/XAI-based modeling in cybersecurity and isolate compromised devices, block malicious traffic, and
DT motivates us to conduct this survey. Thus, we begin with a implement security protocols to prevent further damage.
variety of security concerns in DT in our paper. Following that, • To simulate and analyze user behavior, providing data to
we provide a thorough analysis of several AI/XAI techniques train AI models to detect anomalous user behavior that
for cybersecurity modeling using a taxonomy that includes may indicate a security threat. This can help organiza-
their explicable features. This can help analysts and security tions detect insider threats and prevent data breaches.
specialists identify potential threats and anomalies, understand • To create intelligent access control systems that can
how the system functions, and ultimately determine the best authenticate and authorize users based on their behavior,
path to take. We also go over the potential applications of location, or other factors, to prevent unauthorized access.
AI/XAI-based techniques in various cyber domains within AI algorithms can be used to detect anomalies in user
the context of DT. We conclude by highlighting the research behavior and alert security personnel.
6
I.H. Sarker, H. Janicke, A. Mohsin et al. ICT Express xxx (xxxx) xxx

Overall, AI can play a crucial role in strengthening cy- system and the digital twin, as well as between different
bersecurity resilience in digital twins. By leveraging machine components of the digital twin. Security threats in this layer
learning algorithms and other AI technologies, discussed in can arise from various sources, including data breaches, cyber
Section 4, organizations can improve threat detection, vulner- attacks on communication channels, and unauthorized access
ability assessment, incident response, predictive maintenance, to the digital twin. For example, data breaches can occur when
and access control, ensuring the integrity and safety of their sensitive data is accessed or stolen by unauthorized parties.
digital twin environments. Malware and viruses can infect the data and communica-
tion layer of a digital twin, compromising the integrity and
3.2. Security threats in the digital twin availability of data. Similarly, insider threats can occur when
authorized users misuse their access to the digital twin, either
Digital twin technology provides many benefits, such as intentionally or unintentionally. AI-based solutions, discussed
enhanced system monitoring, predictive maintenance, and op- in Section 4 can be used to detect and prevent security threats
timization, but it also poses significant security risks or threats in the data and communication layer of a digital twin by
[2,34]. According to [40], a security threat can be defined as
monitoring network traffic, identifying suspicious activity, and
”a set of circumstances that has the potential to cause loss
flagging potential threats. For example, machine learning al-
or harm”. In this section, we explore the possible threats of
gorithms [43,44] can be trained to detect unusual patterns of
digital twins considering the layer-by-layer architecture of a
data access or data transfer by authorized users or to detect
digital twin. Motivated by our earlier paper Sarker et al. [41]
unusual patterns of network traffic that may indicate malware
and Alcaraz et al. [2], we take into account the 4-layered
architecture of a digital twin and their associated security or virus activity.
issues in the following.
3.2.3. Digital and analytical layer
3.2.1. Physical layer The digital and analytical layer of a digital twin typically
The physical layer of a digital twin refers to the hardware monitors physical twin behavior, performs data analysis, and
and infrastructure that make up the physical environment of generates insights and recommendations based on the data
the digital twin. This includes sensors, actuators, communi- received from the physical counterpart. Security threats in this
cation networks, and other physical devices that are typically layer can arise from various sources, including data tampering,
used to collect and transmit data to the digital twin [1]. Some model poisoning, and algorithmic bias. For example, data
common security threats in the physical layer of digital twins tampering can occur when data is modified or deleted by
include physical attacks that can include theft, tampering, unauthorized users, resulting in inaccurate analysis and faulty
or sabotage of the physical system or its components [2, recommendations. Similarly, model poisoning can occur when
42]. For example, an attacker could tamper with sensors or attackers manipulate the training data or the machine learning
other critical components of the system, causing inaccurate algorithms used to generate insights and recommendations,
data to be generated and potentially leading to erroneous resulting in biased or inaccurate results [45]. Algorithmic bias
decisions. Similarly, malfunctioning hardware components can could be another issue that can occur when AI algorithms
cause inaccuracies in sensor readings or other data, leading used to generate insights and recommendations are biased
to erroneous decisions. Environmental factors, such as tem- against certain groups or individuals, resulting in unfair or
perature, humidity, and electromagnetic interference, can also discriminatory outcomes. In addition, adversarial attacks can
pose a threat to physical systems. In addition, malicious code occur when attackers attempt to manipulate the input data
can be introduced into the physical system through infected to mislead or confuse the machine learning algorithms, re-
software, firmware, or hardware. Attackers may use malicious sulting in inaccurate or misleading results [46,47]. AI-based
code to gain unauthorized access to the system, steal data, or solutions, discussed in Section 4 can be used to detect and
disrupt its operations. Thus, security threats to the physical prevent security threats in the digital and analytical layer of
layer of a digital twin can have serious consequences, as they
a digital twin by monitoring data integrity and data access,
can result in physical damage, loss of data, and disruption of
detecting anomalies in the input data and the output results,
operations. AI-based solutions, discussed in Section 4 can be
and preventing algorithmic bias and adversarial attacks. For
used to detect and prevent such security threats by monitoring
example, machine learning algorithms [43,44] can be trained
and analyzing sensor data, diagnosing hardware failures, mod-
to identify patterns in sensor data and adjust the parameters of
eling the effects of environmental factors, and detecting and
preventing cyber attacks on the physical system. For example, the digital twin’s models to improve accuracy.
anomaly detection using machine learning algorithms [43,44]
can be used to identify unusual behavior in control systems or 3.2.4. User and application layer
unexpected changes in sensor readings that deviate from the The Application Layer of a digital twin is responsible for
norm as potential attacks. providing the user interface and functionality for interacting
with the system. Security threats in this layer can arise from
3.2.2. Data and communication layer various sources, including phishing attacks, unauthorized ac-
The data and communication layer of a digital twin typ- cess to user accounts, and vulnerabilities in the user interface.
ically facilitates the exchange of data between the physical For example, insecure user accounts can be compromised
7
I.H. Sarker, H. Janicke, A. Mohsin et al. ICT Express xxx (xxxx) xxx

Fig. 4. Major AI technologies for automation and intelligent decision- Fig. 5. Machine learning taxonomy highlighting major learning categories
making in the context of cybersecurity. used for self-learning cyber automation and intelligence.

through weak passwords or social engineering attacks, allow- 4.1. AI methods for cybersecurity modeling
ing unauthorized access to the digital twin. Phishing attacks
are a common form of social engineering that trick users into In cybersecurity modeling, artificial intelligence offers ad-
providing sensitive information, such as login credentials or vanced techniques for threat detection, risk assessment, ano-
financial information [48,49]. Similarly, vulnerabilities in the maly detection, and incident response. To comprehend the
user interface can occur when attackers exploit weaknesses potential of diverse AI methods, we first classify them into
in the design or implementation of the user interface. Thus, six key categories based on their working principles that
security threats to the application layer of a digital twin can can be used for cybersecurity models, as depicted in Fig. 4.
compromise the confidentiality, integrity, and availability of The following subsections discuss these methods, emphasizing
data, as well as the functionality of the system. AI-based their potential to make cybersecurity systems automated and
solutions, discussed in Section 4 can be used to detect and intelligent.
prevent security threats in the user and application layer of a
digital twin by monitoring user behavior, detecting anomalies 4.1.1. Machine learning
The rapid growth of data generated by digital systems
in application behavior, and preventing unauthorized access to
and the complexity of threats are making traditional methods
resources. For example, machine learning algorithms [43,44]
of detecting and preventing cyberattacks less effective. ML,
can be trained to detect discrepancies between the digital
a core component of AI, has the potential to automate the
twin’s outputs and the actual physical system’s behavior or to
process of detecting and responding to threats, as well as
identify unusual patterns of application usage.
provide more effective and efficient cybersecurity solutions,
Overall, by integrating AI-based solutions, as discussed
including intrusion detection, spam detection, malware detec-
briefly in Section 4 into the digital twin systems, cybersecurity tion, fraud detection, and user behavior analytics [44,64,65].
can be improved, and the accuracy and reliability of the digital A key advantage of machine learning in cybersecurity is its
twin can be enhanced. ability to analyze vast amounts of data gathered from network
traffic, user behavior, and system logs to identify patterns
4. AI/XAI methods and taxonomy and anomalies that may indicate a potential security threat,
which cannot be done manually by humans. In a broader
In this section, we explore multi-aspects AI/XAI methods perspective, learning can be supervised (task-driven), unsuper-
that are useful for cybersecurity modeling in DT and build vised (data-driven), and reinforcement (environment-driven)
a taxonomy accordingly, as shown in Fig. 6. To achieve th- as shown in Fig. 5. Semi-supervised could be another type
is goal, we first summarize and discuss the potentiality of combining supervised and unsupervised learning. These can
diverse AI methods (Section 4.1) and then discuss their ex- be used in various cyber application areas depending on the
plainable capabilities (Section 4.2) from different perspectives. problem nature and availability of data [66]. For instance,
Several popular techniques and their potential applications in Cui et al. [67] demonstrate ML-based methods, e.g., k-means
cyberspace are outlined in Table 3. clustering, and naive Bayes classification with Monte Carlo
8
I.H. Sarker, H. Janicke, A. Mohsin et al. ICT Express xxx (xxxx) xxx

Fig. 6. A taxonomy of AI/XAI based methods for cybersecurity modeling.

simulation, to detect anomalies for load forecasting under and diversity of cyber threats. In the context of adversarial
cyberattacks. A decision tree-based intelligent intrusion detec- machine learning, robust models are designed to withstand
tion system has been discussed in [68]. Heartfield et al. [69] adversarial attacks such as intrusion detection system evasions
present a self-configurable cyber–physical intrusion detection or data poisoning attacks [31]. Overall, ML methods and their
system for smart homes using reinforcement learning. A tree- variations could be one of the most promising tools for future-
based model has been presented in [70] for online diagnosis generation cybersecurity systems, particularly when focusing
services and in [71] for stealthy cyber-attack detection in on self-learning automation and intelligent decision-making in
smart grid networks. Similarly, a variety of use cases using DT environments.
machine learning techniques and their potential for security
modeling have been summarized in [43]. Based on the data
and modeling variations, different categories of ML modeling 4.1.2. Neural networks and deep learning
are used to solve cyber issues. For instance, Alazab et al. [24] Deep learning (DL), is a subset of a larger family of
highlight the potentiality of federated learning in cybersecurity, ML that uses multiple layers to gradually extract higher-
which enables different devices to learn a collaborative ML level features from the raw input, and can also be leveraged
model. An active learning-based XGBoost model for cyber– for cybersecurity modeling in DT environments. DL specifi-
physical system against generic false data injection attacks cally neural networks with multiple hidden layers, can learn
has been presented in [65]. However, the key challenge is complex patterns and representations from large amounts of
to ensure the availability of high-quality and labeled data for data, to identify patterns and make predictions, which can
training ML models, especially considering the complexity be valuable for cybersecurity in digital twin systems. DL
9
I.H. Sarker, H. Janicke, A. Mohsin et al. ICT Express xxx (xxxx) xxx

