2021 IEEE International Conference on Cyber Security and Resilience (CSR) Workshops

The THREAT-ARREST Cyber Range Platform

George Hatzivasilis1, Sotiris Ioannidis1, Michail Smyrlis2, George Spanoudakis2, Fulvio Frati3, Chiara Braghin3, Ernesto
Damiani3, Hristo Koshutanski4, George Tsakirakis5, Torsten Hildebrandt6, Ludger Goeke7, Sebastian Pape7, Oleg Blinder8,
2021 IEEE International Conference on Cyber Security and Resilience (CSR) | 978-1-6654-0285-9/21/$31.00 ©2021 IEEE | DOI: 10.1109/CSR51186.2021.9527963

Michael Vinov8, George Leftheriotis9, Martin Kunc10, Fotis Oikonomou11, Giovanni Magilo12, Vito Petrarolo12, Antonio Chieti12,
Robert Bordianu13
1
FORTH-ICS, Greece, 2Sphynx Technology Solutions AG, Switzerland, 3University of Milan, Italy, 4Atos Spain SA, Spain,
5
ITML, Greece, 6SimPlan, Germany, 7Social Engineering Academy GmbH, Germany, 8IBM Israel, Israel, 9TUV Hellas, Greece,
10
Czech National CSIRT, Czech Republic, 11DANAOS Shipping Company, Cyprus, 12ARESS, Italy, 13Lightsource BP, Ireland

Abstract—Emerging technologies are facilitating our daily or even attacking a system by practicing on a legal, safe, and
activities and drive the digital transformation. The Internet of virtual environment. The trainer creates a virtual lab which may
Things (IoT) and 5G communications will provide a wide range of resemble an actually operational system or subsystem. There,
new applications and business opportunities, but with a wide and the trainee can learn how to administrate mainstream and/or
quite complex attack surface. Several users are not aware of the advanced security mechanisms, try different configurations and
underlying threats and most of them do not possess the knowledge settings, and assess the overall results under realistic attack
to set and operate the various digital assets securely. Therefore, scenarios. The virtual environment is instantiated or destroyed
cyber security training is becoming mandatory both for simple on demand for each trainee, and the process can be repeated
users and security experts. Cyber ranges constitute an advance
again and again. Nevertheless, the design and development of
training technique where trainees gain hands-on experiences on a
safe virtual environment, which can be a realistic digital twin of
even a mainstream programme requires significant expertise,
an actual system. This paper presents the cyber ranges platform time, and effort by the trainer.
THREAT-ARREST. Its design is fully model-driven and offers all Thereafter, the trainee can follow the defined learning path
modern training features (i.e. emulation, simulation, serious to obtain knowledge and acquire new skills, complete a full
games, and fabricated data). The platform has been evaluated programme, and earn a relevant certification [6]. However, the
under the smart energy, intelligent transportation, and healthcare fact that someone fulfils the training and learning requirements
domains. does not mean that he/she will also adopt automatically