Table 3
Summary of Various AI/XAI-based Methods Used in the Context of Cybersecurity Applications.
Broad area Cyber Methods used Explainabil- Main contributions
applications ity
EAI/ML [50] Intrusion Gini Index, DT Whitebox To build a generalized IntrudTree with the
Detection top-ranked security features
AI/ML [36] Anomaly Pearson correlation, – Detecting cyber-anomalies and multi-attacks
Detection DT, RF, XGB, ANN, etc. with feature importance
EAI/ML [51] Intrusion Classifier, SHAP Global, A framework to improve the interpretation
Detection Local of IDSs
EAI/ML [52] Fraud Detection LR, Autoencoder, NN, Global Exploring explainability methods for runtime
LIME, SHAP, etc. tradeoffs on supervised and unsupervised models
EAI/ML [53] Anomaly One Class SVM, DT, Model- To explain the anomalies detected by an
Detection K-Means, Rules agnostic unsupervised OCSVM ML model through rules
EAI/ML [54] Intrusion DT, Whitebox, To propose a rule-based interpretable and
Detection Human Expert Rules Rule-based explainable hybrid intrusion detection system
EAI/ML [55] Malware LR, DT Whitebox To propose a hardware-assisted malware detection
Detection framework using explainable machine learning
EAI/DL [56] Phishing Faster-RCNN, Visual To design a hybrid deep learning system for
Detection Transfer Learning phishing identification
EAI/DL [49] Phishing Threat Attention mechanism, Visual Designing a multi-modal hierarchical attention
Intelligence Multimodal model for phishing website detection.
EAI/DL [57] Malware MLP, NLP, Semantic Rule, Textual, Designing a ML-based approach to interpret
Detection Attention mechanism Expert the core malicious behaviors within apps.
Analysis
EAI/DL [58] Malware Family Deep Learning Visual Designing an interpretable deep learning model
Identification for mobile malware and family identification.
AI/DL [48] Phishing K-medoids, DT, Searching, – Designing a NN phishing detection model based
detection on decision tree and optimal feature selection.
Optimal Features, ANN
AI/DL [59] IoT Threat NLP, TFIDF, LogTF, – Designing combined DL approach to detect the
detection CNN pirated software and malware-infected files
across the IoT network
AI/DL [60] Botnet detection Fuzzy rules, – Designing a fuzzy logic based feature engineering
ANN method for botnet classification
EAI/DL [61] Botnet traffic CNN, SHAP Model Designing a DL model for botnet detection and
detection agnostic, classification with decision explanation
and classification Global
EAI/ML [62] Twitter bot Ensemble, LR, CART, Visual Designing a ensemble ML approach for
detection MLP, explainable and multi-class bot detection
AdaBoost, RF, LIME
EAI/ML [63] Cyber–physical SOM, ANN, Histograms, Global, Designing an explainable unsupervised machine
systems U-Matrix, Heat map Local learning for cyber–physical systems

can be categorized into generative (e.g., GAN), discrimina- malware threat hunting approach has been presented in [75].
tive (e.g., RNN), and hybrid modeling, discussed briefly in DL techniques in cybersecurity are advantageous because they
Sarker et al. [35] and have many potential security applica- can learn from large volumes of data and identify complex
tions. For instance, Lv et al. [72] utilized DL-based methods, patterns that traditional approaches may overlook. However,
i.e., CNN-SVR, to solve the security problems of the coop- much attention might be needed to ensure the effectiveness of
erative intelligent transportation system in digital twins. Luo the DL model and avoid potential biases or false positives in
et al. [73] discussed various aspects of deep learning-based DT environments.
methods (i.e., DNN, CNN, LSTM) to identify anomalies in
cyber–physical systems and ensure the security of CPS. An in- 4.1.3. Rule mining and expert system modeling
terpretable deep learning model for mobile malware detection Typically, knowledge mining involves extracting insights,
and family identification has been presented in [58]. Danilczyk patterns, and relationships from large volumes of data [9]. An
et al. [74] present a smart grid anomaly detection method using important part of knowledge mining is rule mining, which
a deep learning (CNN) digital twin that can classify the faults is used to find interesting relationships between variables in
with over 95% accuracy. A deep RNN-based approach for IoT large datasets. Using discovered knowledge or rules and expert
10
I.H. Sarker, H. Janicke, A. Mohsin et al. ICT Express xxx (xxxx) xxx

systems in cybersecurity modeling allows for enhanced threat of potential threats, multimodal intelligence refers to the abil-
detection and mitigation. In rule mining, patterns, and cor- ity to process and integrate cyber information from various
relations are automatically discovered in vast datasets, which modalities in DT environments, such as text, images, audio,
can be used to identify vulnerabilities and malicious behavior. and sensors, rather than relying solely on one type of data. For
Based on these rules, an expert system can be constructed that example, a cybersecurity model may analyze network traffic
emulates the decision-making capabilities of human cyberse- data, e.g., text, and detect patterns of suspicious activities in
curity experts. To discover rules, Sarker et al. [11] explored DT. It may also analyze images from security cameras and
a taxonomy of diverse methods such as knowledge-based ap- detect unusual behavior or identify individuals who are not
proach, i.e., based on human expertise, data-driven approach, authorized to be on the premises. Similarly, by analyzing both
i.e., extracting insights or useful knowledge from data, and the content of emails and the network traffic associated with
their ensembles. Different types of rules can be discovered those emails, a system can more accurately detect and prevent
depending on the data nature and the target cyber solution. For phishing attempts. A variety of machine learning, statistical,
example, association rules [76] can be employed to identify a and NLP techniques are used in textual analytics to extract
correlation between certain user behaviors and the likelihood insights and patterns from massive amounts of unstructured
of a security breach. Similarly, classification rules [77] can text [31]. For instance, NLP techniques (word embedding
be used to identify the type of malware that is present on a GloVe + CNN) are used to prioritize vulnerabilities based
network and to determine the appropriate action to take to on their description [83]. Similarly, visual analytics extracts
mitigate the threat. In addition, fuzzy rules [78,79] and belief insights from images or visual data. Chai et al. [49] present
rules [80,81] based modeling can be used to handle uncertainty an explainable multi-modal hierarchical attention model by
and imprecision in data. For instance, a fuzzy rule could be taking into account both the textual and visual information
used to detect network traffic that is slightly anomalous but for developing phishing threat intelligence. Thus, by analyzing
not necessarily indicative of a specific attack. Similarly, a data from multiple modalities simultaneously, an AI system
belief rule could be used to determine the likelihood that a can identify patterns that might not be visible with a single
particular security event is a false positive, based on the level modality and improve the accuracy of its predictions and
of confidence in the detection algorithm and other relevant alerts. Although getting access to diverse datasets in DT is a
factors. By using rule-based modeling, security analysts can challenging issue, incorporating multimodal intelligence into
detect and respond to threats more effectively and find the cybersecurity modeling can lead to more effective and efficient
root cause of such threats for proactive solutions. Through detection and prevention of cyber threats.
continuous learning and adaptation, rule mining and expert
4.1.5. Semantic knowledge representation and reasoning
systems enhance the resilience and security posture against
By encoding domain-specific knowledge and facilitating
evolving cyber threats. However, a balance between rule com-
intelligent decision-making, semantic knowledge representa-
plexity and interpretability is crucial to effective cybersecurity
tion and reasoning offer a robust framework for advancing
decision-making. Thus, much attention is needed while design-
cybersecurity modeling. Using semantic technologies such as
ing innovative algorithms by taking into account essential rule
ontologies, i.e., formal representations of knowledge within a
properties such as completeness, non-redundant, conflict-free,
specific domain, and knowledge graphs, i.e., structured repre-
generalization, and eventually higher accuracy [11] to solve a
sentation of knowledge that captures entities, their attributes,
particular cybersecurity issue.
and the relationships between them, enabling rich data integra-
tion and analysis, cybersecurity models can capture intricate
4.1.4. LLM and multimodal intelligence modeling relationships among threats, vulnerabilities, assets, and defen-
The Large Language Modeling (LLM) approach has signif- sive measures. These semantic techniques are used in various
icant potential for revolutionizing cybersecurity modeling by application areas such as security monitoring [84], malware
harnessing advanced natural language processing (NLP) [9]. analysis [85] etc. For instance, a semantic knowledge graph
The use of NLP typically facilitates the identification of po- might represent the relationships between different actors, such
tential vulnerabilities and suspicious activities by extracting as threat actors, organizations, and malware families. By repre-
valuable insights from unstructured text data, such as se- senting this information in a structured format, cybersecurity
curity logs, incident reports, and threat intelligence feeds. professionals can analyze and reason about potential threats
LLMs enable deeper semantic understanding and contextual and responses. Wang et al. [86] present a scheme to integrate
reasoning by understanding and generating human-like text. knowledge reasoning and semantic data for smart factories
The use of LLMs can allow cybersecurity systems to effi- where the reasoning engine analyzes the ontology model with
ciently sift through vast amounts of unstructured data, identify real-time semantic data. Overall, this structured representation
subtle indicators of malicious activities, and make better- enables sophisticated reasoning capabilities, allowing models
informed decisions in real time. However, much attention is to infer complex insights, identify potential attack scenarios,
needed to take into account diverse issues, e.g., data poisoning, and recommend tailored countermeasures based on contextual
fine-tuning, and trustworthiness in different phases, such as understanding. However, much attention is needed to design
pre-modeling, in-modeling, and post-modeling summarized by efficient algorithms and scalable inference mechanisms to de-
Sarker et al. [82]. To generate a comprehensive understanding tect anomalies, identify patterns, and infer actionable insights
11
I.H. Sarker, H. Janicke, A. Mohsin et al. ICT Express xxx (xxxx) xxx

from large-scale semantic knowledge bases. The use of ma- be included in this process [38,93]. The use of feature en-
chine learning and knowledge or rule mining methods [11] gineering to select or create relevant features from raw data
can augment knowledge graphs through tasks such as entity could improve the performance of AI models. For optimizing
linking, node classification, relation extraction, recommenda- security parameters, inventing intrusion detection rules, and
tion, searching, disambiguating, feature engineering, as well analyzing malware, genetic algorithms could be useful. In
as construction automation, making these applications more addition, hybrid intelligence, which combines different AI
useful and effective. techniques and methodologies, can be used to solve a range
of problems. The combination of machine learning algorithms
4.1.6. Uncertainty modeling with expert systems or rule-based systems is one example of
Due to the inherent complexity and dynamic nature of inter- hybrid intelligence in cybersecurity modeling [31]. Machine
connected systems, cybersecurity modeling within digital twin learning algorithms can identify patterns and anomalies that
environments may pose uncertainty issues. These issues arise may not be immediately apparent to human analysts, while
from a variety of sources, including training data, evolving expert systems or rule-based systems can incorporate domain-
threat landscapes, and uncertainties in system behavior and specific knowledge and rules to identify potential threats that
interactions. Uncertainty modeling in AI encompasses two might not be identified by machine learning algorithms alone.
primary dimensions: data uncertainty and model uncertainty. Another example could be the combination of supervised
Data uncertainty arises from limitations in the quality, quan- and unsupervised learning techniques [66]. Similarly, different
tity, and representativeness of available data, such as noise, methods such as LLM, semantic knowledge, visual analytics,
bias, missing values, outliers, incompleteness, and variability and machine or deep learning can be integrated to produce
in real-world phenomena. Model uncertainty, on the other an output depending on available data and target solution. For
hand, refers to the assumptions and limitations inherent in instance, Garrido et al. [84] present machine learning-based
the algorithms resulting from architectural complexity, param- knowledge graphs for security monitoring. Piplai et al. [85]
eter estimation, and generalization capability. Data uncertainty use fusion, NLP (named entity recognition, word2vec, TF-IDF
can often be addressed through robust preprocessing, data score, etc.), and neural networks to create their knowledge
augmentation, or statistical methods, but model uncertainty graph for malware analysis utilizing action reports. Qaisar
often requires more sophisticated approaches. A variety of et al. [91] present a multimodal information fusion for An-
techniques are employed to address these different types of droid malware detection using lazy learning. Overall, hybrid
uncertainty, including probabilistic graphical models, fuzzy intelligence could be a valuable approach that can enhance
logic, belief functions, Bayesian inference, or Monte Carlo the effectiveness of cybersecurity modeling by leveraging the
methods [87,88]. Models using probabilistic graphical repre- strengths of different AI techniques and methodologies.
sentations, such as Bayesian Networks, provide a structured In summary, these AI methods, discussed above are often
framework to represent and reason about uncertainties, while used in combination to tackle real-world problems, and the
fuzzy logic allows for flexibility in working with imprecise choice of technique depends on the specific task and the nature
or qualitative data. Conversely, model uncertainty can be mit- of the available data. The incorporation of these AI methods
igated through techniques like ensemble learning, dropout with their explainability analysis into cybersecurity modeling
regularization, model calibration, Bayesian model averaging, can enhance the effectiveness of organizations in detecting,
and sensitivity analysis [89], which assess how robust the mitigating, and responding to cyber threats.
predictions of an AI model are under various assumptions
and parameters. To ensure robustness and trustworthiness in 4.2. XAI methods for cybersecurity modeling
AI systems, it is crucial to balance these two aspects of
uncertainty modeling. In this section, we discuss XAI methods from different
perspectives highlighting the explainable capabilities of AI
4.1.7. Others methods discussed earlier. To comprehend XAI methods for
In addition to the above key categories of AI methods, cybersecurity modeling, we classify them into five categories,
several other techniques are also useful in the context of cy- discussed in the following subsections.
bersecurity modeling. For instance, information fusion, which
is ‘the study of efficient methods for automatically or semi- 4.2.1. Explainability based on model transparency
automatically transforming information from different sources This category of interpretability is based on how the model
and points in time into a representation that provides effective is transparent in terms of its architecture such as glass or
support for human or automated decision-making’ [90]. Data white-box and black-box modeling, depending on the specific
can be generated from a variety of sources, such as machines, needs of the application. White-box models are typically trans-
physical environments, virtual spaces, and historical databases, parent models, such as decision trees or rule-based systems
in digital twin systems [38]. By combining this data, analysts explored by Sarker et al. [11], i.e., the internal structure and
can identify potential threats more effectively, such as fusion- decision-making process of the models are transparent and
based malware detection [91], intrusion detection [92], etc. interpretable. These models can be particularly useful in cyber-
Data generation, modeling, cleaning, clustering, dimension- security for explaining how specific security policies or rules
ality reduction as well as advanced mining techniques can are being enforced. For instance, Sarker et al. [50] present
12
I.H. Sarker, H. Janicke, A. Mohsin et al. ICT Express xxx (xxxx) xxx

a tree-based machine learning model for intrusion detection, are typically less accurate as they simply use the input and
where the anomaly detection rules are generated by traversing output to explain the behavior of the models while model-
from root node to leaf which is human-understandable. The specific approaches rely on the characteristics of the particular
transparency of white-box models makes them ideal for use methods or models.
cases where the ability to understand and explain decision-
making is essential. However, the problem with white-box 4.2.3. Explainability based on information type
modeling is that it may not be employed to work with complex This category of interpretability techniques is dependent on
dependencies that have a lot of parameters. Thus, black- the form in which explanation data is presented. It might in-
box models, such as deep neural networks [35] may include volve visual explanation techniques, such as heatmaps, charts,
billions of parameters, and can be used to detect patterns graphs, etc., that generate images or plots to illustrate the
and anomalies in large datasets, such as network traffic or model’s decisions. In particular, dimensionality reduction, clus-
user behavior logs. For instance, Luo et al. [73] presented a tering, classification, and regression analysis play a significant
survey of deep neural network learning-based anomaly detec- role in the interpretation of the machine learning algorithm.
tion in cyber–physical systems. However, these models can For instance, Wickramasinghe et al. [63] use visualization
be difficult to interpret and understand, making it challenging methods like Histograms, Heat Maps, and U-Matrix (Unified
to determine why a particular decision was made. Decisions Distance Matrix) to visualize how the feature values change
made in cyberspace without clear justifications are generally across clusters for their ML-based cyber–physical systems.
quite impractical due to the trustworthiness issues [9]. To Szafron et al. [95] visualized the classifier decisions and the
make black-box models more transparent, XAI techniques supporting data for these decisions using a straightforward
such as sensitivity analysis, feature importance, and model graphical explanation to explain the naı̈ve Bayesian, linear
visualization can be used to reveal how the model is making support vector machine, and logistic regression classification
its decisions. For example, feature importance [36] can show process. Textual explanation techniques generate natural lan-
which network traffic features are having the most influence guage text to interpret the decisions [96]. For instance, Wu
on the model’s output, while model visualization can provide et al. [57] present a method that generates an understandable
a graphical representation of the decision-making process. natural language description to interpret the malicious behav-
It might be worthwhile to trade off white-box and black- iors of Android apps. Mathematical explanations or numerical
box modeling according to the requirements [9]. Overall, the scores could be another format for providing more detailed
choice between black box and white box models depends explanations for the overall findings [97]. For instance, a linear
on the application’s specific requirements, including trans- classifier is fitted to the intermediate layers to track the features
parency, interpretability, accuracy, and regulatory compliance, and assess how well-suited they are for classification.
may differ application to application.
4.2.4. Explainability based on usage realm
4.2.2. Explainability based on model specificity This category of interpretability is dependent on the usage
Depending on how the model is specific or agnostic, this realm such as global, cohort, and local model explainability
interpretability strategy is taken into account. Model-specific depending on the characteristics of the model. Global model
techniques such as decision trees, SVM, XGBoost, linear explainability aims to provide an overall understanding of
regression, etc. [66] are designed to provide explanations for a how an AI model works such as Permutation Importance and
specific machine-learning model. A model-specific XAI tech- SHAP [61,94]. It involves analyzing the model’s architecture,
nique is useful for understanding and explaining the decisions training data, and parameters to identify the most relevant
made by a specific model. Transparency and trust can be features that contribute to the model’s outcome. This can help
increased in the decision-making process of models using identify the most critical attack vectors and the most important
these techniques. The model-agnostic approach, on the other indicators of compromise in the context of cybersecurity. On
hand, provides explanations that apply to any machine learning the other hand, local model explainability focuses on under-
model, regardless of its architecture or algorithm. Examples standing how an AI model makes specific outcomes such as
of model-agnostic XAI techniques include LIME and SHAP LIME [52,94]. It involves analyzing the model’s decision-
which are employed for fraud detection [52] and Botnet traffic making process for a particular input, such as a network packet
detection [61] respectively. A wide range of machine learning or a log file. This can help identify the specific features that
models can benefit from these techniques, which can help triggered the model’s decision, which can be useful for investi-
identify which features of the input data are most significant gating suspicious activities or validating the model’s output. A
for a given decision. XAI with model-agnostic techniques is study by Wang et al. [51] demonstrated in their experimental
useful when the goal is to understand and explain decisions analysis that local explanations explain why models make
made by any machine learning model, rather than a specific certain decisions based on inputs, while global explanations
model. Model specific approaches depend on a certain model present the relationships between feature values and types of
structure, e.g., a specific architecture of CNN, whereas model attacks extracted from IDSs. Another one is cohort model
agnostic techniques function with any type of ML model [94]. explainability involves comparing the behavior of an AI model
Flexibility is a key advantage of model-agnostic interpretation with that of similar models trained on different datasets or with
techniques over model-specific ones. However, these methods different parameters. By analyzing the differences in behavior,
13
I.H. Sarker, H. Janicke, A. Mohsin et al. ICT Express xxx (xxxx) xxx

XAI can identify the specific factors that contribute to the Pan et al. [55] demonstrated their experimental results while
model’s performance. For cybersecurity applications, cohort hardware-assisted malware detection and localization using
model explainability can help detect anomalies and outliers explainable machine learning. They achieved their highest
that may indicate a potential attack or data breach. Overall, results with ‘accuracy = 88.9’, ‘false positive = 5.2’, ‘false
these explainable capabilities can provide valuable insights negative = 5.9’, and ‘f1-score = 0.88’ for Decision Tree
into the behavior of AI models in cybersecurity applications, modeling, and with ‘accuracy = 97.7’, ‘false positive = 0.9’,
which can help analysts detect and respond to potential threats ‘false negative = 1.4’, and ‘f1-score = 0.97’ for RNN-LSTM
more effectively. modeling. Ullah et al. [59] demonstrated their experimental
results while building their cyber security threats detection
4.2.5. Explainability based on working stages model in IoT using a deep learning approach. They achieved
Explainability can be used at every stage of the AI devel- results with ‘accuracy = 97.46%’, and ‘f1-score = 97.44%’
opment process and can be divided into three different ways for their deep convolutional neural network (DCNN) model
as Pre-Modeling, In-modeling, and Post-modeling stage [9]. to detect malicious infections in IoT networks through color
Premodel explainability focuses on the data used to train the image visualization. Chai et al. [49] demonstrated their ex-
machine learning model, which aims to ensure that the training perimental results while building an explainable multi-modal
data is representative, unbiased, and reliable. By examining hierarchical attention model for developing phishing threat
the data used to train the model, analysts can identify po- intelligence. They achieved results with ‘accuracy = 0.97’,
tential biases, inconsistencies, or errors that may affect the ‘precision = 0.97’, ‘recall = 0.96’, and ‘f1-score = 0.97’ for
model’s performance and robustness. In-model explainability their multi-modal hierarchical attention model consisting of
approach involves examining the internal workings of the ma- URL, webpage text and images.
chine learning model to understand how it makes predictions In general, the performance of the resulting AI model
such as rule-based modeling [98]. In-model explainability depends on the data characteristics, preprocessing, and in-
techniques can be used to identify the most important fea- tended solution. When analyzing the KDD Cup dataset, Sindhu
tures or variables that contribute to the model’s output. This et al. [101] show that the detection rate is influenced by
can help analysts identify potential vulnerabilities, biases, or the features selected. The accuracy of a system can vary
errors in the model’s decision-making process. Thus this can depending on the features selected and the categorization, such
help identify potential threats or anomalies in network traffic, as binary or multiclass, as described by Sarker et al. [36]. In
user behavior, or system logs in the context of cybersecu- certain scenarios, multiple methods can be integrated into one
rity. Postmodel explainability involves analyzing the output of approach; therefore, the outcome depends on the integration.
the machine learning model to understand how it performs Overall, several factors, such as the nature of the problem,
in real-world scenarios. For instance, Langone et al. [99] the available data characteristics, the computational resources,
use a posthoc approach for analyzing anomaly detection and the interpretability requirements, and eventually the specific
Mehdiyev et al. [100] for predictive analytics. This can be used project goals, are needed to consider to choose and design an
to validate the model’s performance, identify potential errors, effective AI model.
or generate insights into the model’s behavior, which can help
analysts respond more effectively. 5. Real-world usage scopes

4.3. Performance analysis and discussion In this section, we summarize and discuss the potential
real-world usage scopes of AI/XAI-based cybersecurity mod-
Depending on the nature of the problem and the data eling in the digital twin, as shown in Fig. 7, from different
characteristics, different methods can potentially be used to perspectives as below.
build AI-based cybersecurity models. Table 3 summarizes
methods used in various cyber applications, highlighting their 5.1. Predictive maintenance and proactive solutions
explainability and contributions. While accuracy on unseen
test cases is an important metric, other metrics can also be used AI-based predictive maintenance can significantly enhance
to assess a model’s effectiveness, such as detection rate, false cybersecurity in a digital twin environment by proactively
positive rate, false negative rate, error calculation, etc. [11]. identifying and mitigating potential threats. This typically
For instance, Wang et al. [51] demonstrated their experi- involves using machine learning and analytics techniques [66,
mental results with accuracy, precision, recall, f1-score, etc. 102] to analyze data from the digital twin and make predic-
while building their explainable machine learning framework tions about potential security threats, vulnerabilities, or risks
for intrusion detection systems. They achieved ‘accuracy = that may arise in the future, and eventually recommend preven-
0.806’, ‘precision = 0.828’, ‘recall = 0.806’, and ‘f1-score tive measures. For example, a DT may recommend software
= 0.807’ for the one-vs-all classifier, and ‘accuracy = 0.803’, updates, network configuration changes, or other security mea-
‘precision = 0.828’, ‘recall = 0.803’, and ‘f1-score = 0.792’ sures to mitigate the risk of a cyber attack. Thus businesses can
for the multi-class classifier, utilizing NSL-KDD test dataset. proactively uncover security issues before causing any harm
For explainability analysis, they use SHAP and combine local with predictive analytics, where machine learning algorithms
and global explanations to improve the interpretation of IDSs. can be employed. Baryannis et al. [103] present an approach
14
I.H. Sarker, H. Janicke, A. Mohsin et al. ICT Express xxx (xxxx) xxx

anomaly detection in cyber–physical systems taking advantage

of unlabeled data and continuously learning at runtime, where
Generative Adversarial Network is used as the backbone of
the framework. Sahingoz et al. [109] demonstrate a phish-
ing detection system using machine learning techniques (DT,
Adaboost, RF, SMO, KNN, NB) as well as various features
such as NLP-based features, word vectors, and hybrid features.
Qiu et al. [110] summarized various uses of deep learning
models (FCN, CNN, RNN, DBN, AE, and hybrid) to detect
Android malware. Kocher et al. [111] summarized various
uses of ML and DL methods for intrusion detection systems.
Shafiq et al. [112] present a malicious Bot-IoT traffic detection
method in IoT networks using machine learning techniques
(DT, NB, RF, SVM). A classification system within the digital
twin can also be used to understand the nature of the threats
and to prioritize their response accordingly. For example,
a classification system might categorize an intrusion as a
brute-force attack, a denial-of-service attack, or a malware
infection [36,43].

5.3. Suspicious activities and behavior analytics

Fig. 7. AI/XAI based potential usage scope in the context of cybersecurity.
In a digital twin, users interact with the virtual system in
a similar way to how they would interact with the physical
to predicting supply chain risks using machine learning algo-
system, which makes behavior analytics important in this
rithms (SVM, Decision Trees). Okutan et al. [104] presented
context. Behavior analytics involves using machine learning
an approach to predicting cyber attacks with Bayesian net- algorithms to analyze user behavior and identify patterns or
works using signals drawn from global events and social anomalies that could indicate suspicious activity. For instance,
media. Fang et al. [105] present a deep learning framework Vallathan et al. [113] present a suspicious activity detection
utilizing the bi-directional RNN with LSTM for predicting approach using deep learning in secure assisted living IoT
cyber attack rates, which gives better accuracy than statistical environments. Similarly, a hybrid deep-learning-based scheme
approaches like ARIMA (Autoregressive integrated moving for suspicious flow detection has been presented in [114]. The
average). Overall, AI-based predictive maintenance can be a AI and machine learning algorithms can monitor user activity,
valuable tool in the context of cybersecurity within a digital including access to systems and data, network traffic, and other
twin, helping organizations to predict and assist in providing behaviors that may indicate a potential threat [43]. This can
proactive solutions to protect critical systems and data from help organizations detect when a user is attempting to access
being compromised. resources or data that they do not have permission to access,
or when a user is accessing resources outside of their normal
5.2. Intrusions or anomaly detection and classification usage patterns through the power of AI modeling. For exam-
ple, machine learning can be used to analyze employee activity
Identifying patterns and anomalies in logs and traffic can within a digital twin of an organization’s IT infrastructure and
be accomplished within a digital twin environment by moni- detect unusual behavior, such as unauthorized access attempts
toring the behavior of the virtual network. Machine learning or data exfiltration. By monitoring user activity, the system can
algorithms can be used to detect and classify potential threats identify potential insider threats and take appropriate actions
and anomalies within a digital twin based on observed patterns to prevent data theft or other malicious activities. Overall, by
and behaviors. A machine and deep learning algorithm can leveraging AI and machine learning algorithms to analyze user
be trained on large historical datasets to identify patterns and behavior, organizations can identify potential security risks and
relationships in the data [36,50]. Data generated from the take appropriate action in the digital twin.
digital twin can then be analyzed in real time and deviations
from the learned patterns detected. Castellani et al. [106] 5.4. Risk assessment and prioritizing threats
demonstrate real-world anomaly detection using digital twin
systems and ML techniques (SVM, Isolation Forest, KNN, Risk assessment and prioritization using AI in the digital
PCA, Clustering, CNN-SAE). Balta et al. [107] presented a twin has the potential to revolutionize the way organizations
digital twin-based framework to detect attacks and anoma- manage risks in their systems, processes, and products. Tra-
lies for cyber–physical manufacturing systems, where they ditional risk assessment and prioritization methods can be
utilize one-class support vector machines (OSVM) to model time-consuming, and error-prone, and may not take into ac-
normal behavior. Xu et al. [108] present a digital twin-based count all the variables that could affect the likelihood and
15
I.H. Sarker, H. Janicke, A. Mohsin et al. ICT Express xxx (xxxx) xxx

impact of a risk. By leveraging machine learning with other help organizations assess the vulnerabilities of their digital
AI techniques in the digital twin, organizations can automate twin identify potential weaknesses that could be exploited by
the process of risk assessment and prioritization, enabling real-world attacks and develop more effective cybersecurity
them to identify potential risks and threats more quickly and strategies accordingly. Thus AI can optimize security strategies
accurately [37,115]. This can involve using techniques such in the digital twin environment based on the results of threat
as classification, regression, clustering, and natural language simulations and vulnerability models.
processing (NLP) [31,66]. AI algorithms can analyze vast
amounts of data generated by the digital twin to identify 5.6. Intelligent access control
potential attack vectors and generate new attack scenarios, that
might be missed by human analysts. This can help organi- The digital twin itself, or a secure entity in direct com-
zations to better understand the potential risks and prioritize munication with the digital twin, must ensure that access
their security efforts. For example, several generative AI meth- control is implemented to all incoming requests [122]. It
ods such as Generative Adversarial Networks (GANs) [116], includes requests for and exchange of information with third
Variational Autoencoders (VAEs) [117], Recurrent Neural Net- parties as well as exchange of information with other digital
works (RNNs) [118], Transformer models [119] etc. have the twins. AI-based access control systems can dynamically adjust
capabilities to process and generate new data and can be used privileges based on risk factors and user behavior. When a
to create new attack scenarios based on the existing vulnera- user exhibits behavior that is unusual or potentially dangerous,
bilities. For instance, Yan et al. [116] presented an architecture access privileges can be automatically restricted or revoked
that automatically synthesizes DoS attack traces using GANs. until the situation is investigated. Heaps et al. [123] pre-
Additionally, AI can learn from historical data, enabling it sented a dynamic access control policy generation method
to make more accurate predictions about future risks and from user stories information using machine learning (Trans-
their potential impact. Once potential risks are identified, they
formers, CNN, and SVM). Nobi et al. [124] conduct a survey
can be prioritized based on their severity and likelihood of
of access control systems using machine learning. AI can
occurrence, which is a crucial factor for decision-making
be used to analyze user behavior and determine appropriate
and formulation of mitigation plans [120]. Prioritization can
access permissions based on user roles and access policies.
help organizations focus their resources on the most critical
AI can also play a key role in automatically assigning roles
risks, enabling them to take proactive measures to prevent or
and permissions to users based on their job roles, access
mitigate them.
history, and other factors. In addition, AI can assist in dynam-
ically adjusting access permissions based on the context of a
5.5. Threat simulation, modeling and optimization of security
user’s request, such as their location, device type, and time
strategies
of day. Overall, AI-based access control in digital twin can
help organizations improve their security posture by providing
By simulating attacks or threats and examining the impact
automated access management processes and reducing the risk
on the virtual equivalent of physical twins, digital twins can
of unauthorized access.
assist enterprise security [121]. AI-based threat simulation
and modeling can be a valuable cybersecurity application in
a digital twin environment. Threat simulation involves us- 5.7. Real-time monitoring, incident response and alert
ing AI algorithms to simulate various cyber attack scenarios, generation
while modeling involves creating virtual representations of the
digital twin and its components to assess vulnerabilities, eval- By continuously analyzing operations and network traffic,
uate the effectiveness of cybersecurity defenses, and optimize an AI-based security system can detect unusual behavior that
security strategies. For example, AI can simulate different leads to penitential attacks and alert system administrators to
types of cyber attacks, such as ransomware attacks, DDoS mitigate them. This can be done by training the AI system
attacks, phishing attacks, or insider threats, in the digital twin on a dataset of known threats and attacks and then using
environment. These simulations can be based on known attack it to classify new network activity based on these patterns,
patterns, historical attack data, or even generated using AI- where machine learning algorithms can play a key role [43].
generated adversarial attacks. Generative AI can be used to For instance, Liu et al. [125] propose an intelligent rein-
create realistic simulations of cyber attacks, such as phishing forcement learning-based approach that can intelligently learn
attacks or malware infections, and model the behavior of mitigation policies under various attack scenarios and miti-
attackers in response to different security measures. These gate DDoS flooding attacks instantly. Alturkistani et al. [126]
simulations can provide insights into the potential impact presented an approach for optimizing cybersecurity incident
of different attack scenarios, including the propagation of response decisions in SIEM systems using deep reinforcement
attacks, the exploitation of vulnerabilities, and the poten- learning (deep Q-learning). Hughes et al. [127] presented
tial consequences for the digital twin and its components. a deep reinforcement learning-based approach to facilitate
Generative AI is particularly useful when real-world data is the creation of different incident response policies. Bashendy
scarce or difficult to obtain to simulate different scenarios and et al. [128] conducted a survey on intrusion response systems
test the effectiveness of different security measures. This can for cyber–physical systems focusing on various architectures
16
I.H. Sarker, H. Janicke, A. Mohsin et al. ICT Express xxx (xxxx) xxx

and decision-making processes highlighting the recent ad- that allows organizations to collaborate and share infor-
vances using reinforcement learning algorithms (Q-learning, mation while keeping the data decentralized and private.
DQN, SARSA, DDPG, etc.). Overall, AI algorithms have For example, federated deep learning can be used for
the potential to monitor network traffic, system logs, and malware detection, where the goal is to identify and
other data sources to identify cyber incidents and trigger an block malicious software on multiple devices without
appropriate response, e.g., automatically block the attack and compromising the privacy of the users. However, feder-
notify security personnel. ated learning assumes that data from different parties is
similar in distribution and format, which might not be
5.8. Creating cyber awareness to users true always in the context of cybersecurity modeling due
to network topology, types of attacks, and security poli-
To create cyber awareness among users, understanding why cies. Thus cyber researchers need to focus on effectively
it happened is crucial. For this, identifying the root cause modeling federated learning or developing privacy-aware
of incidents, i.e., diagnostic analytics is needed to discover efficient techniques with their explainable capabilities to
in a digital twin environment. Diagnostic analytics typically handle heterogeneous data collected from diverse sources
answers the question “Why did it happen” through analyzing in DT.
past data, to gain insights into why things happened in the past • Data Generation and Annotation Issue: In a digital twin
and what actions can be taken to prevent similar issues from environment, it is essential to have enough data to test
occurring in the future. Thus identifying patterns, trends, and and validate the security of the system, which is chal-
correlations in data to determine the root cause of an incident lenging. Generative AI can be used to generate new data
might be helpful. Several data analytics and machine learning that mimics the characteristics of real-world data [35].
techniques such as association analysis, correlation analysis, In terms of attacks, Generative AI can be used to create
rule-based analysis, as well as statistical approaches to exam- new attack scenarios based on the existing vulnerabil-
ine data sets and identify factors [43] could play a key role in ities in the digital twin environment, which can help
this purpose. For instance, Steenwinckel et al. [129] present a organizations to better understand the potential risks and
method for adaptive anomaly detection and root cause analysis prioritize their security efforts. In addition, the lack of
on sensor data streams. This method combines expert knowl- labeled data is a significant challenge due to annotation
edge with machine learning techniques. Eckhart [130] et al. cost, human efforts, and time-consuming issues faced
presented a method for improving cyber situational awareness by researchers and practitioners in the field. Therefore,
in cyber–physical systems through the use of digital twins. an automated approach with good generalization and
Sarker et al. [50] present a machine learning-based intrusion decision-making capability is expected to solve this pri-
detection model that generates rules from decision trees ca- mary issue. Traditional semi-supervised solutions with a
pable of explaining the cause of anomalies. Thus, creating a certain amount of labeled data might not be effective due
cyber-aware culture among users accordingly could be one of to imbalance issues in cyber incident data. Thus the con-
the best practices to minimize the risk of cyber-attacks in the cept of active learning [133] dynamically selecting the
digital twin environment. most informative samples for labeling or self-supervised
learning [134] predicting a target variable from input data
6. Challenges and future prospects with potential to create a supervisory signal could be a possible solution
research directions in this context. Another promising research direction
Based on our extensive study, we identify several chal- in cybersecurity modeling for digital twins could be
lenges and research issues still open in the context of AI/XAI- transfer learning [119]. This involves using pre-trained
based cybersecurity modeling in DT environments. In this models on related tasks to improve the model perfor-
section, we summarize these challenges that need attention mance with limited data to transfer cyber knowledge
by the researchers and industry experts in this emerging area from other closely related domains such as network
of study as well as highlight the prospects with potential intrusion detection or malware classification. Researchers
directions. These are: can investigate the effectiveness of unsupervised learning
techniques [43] to cluster data and identify patterns and
• Data Heterogeneity and Privacy-Aware Self-Learning: anomalies without the need for labeled samples as well as
Digital twin environments can be heterogeneous and data augmentation techniques through generative AI such
complex in the real world [131]. Data from multiple as generative adversarial networks (GANs) or variational
sources such as network logs, system logs, user behavior autoencoders (VAEs) [35,135] depending on the nature
data, or other historical or real-time data, may need to of target application.
be integrated and analyzed. Both software and hardware- • Developing Smart Algorithms and Models: In many cases
based data collection processes can be used [20]. How- some traditional algorithms, mentioned in Section 4
ever, there may be concerns about sharing sensitive data, might not be effective due to the constantly evolving
which makes it difficult to solve using traditional cen- cyber threats, and new attack vectors are emerging all
tralized learning techniques. One possible solution could the time. This dynamic nature can lead to uncertainty
be federated learning [24,132], a decentralized approach in the model’s outcome. Scalable and smart algorithms
17
I.H. Sarker, H. Janicke, A. Mohsin et al. ICT Express xxx (xxxx) xxx

with their explainability analysis can help effectively used, e.g., transferring knowledge from related domains
and efficiently analyze security logs and events with like network traffic analysis, could be another possible
real-time monitoring and decision-making. Thus cyberse- domain depending on data availability.
curity researchers need to focus on designing innovative • Context-Awareness for Adaptive Cybersecurity: In cy-
algorithms and models to handle these issues, which bersecurity, context-aware decision-making involves an-
could be a promising research area and direction in alyzing the context of a potential threat or attack and
the context of today’s cybersecurity. Another direction making a decision based on that analysis. Thus it can be
could be model optimization and trustworthiness anal- considered a crucial aspect of AI-based cybersecurity as
ysis in machine learning [43], deep learning [35], rule it enables systems to make informed decisions based on
mining [11], generative AI [9], LLM [82] or other AI the relevant contextual information such as the spatio-
methods based cybersecurity modeling, discussed briefly temporal, environment, the user, the device, and other
in Section 4, as it determines the performance and accu- factors to decide on how to respond to a security event.
racy of the resultant cyber model in DT. Although several Context-aware decision-making is also highly human-
techniques such as trail error, grid search, and Bayesian interpretable and can help security experts understand
optimization exist, it is important to consider the trade- and trust the decisions made by the models. For instance,
offs between accuracy and false positives/negatives in it can allow a system to make a decision based on the
the context of cybersecurity modeling. For example, a current state of the network or the behavior of the user
model that has high accuracy but generates several false that may vary over time. For instance, context aware-
positives, might not be practical for real-world cyber ness can play a significant role in classifying software
usage in a DT environment. vulnerabilities [141], user behavior modeling [98], and
• Automatic Rule Generation and Security Policies: This so on. Thus developing context-awareness cybersecurity
involves data-driven approaches to generate rules and models that can behave according to the current contexts,
policies that trigger alerts or response actions when devi- could be a significant research direction in this domain.
ations from normal behavior are detected. The discovered
Researchers also need to explore new approaches to
patterns from the data collected from the DT environment
human–AI collaboration, where AI systems can work
and relevant features can be used to generate rules and
together with human experts to make context-aware de-
policies to detect any deviations from the normal system
cisions that are more effective than either system could
behavior that could indicate a potential cyber threat.
achieve alone.
The major advantages of data-driven approaches are cre-
• Enhancing Semantic Knowledge with Extracted Cyber
ating evidence-based rules according to data patterns,
Insights: The knowledge-driven system such as cyber-
adapting to new updates as well as reducing manual
security knowledge graph or ontology-based knowledge
efforts, discussed briefly in Sarker et al. [11], which is
representation can represent the complex knowledge of
very difficult to create and manage rules manually for
heterogeneous systems with the semantic capabilities
a large scale DT system. Existing techniques such as
association learning [76,98] may not be effective due to [142]. However, it would not be able to detect anomalies
producing redundant rules which may lead to inefficient since it fails to handle large amounts of raw data and
decision-making and computationally expensive. There- human experts lack the knowledge to manually con-
fore, developing scalable rule discovery algorithms and firm which patterns in the raw data might indicate po-
eventually making dynamic decisions accordingly could tential threats [129]. Thus a hybridization of seman-
be a significant direction in the context of DT research. tic knowledge representation techniques with machine-
• Handling Malicious Behavior Changes and Adapting learning and knowledge or rule mining methods [11]
Concept Drift in Cyberspace: In the real-world sce- could be useful in terms of automation, scalability, per-
nario in the DT context, concept drift may occur due to formance and interpretability in the context of large scale
changing behavioral patterns over time. Traditional AI cybersecurity systems. By analyzing data from security
algorithms may not be able to adapt to concept drift logs, incident reports, threat intelligence feeds, and other
in cyberspace in DT in real time, which can lead to sources, AI and machine learning algorithms [66] can au-
inaccurate predictions and false alarms. Thus develop- tomatically identify patterns, correlations, and anomalies
ing adaptive algorithms that can continually learn and that can be used to construct a comprehensive and dy-
adapt to the new types of attacks, could be a promising namic knowledge graph. For instance, NLP can be used
research direction in this context. Moreover, algorithms to extract information from unstructured data sources
that can automatically identify the most relevant fea- such as text-based logs and reports, and RL can be used
tures for detecting different types of attacks, could play to optimize the graph structure based on feedback from
a key role [136]. In addition, developing incremental SOC analysts. Thus designing ML-enhanced dynamic
learning [137], dynamic updated ensemble learning [138, knowledge graphs that can help security teams better un-
139], recent pattern-based mining [140] as well as their derstand their network and quickly respond to potential
hybridization could be a major direction in this con- threats of an organization, could be a significant research
text. Investigating how transfer learning [119] can be direction.
18
I.H. Sarker, H. Janicke, A. Mohsin et al. ICT Express xxx (xxxx) xxx

• AI Model Interpretability and Trustworthiness: Ensur- challenges, interdisciplinary collaboration and continu-
ing the interpretability and trustworthiness of AI mod- ous innovation are required to advance the state-of-the-
els is paramount for effective cybersecurity modeling art in AI-driven cybersecurity, enhancing the resilience
within digital twin systems. As digital twin systems be- and security of digital infrastructures.
come increasingly complex, understanding the decisions
that AI algorithms make becomes increasingly important In summary, our study has revealed several potential future
for cyber defense strategies. As an example, LLM has avenues for the study of cybersecurity in digital twins. First,
strong computing capabilities, but its black-box nature more research needs to be done on the characteristics of
makes it hard to explain the outcome [82]. Interpretabil- DT data, including related features, data distributions, and
ity thus plays an important role in allowing stakeholders pertinent contexts. Second, real-world evaluation of the scal-
to validate and trust AI-driven decisions. Achieving trust- ability and effectiveness of current analytics methodologies
worthiness involves not only verifying the accuracy of applied to DT data is required. Thirdly, innovative methods
AI predictions but also assessing their resilience to po- and algorithms handling the underlying issues are needed to
tential threats and vulnerabilities. In addition, ethical develop. Fourth, a range of empirical evaluations are necessary
and regulatory considerations must be addressed to en- to quantify the performance of these AI techniques and to
sure a responsible deployment of AI in digital twins. compare their efficacy and efficiency to those of currently used
Developing techniques to explain AI outputs, quanti- techniques. Fifth, additional effort is required to effectively de-
fying uncertainties, and integrating human feedback is ploy the ultimate models in a way that will achieve automation,
essential for accomplishing these goals. By prioritizing intelligence, and trustworthiness in the relevant application
research efforts towards enhancing interpretability and domains. Overall, the concerns with research and prospective
trustworthiness, cybersecurity modeling can leverage AI methods outlined above could help the community realize
capabilities while maintaining transparency, reliability, the full potential of AI/XAI-based cyber modeling in the
and adherence to ethical standards, thus strengthening the digital twin environment. It will require continual research and
resilience of digital twin systems against evolving cyber development, as well as collaboration between cybersecurity
threats. professionals, AI specialists, and DT experts, to address the
• Adversarial Attacks: In the context of digital twin en- issues and capitalize on the potential provided by AI/XAI for
vironments, adversarial attacks pose a significant threat next-generation cybersecurity in a digital twin environment.
to the integrity and reliability of interconnected sys-
7. Discussion
tems. By carefully crafted perturbations into input data,
these attacks exploit vulnerabilities in AI-driven models, The above study and literature review assessed that meth-
which leads to incorrect or compromised decisions [45, ods based on AI/XAI have the potential to make significant
46]. As digital twins become more interconnected and advancements in a variety of application areas in the context
data exchange occurs more frequently, adversarial at- of cybersecurity in the digital twin environment. The growing
tacks are more likely to disrupt critical operations and complexity of cybersecurity threats in DT and the increasing
compromise sensitive data. To address this issue, robust use of AI and data-driven technologies for security tasks
defense mechanisms are needed, including adversarial have made it essential to develop transparent and interpretable
training, anomaly detection, and model verification tech- models that can help analysts better understand the security
niques adapted to the unique characteristics of digital landscape and make more informed decisions [9]. Leveraging
twin ecosystems. Furthermore, cybersecurity profession- machine learning algorithms and other AI technologies dis-
als and stakeholders need to foster awareness and un- cussed in Section 4, offers several benefits, including proactive
derstanding of adversarial threats to mitigate risks and threat detection, improved resilience as well as interpretability
maintain the resilience of digital twin infrastructures. analysis in the context of cybersecurity in the digital twin.
• Potential Framework Design: The most crucial task for Furthermore, XAI methods can support analysts and security
creating an AI-based cybersecurity system is to establish professionals in comprehending how the system functions,
a solid foundation that supports automation, intelligence, identifying potential vulnerabilities, and ultimately leading to
and trustworthy decision-making. A well-designed AI the development of trustworthy cyber systems with intelligent
framework for security modeling and experimental eval- decision-making.
uation with DT data is both a very significant direction The integration of XAI into cybersecurity modeling in a
and a challenging problem. To do this, sophisticated digital twin environment can provide a better understanding of
algorithms need to be developed that can detect and the behavior of the system and the potential threats it may face.
mitigate cyber threats autonomously, taking advantage One of the key advantages of using digital twin-based XAI
of machine learning techniques and natural language models for cybersecurity is that they can provide a comprehen-
processing to analyze huge amounts of data generated sive view of the security landscape answering the questions -
by digital twins. A rigorous experimental evaluation, “How does DT enhance cybersecurity resilience using AI?”
including diverse datasets, simulated attack scenarios, and “How AI can help to mitigate the possible threats and
and real-world testing, is needed to ensure the reliability anomalies in DT”, discussed in Section 3. By simulating
and effectiveness of such systems. To overcome these different scenarios and analyzing the behavior of the system
19
I.H. Sarker, H. Janicke, A. Mohsin et al. ICT Express xxx (xxxx) xxx

under different conditions, it becomes possible to identify analysts. Finally, several key challenges and prospects have
potential vulnerabilities and threats that might be missed by been identified and discussed based on our study that may aid
human analysts or other approaches. This can help analysts the community in understanding and realizing the full potential
develop more effective security strategies and prioritize their of AI-based cyber modeling in this emerging area of study. We
resources more efficiently. While there have been significant believe our study and in-depth analysis from the perspective of
advances in AI research in recent years [18], AI/XAI-based automation, intelligence, and trustworthiness might serve as a
cyber modeling still faces many issues including available reference guide and foundation for researchers and industry
data and modeling algorithms, summarized and discussed in professionals, as well as policy makers, and provide a roadmap
Section 6. Furthermore, making the AI-based cyber model for the next-generation cybersecurity applications.
explainable and obtaining the human-level accuracy of such
systems is challenging and demanding for both researchers and CRediT authorship contribution statement
practitioners. As XAI can build alternative systems, models,
and algorithms with human-understandable capabilities, it is Iqbal H. Sarker: Writing – review & editing, Writing –
also challenging to decide which XAI methods could be useful original draft, Methodology, Formal analysis, Visualization,
to tackle a certain problem in DT. Typically, AI models depend Conceptualization. Helge Janicke: Writing – review & edit-
on several factors, such as the nature of the problem, the ing, Adviser. Ahmad Mohsin: Writing – review & editing.
available data, the computational resources, the interpretability Asif Gill: Writing – review & editing. Leandros Maglaras:
requirements, and the specific project goals. Thus our AI/XAI Writing – review & editing.
taxonomy analysis discussed in Section 4 could be a potential
source and guidelines to support the researchers and practi- Declaration of competing interest
tioners in this emerging area of study. There is still much
work to be done to develop techniques that can provide reliable The authors declare no conflict of interests.
and understandable explanations of complex AI, ML, LLM or
other black-box models for their effective and trustable use in Acknowledgments
real-world application areas.
“The work has been supported by the Cyber Security Re-
Overall, AI and XAI have become major cyber industry
search Centre Limited whose activities are partially funded
concerns in DT. The future of almost all contexts and hu-
by the Australian Government’s Cooperative Research Centres
manity including future social context, safety and security,
Program”.
and eventually the quality of human life will be impacted by
these emerging technologies as they continue to grow. Thus,
AI/XAI-based modeling can substantially progress and open References
up new horizons to advance the cyberspace in DT, and even- [1] B.R. Barricelli, E. Casiraghi, D. Fogli, A survey on digital twin:
tually can lead to the next-generation cybersecurity systems in Definitions, characteristics, applications, and design implications,
a digital twin environment. IEEE Access 7 (2019) 167653–167671.
[2] C. Alcaraz, J. Lopez, Digital twin: A comprehensive survey of
security threats, IEEE Commun. Surv. Tutor. (2022).
8. Conclusion
[3] G. Mylonas, A. Kalogeras, G. Kalogeras, C. Anagnostopoulos, C.
Motivated by the need for cybersecurity automation, intel- Alexakos, L. Muñoz, Digital twins from smart manufacturing to smart
cities: A survey, IEEE Access 9 (2021) 143222–143249.
ligence, and trustworthiness, this article provided an extensive
[4] S.P. Ramu, P. Boopalan, Q.-V. Pham, P.K.R. Maddikunta, T. Huynh-
study and synthesis on AI/XAI-based modeling in DT. The The, M. Alazab, T.T. Nguyen, T.R. Gadekallu, Federated learning
study began with formulating key questions accordingly and enabled digital twins for smart cities: Concepts, recent advances, and
how these methods can be employed to resolve various real- future directions, Sustainable Cities Soc. 79 (2022) 103663.
world cyber issues in digital twin environments. Next how [5] B. Sousa, M. Arieiro, V. Pereira, J. Correia, N. Lourenço, T. Cruz,
it can enhance cyber resilience as well as security in dif- ELEGANT: Security of critical infrastructures with digital twins,
ferent layers of digital twin are highlighted to go forward IEEE Access 9 (2021) 107574–107588.
[6] H. Elayan, M. Aloqaily, M. Guizani, Digital twin for intelligent
with AI-based modeling. We then provided a taxonomy with
context-aware IoT healthcare systems, IEEE Internet Things J. 8 (23)
a thorough study of recent advances in AI and XAI-based (2021) 16749–16757.
methods with their potential usability in the context of cy- [7] W. Purcell, T. Neubauer, Digital twins in agriculture: A
bersecurity. Several use cases such as predictive maintenance, state-of-the-art review, Smart Agric. Technol. (2022) 100094.
intrusion detection, access control, cyber awareness gener- [8] A.K. Sleiti, J.S. Kapat, L. Vesely, Digital twin in energy industry:
ation, etc. were highlighted to inspire and provide a clear Proposed robust digital twin for power plant and other complex
picture and understanding of the potentiality of AI/XAI-based capital-intensive large engineering systems, Energy Rep. 8 (2022)
3704–3726.
cybersecurity modeling in DT. Hence, AI is the key element
[9] I.H. Sarker, AI-Driven Cybersecurity and Threat Intelligence: Cy-
of cybersecurity enhancement that enables systems to carry ber Automation, Intelligent Decision-Making and Explainability,
out activities automatically and intelligently, whereas XAI pro- Springer, 2024.
vides a collection of processes that can produce explanations [10] N. Kaloudi, J. Li, The ai-based cyber threat landscape: A survey,
from different perspectives that are understandable by human ACM Comput. Surv. 53 (1) (2020) 1–34.
20
I.H. Sarker, H. Janicke, A. Mohsin et al. ICT Express xxx (xxxx) xxx

[11] I.H. Sarker, H. Janicke, M.A. Ferrag, A. Abuadbba, Multi-aspect [30] W. Saeed, C. Omlin, Explainable ai (xai): A systematic meta-survey
rule-based AI: Methods, taxonomy, challenges and directions toward of current challenges and future opportunities, Knowl.-Based Syst.
automation, intelligence and transparent cybersecurity modeling for (2023) 110273.
critical infrastructures, Internet Things (2024) 101110. [31] I.H. Sarker, Multi-aspects AI-based modeling and adversarial learn-
[12] A. Adadi, M. Berrada, Peeking inside the black-box: a survey ing for cybersecurity intelligence and robustness: A comprehensive
on explainable artificial intelligence (XAI), IEEE Access 6 (2018) overview, Secur. Privacy (2022) e295.
52138–52160. [32] E. Bout, V. Loscri, A. Gallais, How machine learning changes the
[13] R. Ibrahim, M.O. Shafiq, Explainable convolutional neural networks: nature of cyberattacks on IoT networks: A survey, IEEE Commun.
A taxonomy, review, and future directions, ACM Comput. Surv. 55 Surv. Tutor. 24 (1) (2021) 248–279.
(10) (2023) 1–37. [33] R. Faleiro, L. Pan, S.R. Pokhrel, R. Doss, Digital twin for cy-
[14] R. Guidotti, A. Monreale, S. Ruggieri, F. Turini, F. Giannotti, D. bersecurity: Towards enhancing cyber resilience, in: Broadband
Pedreschi, A survey of methods for explaining black box models, Communications, Networks, and Systems: 12th EAI International
ACM Comput. Surv. (CSUR) 51 (5) (2018) 1–42. Conference, BROADNETS 2021, Virtual Event, October 28–29,
2021, Proceedings 12, Springer, 2022, pp. 57–76.
[15] R. Dwivedi, D. Dave, H. Naik, S. Singhal, R. Omer, P. Patel, B.
[34] D. Holmes, M. Papathanasaki, L. Maglaras, M.A. Ferrag, S. Nepal,
Qian, Z. Wen, T. Shah, G. Morgan, et al., Explainable AI (XAI):
H. Janicke, Digital twins and cyber security–solution or chal-
Core ideas, techniques, and solutions, ACM Comput. Surv. 55 (9)
lenge? in: 2021 6th South-East Europe Design Automation, Computer
(2023) 1–33.
Engineering, Computer Networks and Social Media Conference,
[16] N. Capuano, G. Fenza, V. Loia, C. Stanzione, Explainable artificial
SEEDA-CECNSM, IEEE, 2021, pp. 1–8.
intelligence in CyberSecurity: A survey, IEEE Access 10 (2022)
[35] I.H. Sarker, Deep learning: a comprehensive overview on techniques,
93575–93600.
taxonomy, applications and research directions, SN Comput. Sci. 2
[17] D. Wagg, K. Worden, R. Barthorpe, P. Gardner, Digital twins:
(6) (2021) 420.
state-of-the-art and future directions for modeling and simulation in [36] I.H. Sarker, CyberLearning: Effectiveness analysis of machine learn-
engineering dynamics applications, ASCE-ASME J. Risk Uncertain. ing security modeling to detect cyber-anomalies and multi-attacks,
Engrg. Syst. B Mech. Engrg. 6 (3) (2020). Internet Things 14 (2021) 100393.
[18] I.H. Sarker, Ai-based modeling: Techniques, applications and research [37] G. Apruzzese, P. Laskov, E. Montes de Oca, W. Mallouli, L.
issues towards automation, intelligent and smart systems, SN Comput. Brdalo Rapa, A.V. Grammatopoulos, F. Di Franco, The role of
Sci. 3 (2) (2022) 158. machine learning in cybersecurity, Digit. Threat.: Res. Pract. 4 (1)
[19] M.M. Rathore, S.A. Shah, D. Shukla, E. Bentafat, S. Bakiras, The (2023) 1–38.
role of ai, machine learning, and big data in digital twinning: [38] F. Tao, H. Zhang, A. Liu, A.Y. Nee, Digital twin in industry:
A systematic literature review, challenges, and opportunities, IEEE State-of-the-art, IEEE Trans. Ind. Inform. 15 (4) (2018) 2405–2415.
Access 9 (2021) 32030–32052. [39] Z. Zhang, H. Al Hamadi, E. Damiani, C.Y. Yeun, F. Taher,
[20] Y. Hu, W. Kuang, Z. Qin, K. Li, J. Zhang, Y. Gao, W. Li, K. Li, Explainable artificial intelligence applications in cyber security:
Artificial intelligence security: Threats and countermeasures, ACM State-of-the-art in research, IEEE Access (2022).
Comput. Surv. 55 (1) (2021) 1–36. [40] A. Humayed, J. Lin, F. Li, B. Luo, Cyber-physical systems
[21] D. Kaur, S. Uslu, K.J. Rittichier, A. Durresi, Trustworthy artificial security—A survey, IEEE Internet Things J. 4 (6) (2017) 1802–1831.
intelligence: a review, ACM Comput. Surv. 55 (2) (2022) 1–38. [41] I.H. Sarker, A.I. Khan, Y.B. Abushark, F. Alsolami, Internet of
[22] M. Kuzlu, C. Fair, O. Guler, Role of artificial intelligence in the Things (iot) security intelligence: a comprehensive overview, machine
Internet of Things (IoT) cybersecurity, Discov. Internet Things 1 learning solutions and research directions, Mob. Netw. Appl. (2022)
(2021) 1–14. 1–17.
[23] S. Samtani, M. Kantarcioglu, H. Chen, Trailblazing the artificial [42] S. Kim, K.-J. Park, C. Lu, A survey on network security for cyber–
intelligence for cybersecurity discipline: a multi-disciplinary research physical systems: From threats to resilient design, IEEE Commun.
roadmap, ACM Trans. Manag. Inf. Syst. (TMIS) 11 (4) (2020) 1–19. Surv. Tutor. 24 (3) (2022) 1534–1573.
[43] I.H. Sarker, Machine learning for intelligent data analysis and
[24] M. Alazab, S.P. RM, M. Parimala, P.K.R. Maddikunta, T.R.
automation in cybersecurity: current and future prospects, Ann. Data
Gadekallu, Q.-V. Pham, Federated learning for cybersecurity: con-
Sci. (2022) 1–26.
cepts, challenges, and future directions, IEEE Trans. Ind. Inform. 18
[44] A. Halbouni, T.S. Gunawan, M.H. Habaebi, M. Halbouni, M. Kartiwi,
(5) (2021) 3501–3509.
R. Ahmad, Machine learning and deep learning approaches for
[25] A.B. Arrieta, N. Díaz-Rodríguez, J. Del Ser, A. Bennetot, S. Tabik,
cybersecuriy: A review, IEEE Access (2022).
A. Barbado, S. García, S. Gil-López, D. Molina, R. Benjamins, et
[45] I. Rosenberg, A. Shabtai, Y. Elovici, L. Rokach, Adversarial machine
al., Explainable Artificial Intelligence (XAI): Concepts, taxonomies,
learning attacks and defense methods in the cyber security domain,
opportunities and challenges toward responsible AI, Inf. Fusion 58
ACM Comput. Surv. 54 (5) (2021) 1–36.
(2020) 82–115.
[46] K. He, D.D. Kim, M.R. Asghar, Adversarial machine learning for
[26] M. SEALE, Explainable intrusion detection systems (X-IDS): A network intrusion detection systems: A comprehensive survey, IEEE
survey of current methods, challenges, and opportunities, IEEE Commun. Surv. Tutor. (2023).
Access (2022). [47] S. Yan, J. Ren, W. Wang, L. Sun, W. Zhang, Q. Yu, A survey of
[27] A. Rawal, J. McCoy, D.B. Rawat, B.M. Sadler, R.S. Amant, Recent adversarial attack and defense methods for malware classification in
advances in trustworthy explainable artificial intelligence: Status, cyber security, IEEE Commun. Surv. Tutor. (2022).
challenges, and perspectives, IEEE Trans. Artif. Intell. 3 (6) (2021) [48] E. Zhu, Y. Ju, Z. Chen, F. Liu, X. Fang, DTOF-ANN: an artificial
852–866. neural network phishing detection model based on decision tree and
[28] F. Charmet, H.C. Tanuwidjaja, S. Ayoubi, P.-F. Gimenez, Y. Han, optimal features, Appl. Soft Comput. 95 (2020) 106505.
H. Jmila, G. Blanc, T. Takahashi, Z. Zhang, Explainable artificial [49] Y. Chai, Y. Zhou, W. Li, Y. Jiang, An explainable multi-modal hier-
intelligence for cybersecurity: a literature survey, Ann. Telecommun. archical attention model for developing phishing threat intelligence,
(2022) 1–24. IEEE Trans. Dependable Secure Comput. 19 (2) (2021) 790–803.
[29] I. Ahmed, G. Jeon, F. Piccialli, From artificial intelligence to [50] I.H. Sarker, Y.B. Abushark, F. Alsolami, A.I. Khan, Intrudtree: a
explainable artificial intelligence in industry 4.0: a survey on what, machine learning based cyber security intrusion detection model,
how, and where, IEEE Trans. Ind. Inform. 18 (8) (2022) 5031–5042. Symmetry 12 (5) (2020) 754.
21
I.H. Sarker, H. Janicke, A. Mohsin et al. ICT Express xxx (xxxx) xxx

[51] M. Wang, K. Zheng, Y. Yang, X. Wang, An explainable machine [72] Z. Lv, Y. Li, H. Feng, H. Lv, Deep learning for security in digital
learning framework for intrusion detection systems, IEEE Access 8 twins of cooperative intelligent transportation systems, IEEE Trans.
(2020) 73127–73141. Intell. Transp. Syst. 23 (9) (2021) 16666–16675.
[52] I. Psychoula, A. Gutmann, P. Mainali, S.H. Lee, P. Dunphy, F. Pe- [73] Y. Luo, Y. Xiao, L. Cheng, G. Peng, D. Yao, Deep learning-
titcolas, Explainable machine learning for fraud detection, Computer based anomaly detection in cyber-physical systems: Progress and
54 (10) (2021) 49–59. opportunities, ACM Comput. Surv. 54 (5) (2021) 1–36.
[53] A. Barbado, Ó. Corcho, R. Benjamins, Rule extraction in unsu- [74] W. Danilczyk, Y.L. Sun, H. He, Smart grid anomaly detection using
pervised anomaly detection for model explainability: Application to a deep learning digital twin, in: 2020 52nd North American Power
OneClass SVM, Expert Syst. Appl. 189 (2022) 116100. Symposium, NAPS, IEEE, 2021, pp. 1–6.
[54] T. Dias, N. Oliveira, N. Sousa, I. Praça, O. Sousa, A hybrid approach [75] H. HaddadPajouh, A. Dehghantanha, R. Khayami, K.-K.R. Choo,
for an interpretable and explainable intrusion detection system, in: A deep recurrent neural network based approach for internet of
Intelligent Systems Design and Applications: 21st International Con- things malware threat hunting, Future Gener. Comput. Syst. 85 (2018)
ference on Intelligent Systems Design and Applications, ISDA 2021 88–96.
Held During December 13–15, 2021, Springer, 2022, pp. 1035–1045. [76] R. Agrawal, R. Srikant, Fast algorithms for mining association rules,
[55] Z. Pan, J. Sheldon, P. Mishra, Hardware-assisted malware detection
in: Proceedings of the 20th International Conference on Very Large
and localization using explainable machine learning, IEEE Trans.
Data Bases, VLDB, Vol. 1215, 1994, pp. 487–499.
Comput. 71 (12) (2022) 3308–3321.
[77] J.R. Quinlan, C4.5: Programs for machine learning, Mach. Learn.
[56] Y. Lin, R. Liu, D.M. Divakaran, J.Y. Ng, Q.Z. Chan, Y. Lu,
(1993).
Y. Si, F. Zhang, J.S. Dong, Phishpedia: A hybrid deep learning
[78] M. Hasanipanah, H. Bakhshandeh Amnieh, A fuzzy rule-based
based approach to visually identify phishing webpages, in: USENIX
approach to address uncertainty in risk assessment and prediction
Security Symposium, 2021, pp. 3793–3810.
of blast-induced flyrock in a quarry, Nat. Resour. Res. 29 (2020)
[57] B. Wu, S. Chen, C. Gao, L. Fan, Y. Liu, W. Wen, M.R. Lyu, Why an
669–689.
android app is classified as malware: Toward malware classification
interpretation, ACM Trans. Softw. Eng. Methodol. (TOSEM) 30 (2) [79] M. Alali, A. Almogren, M.M. Hassan, I.A. Rassan, M.Z.A. Bhuiyan,
(2021) 1–29. Improving risk assessment model of cyber security using fuzzy logic
[58] G. Iadarola, F. Martinelli, F. Mercaldo, A. Santone, Towards an inference system, Comput. Secur. 74 (2018) 323–339.
interpretable deep learning model for mobile malware detection and [80] Z.-J. Zhou, G.-Y. Hu, C.-H. Hu, C.-L. Wen, L.-L. Chang, A survey
family identification, Comput. Secur. 105 (2021) 102198. of belief rule-base expert system, IEEE Trans. Syst. Man Cybern.:
[59] F. Ullah, H. Naeem, S. Jabbar, S. Khalid, M.A. Latif, F. Al-Turjman, Syst. 51 (8) (2019) 4944–4958.
L. Mostarda, Cyber security threats detection in internet of things [81] R. Ul Islam, M.S. Hossain, K. Andersson, A novel anomaly detection
using deep learning approach, IEEE Access 7 (2019) 124379–124389. algorithm for sensor data under uncertainty, Soft Comput. 22 (5)
[60] C. Joshi, R.K. Ranjan, V. Bharti, A fuzzy logic based feature (2018) 1623–1639.
engineering approach for botnet detection using ANN, J. King Saud [82] I.H. Sarker, LLM potentiality and awareness: A position paper from
Univ.-Comput. Inf. Sci. 34 (9) (2022) 6872–6882. the perspective of trustworthy and responsible AI modeling, 2024,
[61] P.P. Kundu, T. Truong-Huu, L. Chen, L. Zhou, S.G. Teo, Detection Authorea Preprints.
and classification of botnet traffic using deep learning with model [83] R. Sharma, R. Sibal, S. Sabharwal, Software vulnerability prioritiza-
explanation, IEEE Trans. Dependable Secure Comput. (2022). tion using vulnerability description, Int. J. Syst. Assur. Eng. Manag.
[62] I. Dimitriadis, K. Georgiou, A. Vakali, Social botomics: A systematic 12 (2021) 58–64.
ensemble ml approach for explainable and multi-class bot detection, [84] J.S. Garrido, D. Dold, J. Frank, Machine learning on knowledge
Appl. Sci. 11 (21) (2021) 9857. graphs for context-aware security monitoring, in: 2021 IEEE Inter-
[63] C.S. Wickramasinghe, K. Amarasinghe, D.L. Marino, C. Rieger, M. national Conference on Cyber Security and Resilience, CSR, IEEE,
Manic, Explainable unsupervised machine learning for cyber-physical 2021, pp. 55–60.
systems, IEEE Access 9 (2021) 131824–131843. [85] A. Piplai, S. Mittal, A. Joshi, T. Finin, J. Holt, R. Zak, Creating
[64] K. Shaukat, S. Luo, V. Varadharajan, I.A. Hameed, M. Xu, A survey cybersecurity knowledge graphs from malware after action reports,
on machine learning techniques for cyber security in the last decade, IEEE Access 8 (2020) 211691–211703.
IEEE Access 8 (2020) 222310–222354. [86] S. Wang, J. Wan, D. Li, C. Liu, Knowledge reasoning with semantic
[65] Y. Xin, L. Kong, Z. Liu, Y. Chen, Y. Li, H. Zhu, M. Gao, H. Hou, C.
data for real-time data processing in smart factory, Sensors 18 (2)
Wang, Machine learning and deep learning methods for cybersecurity,
(2018) 471.
IEEE Access 6 (2018) 35365–35381.
[87] M. Abdar, F. Pourpanah, S. Hussain, D. Rezazadegan, L. Liu, M.
[66] I.H. Sarker, Machine learning: Algorithms, real-world applications
Ghavamzadeh, P. Fieguth, X. Cao, A. Khosravi, U.R. Acharya, et al.,
and research directions, SN Comput. Sci. 2 (3) (2021) 160.
A review of uncertainty quantification in deep learning: Techniques,
[67] M. Cui, J. Wang, M. Yue, Machine learning-based anomaly detection
applications and challenges, Inf. Fusion 76 (2021) 243–297.
for load forecasting under cyberattacks, IEEE Trans. Smart Grid 10
[88] J. Gawlikowski, C.R.N. Tassi, M. Ali, J. Lee, M. Humt, J. Feng,
(5) (2019) 5724–5734.
[68] M.A. Bouke, A. Abdullah, S.H. ALshatebi, M.T. Abdullah, E2IDS: A. Kruspe, R. Triebel, P. Jung, R. Roscher, et al., A survey of
An enhanced intelligent intrusion detection system based on decision uncertainty in deep neural networks, Artif. Intell. Rev. 56 (Suppl
tree algorithm, J. Appl. Artif. Intell. 3 (1) (2022) 1–16. 1) (2023) 1513–1589.
[69] R. Heartfield, G. Loukas, A. Bezemskij, E. Panaousis, Self- [89] J. Zhang, J. Yin, R. Wang, Basic framework and main methods of
configurable cyber-physical intrusion detection for smart homes using uncertainty quantification, Math. Probl. Eng. 2020 (2020) 1–18.
reinforcement learning, IEEE Trans. Inf. Forensics Secur. 16 (2020) [90] M. Liggins II, D. Hall, J. Llinas, Handbook of Multisensor Data
1720–1735. Fusion: Theory and Practice, CRC Press, 2017.
[70] J. Liang, Z. Qin, S. Xiao, L. Ou, X. Lin, Efficient and secure decision [91] Z.H. Qaisar, R. Li, Multimodal information fusion for android mal-
tree classification for cloud-assisted online diagnosis services, IEEE ware detection using lazy learning, Multimedia Tools Appl. (2022)
Trans. Dependable Secure Comput. 18 (4) (2019) 1632–1644. 1–15.
[71] M.R.C. Acosta, S. Ahmed, C.E. Garcia, I. Koo, Extremely random- [92] S. Dey, Q. Ye, S. Sampalli, A machine learning based intrusion detec-
ized trees-based scheme for stealthy cyber-attack detection in smart tion scheme for data fusion in mobile clouds involving heterogeneous
grid networks, IEEE Access 8 (2020) 19921–19933. client networks, Inf. Fusion 49 (2019) 205–215.
22
I.H. Sarker, H. Janicke, A. Mohsin et al. ICT Express xxx (xxxx) xxx

[93] M.J. Kaur, V.P. Mishra, P. Maheshwari, The convergence of digital machine-learning techniques, IEEE Internet Things J. 8 (5) (2020)
twin, IoT, and machine learning: transforming data into action, Digit. 3242–3254.
Twin Technol. Smart Cities (2020) 3–17. [113] G. Vallathan, A. John, C. Thirumalai, S. Mohan, G. Srivastava,
[94] S. Hariharan, R. Rejimol Robinson, R.R. Prasad, C. Thomas, N. J.C.-W. Lin, Suspicious activity detection using deep learning in
Balakrishnan, XAI for intrusion detection system: comparing expla- secure assisted living IoT environments, J. Supercomput. 77 (2021)
nations based on global and local scope, J. Comput. Virol. Hack. 3242–3260.
Tech. (2022) 1–23. [114] S. Garg, K. Kaur, N. Kumar, J.J. Rodrigues, Hybrid deep-learning-
[95] D. Szafron, B. Poulin, R. Eisner, P. Lu, R. Greiner, D. Wishart, based anomaly detection scheme for suspicious flow detection in
A. Fyshe, B. Pearcy, C. Macdonell, J. Anvik, Visual explanation SDN: A social multimedia perspective, IEEE Trans. Multimed. 21
of evidence in additive classifiers, in: Proceedings of Innovative (3) (2019) 566–578.
Applications of Artificial Intelligence, Vol. 2, 2006. [115] K. Vidović, I. Tomičić, K. Slovenec, M. Mikuc, I. Brajdić, Ranking
[96] H. Chen, X. Chen, S. Shi, Y. Zhang, Generate natural language network devices for alarm prioritisation: Intrusion detection case
explanations for recommendation, 2021, arXiv preprint arXiv:2101 study, in: 2021 International Conference on Software, Telecom-
.03392. munications and Computer Networks, SoftCOM, IEEE, 2021, pp.
[97] H. Liu, Q. Yin, W.Y. Wang, Towards explainable NLP: A generative 1–5.
explanation framework for text classification, 2018, arXiv preprint a [116] Q. Yan, M. Wang, W. Huang, X. Luo, F.R. Yu, Automatically
rXiv:1811.00196. synthesizing DoS attack traces using generative adversarial networks,
[98] I. Sarker, A. Colman, J. Han, P. Watters, Context-Aware Machine Int. J. Mach. Learn. Cybern. 10 (12) (2019) 3387–3396.
Learning and Mobile Data Analytics: Automated Rule-Based Services [117] S. Mouti, S.K. Shukla, S. Althubiti, M.A. Ahmed, F. Alenezi,
with Intelligent Decision-Making, Springer, 2021. M. Arumugam, Cyber security risk management with attack detec-
[99] R. Langone, A. Cuzzocrea, N. Skantzos, Interpretable anomaly tion frameworks using multi connect variational auto-encoder with
prediction: Predicting anomalous behavior in industry 4.0 settings via probabilistic Bayesian networks, Comput. Electr. Eng. 103 (2022)
regularized logistic regression tools, Data Knowl. Eng. 130 (2020) 108308.
101850. [118] M. Ibrahim, R. Elhafiz, Modeling an intrusion detection using
[100] N. Mehdiyev, P. Fettke, Explainable artificial intelligence for process recurrent neural networks, J. Eng. Res. 11 (1) (2023) 100013.
mining: A general overview and application of a novel local expla- [119] J. Yin, M. Tang, J. Cao, H. Wang, Apply transfer learning to cy-
nation approach for predictive process monitoring, Interpret. Artif. bersecurity: Predicting exploitability of vulnerabilities by description,
Intell.: A Perspect. Granul. Comput. (2021) 1–28. Knowl.-Based Syst. 210 (2020) 106529.
[101] S.S.S. Sindhu, S. Geetha, A. Kannan, Decision tree based light weight [120] I. Zografopoulos, J. Ospina, X. Liu, C. Konstantinou, Cyber-physical
intrusion detection using a wrapper approach, Expert Syst. Appl. 39 energy systems security: Threat modeling, risk assessment, resources,
(1) (2012) 129–141. metrics, and case studies, IEEE Access 9 (2021) 29775–29818.
[121] M. Dietz, M. Vielberth, G. Pernul, Integrating digital twin security
[102] I.H. Sarker, Data science and analytics: an overview from data-driven
simulations in the security operations center, in: Proceedings of
smart computing, decision-making and applications perspective, SN
the 15th International Conference on Availability, Reliability and
Comput. Sci. 2 (5) (2021) 377.
Security, 2020, pp. 1–9.
[103] G. Baryannis, S. Dani, G. Antoniou, Predicting supply chain risks
[122] C. Gehrmann, M. Gunnarsson, A digital twin based industrial
using machine learning: The trade-off between performance and
automation and control system security architecture, IEEE Trans. Ind.
interpretability, Future Gener. Comput. Syst. 101 (2019) 993–1004.
Inform. 16 (1) (2019) 669–680.
[104] A. Okutan, S.J. Yang, K. McConky, Predicting cyber attacks with
[123] J. Heaps, R. Krishnan, Y. Huang, J. Niu, R. Sandhu, Access control
bayesian networks using unconventional signals, in: Proceedings of
policy generation from user stories using machine learning, in: Data
the 12th Annual Conference on Cyber and Information Security
and Applications Security and Privacy XXXV: 35th Annual IFIP WG
Research, 2017, pp. 1–4.
11.3 Conference, DBSec 2021, Calgary, Canada, July 19–20, 2021,
[105] X. Fang, M. Xu, S. Xu, P. Zhao, A deep learning framework for Proceedings 35, Springer, 2021, pp. 171–188.
predicting cyber attacks rates, EURASIP J. Inf. Secur. 2019 (2019)
[124] M.N. Nobi, M. Gupta, L. Praharaj, M. Abdelsalam, R. Krishnan, R.
1–11.
Sandhu, Machine learning in access control: A taxonomy and survey,
[106] A. Castellani, S. Schmitt, S. Squartini, Real-world anomaly detection 2022, arXiv preprint arXiv:2207.01739.
by using digital twin systems and weakly supervised learning, IEEE
[125] Y. Liu, M. Dong, K. Ota, J. Li, J. Wu, Deep reinforcement
Trans. Ind. Inform. 17 (7) (2020) 4733–4742.
learning based smart mitigation of ddos flooding in software-defined
[107] E.C. Balta, M. Pease, J. Moyne, K. Barton, D.M. Tilbury, Digi- networks, in: 2018 IEEE 23rd International Workshop on Computer
tal twin-based cyber-attack detection framework for cyber-physical Aided Modeling and Design of Communication Links and Networks,
manufacturing systems, IEEE Trans. Autom. Sci. Eng. (2023). CAMAD, IEEE, 2018, pp. 1–6.
[108] Q. Xu, S. Ali, T. Yue, Digital twin-based anomaly detection in [126] H. Alturkistani, M.A. El-Affendi, Optimizing cybersecurity incident
cyber-physical systems, in: 2021 14th IEEE Conference on Software response decisions using deep reinforcement learning, Int. J. Electr.
Testing, Verification and Validation, ICST, IEEE, 2021, pp. 205–216. Comput. Eng. 12 (6) (2022) 6768.
[109] O.K. Sahingoz, E. Buber, O. Demir, B. Diri, Machine learning [127] K. Hughes, K. McLaughlin, S. Sezer, Policy-based profiles for
based phishing detection from URLs, Expert Syst. Appl. 117 (2019) network intrusion response systems, in: 2022 IEEE International
345–357. Conference on Cyber Security and Resilience, CSR, IEEE, 2022,
[110] J. Qiu, J. Zhang, W. Luo, L. Pan, S. Nepal, Y. Xiang, A survey of pp. 279–286.
android malware detection with deep neural models, ACM Comput. [128] M. Bashendy, A. Tantawy, A. Erradi, Intrusion response systems
Surv. 53 (6) (2020) 1–36. for cyber-physical systems: A comprehensive survey, Comput. Secur.
[111] G. Kocher, G. Kumar, Machine learning and deep learning methods (2022) 102984.
for intrusion detection systems: recent developments and challenges, [129] B. Steenwinckel, D. De Paepe, S.V. Hautte, P. Heyvaert, M. Bentefrit,
Soft Comput. 25 (15) (2021) 9731–9763. P. Moens, A. Dimou, B. Van Den Bossche, F. De Turck, S.
[112] M. Shafiq, Z. Tian, A.K. Bashir, X. Du, M. Guizani, Corrauc: a Van Hoecke, et al., FLAGS: A methodology for adaptive anomaly
malicious bot-IoT traffic detection method in IoT network using detection and root cause analysis on sensor data streams by fusing
23
I.H. Sarker, H. Janicke, A. Mohsin et al. ICT Express xxx (xxxx) xxx

expert knowledge with machine learning, Future Gener. Comput. Press, etc. Moreover, he is a lead author of the books “Context-Aware
Syst. 116 (2021) 30–48. Machine Learning and Mobile Data Analytics”, and “AI-driven Cyberse-
[130] M. Eckhart, A. Ekelhart, E. Weippl, Enhancing cyber situational curity and Threat Intelligence”, published by Springer Nature, Switzerland.
awareness for cyber-physical systems through digital twins, in: 2019 He has also been listed in the world’s top 2% of most-cited scientists,
24th IEEE International Conference on Emerging Technologies and published by Elsevier & Stanford University, USA. In addition to research
Factory Automation, ETFA, IEEE, 2019, pp. 1222–1225. work and publications, Dr. Sarker is also involved in a number of research
[131] M. Groshev, C. Guimarães, J. Martín-Pérez, A. de la Oliva, To- engagement and leadership roles such as Journal editorial, international
ward intelligent cyber-physical systems: Digital twin meets artificial conference program committee (PC), student supervision, visiting scholar
intelligence, IEEE Commun. Mag. 59 (8) (2021) 14–20. and national/international collaboration. He is a member of IEEE, ACM
[132] M.A. Ferrag, O. Friha, L. Maglaras, H. Janicke, L. Shu, Federated and Australian Information Security Association.
deep learning for cyber security in the internet of things: Concepts,
applications, and experimental analysis, IEEE Access 9 (2021) Helge Janicke is a Professor of Cybersecurity at Edith Cowan University
138509–138542. (ECU), Australia. He is the Director of ECU’s Security Research Institute
[133] P. Ren, Y. Xiao, X. Chang, P.-Y. Huang, Z. Li, B.B. Gupta, X. Chen, and the Research Director for Australia’s Cyber Security Cooperative
X. Wang, A survey of deep active learning, ACM Comput. Surv. Research Centre. He optained his PhD in 2007 from De Montfort University,
(CSUR) 54 (9) (2021) 1–40. UK, where he established DMU’s Cyber Technology Institute and its
[134] J.Z. Bengar, J. van de Weijer, B. Twardowski, B. Raducanu, Reducing Airbus Centre of Excellence for SCADA cybersecurity and digital forensics
label effort: Self-supervised meets active learning, in: Proceedings of research, as well as heading up DMU’s School of Computer Science. His
the IEEE/CVF International Conference on Computer Vision, 2021, research interests are Cybersecurity in Critical Infrastructure, Human Factors
pp. 1631–1639. of Cybersecurity, Cybersecurity of Emerging Technologies, Digital Twins
[135] X. Liu, F. Zhang, Z. Hou, L. Mian, Z. Wang, J. Zhang, J. Tang, Self- and Industrial IoT.
supervised learning: Generative or contrastive, IEEE Trans. Knowl.
Data Eng. 35 (1) (2021) 857–876. Ahmad Mohsin is a Post-doctoral Research Fellow of the Cyber Security
[136] M. Mohammadpourfard, Y. Weng, M. Pechenizkiy, M. Tajdinian, Cooperative Research Centre (CSCRC) in association with the ECU Security
B. Mohammadi-Ivatloo, Ensuring cybersecurity of smart grid against Research Institute, Edith Cowan University (ECU), Australia. He completed
data integrity attacks under concept drift, Int. J. Electr. Power Energy his Ph.D. in Computers Science and Software Engineering from ECU,
Syst. 119 (2020) 105947. Australia. He has worked closely with Academia and Industry for designing
intelligent and trustworthy systems. Ahmad has actively contributed to
[137] B. Bayram, B. Köroğlu, M. Gönen, Improving fraud detection and
research projects in the Australian industry specific to Critical Infrastructures.
concept drift adaptation in credit card transactions using incremental
His research interests include Cybersecurity, Predictive modeling of smart
gradient boosting trees, in: 2020 19th IEEE International Conference
systems, Trustworthy and Reliable AI, Digital Twins and Critical Infrastruc-
on Machine Learning and Applications, ICMLA, IEEE, 2020, pp.
ture Resilience. Ahmad has publications both in top Journals and conferences
545–550.
and is also an active reviewer of leading journals and conferences. Ahmad
[138] Z. Li, W. Huang, Y. Xiong, S. Ren, T. Zhu, Incremental learning
is a regular guest speaker at various academic and industry avenues.
imbalanced data streams with concept drift: The dynamic updated
ensemble algorithm, Knowl.-Based Syst. 195 (2020) 105694.
Asif Gill is A/Professor and Head of Discipline Software Engineering at the
[139] J. Lu, A. Liu, F. Dong, F. Gu, J. Gama, G. Zhang, Learning under
School of Computer Science, UTS. He is also a Director of the DigiSAS
concept drift: A review, IEEE Trans. Knowl. Data Eng. 31 (12)
Lab. He has PhD Computing, MSc Computing and Master of Business. His
(2018) 2346–2363.
work focuses on architecting, implementing and evaluating the information-
[140] I.H. Sarker, A. Colman, J. Han, Recencyminer: mining recency-based
driven large scale secure and sustainable digital ecosystems. He is a member
personalized behavior from contextual smartphone data, J. Big Data
of the ACS Data Sharing Committee, IFIP Technical Committee 8.1, and
6 (1) (2019) 1–21. Standards Australia Software and Systems Engineering Committee IT-015.
[141] G. Siewruk, W. Mazurczyk, Context-aware software vulnerabil- He is often invited and involved as a professional keynote speaker, editor,
ity classification using machine learning, IEEE Access 9 (2021) conference chair, organizer and reviewer for a number of national and
88852–88867. international academic and industry conferences.
[142] L.F. Sikos, Cybersecurity knowledge graphs, Knowl. Inf. Syst. (2023)
1–21.
Leandros A. Maglaras is a professor of cybersecurity in the School
of Computing at Edinburgh Napier University. From September 2017 to
November 2019, he was the Director of the National Cyber Security
Iqbal H. Sarker received his Ph.D. in Computer Science from Swin- Authority of Greece. He obtained a B.Sc. (M.Sc. equivalent) in Electrical and
burne University of Technology, Melbourne, Australia in 2018. Now he is Computer Engineering from the Aristotle University of Thessaloniki, Greece
working as a Research Fellow of the Cyber Security Cooperative Research in 1998, M.Sc. in Industrial Production and Management from the University
Centre (CRC) in association with the Centre for Securing Digital Futures, of Thessaly in 2004, and M.Sc. and Ph.D. degrees in Electrical & Computer
Edith Cowan University (ECU), Australia. His research interests include Engineering from the University of Thessaly, in 2008 and 2014 respectively.
Cybersecurity, AI/XAI and Machine Learning Algorithms, Data Science In 2018 he was awarded a Ph.D. in Intrusion Detection in SCADA systems
and Behavioral Analytics, Trustworthy LLMs, Knowledge and Rule Mining, from the University of Huddersfield He is featured in Stanford University’s
Digital Twin, Critical Infrastructures and Industrial Applications. He has list of the world’s Top 2% scientists. He is a Senior Member of the Institute
published 100+ journal and conference papers in various reputed venues of Electrical & Electronics Engineers (IEEE) and is an author of more than
published by Elsevier, Springer Nature, IEEE, ACM, Oxford University 200 papers in scientific magazines and conferences.

24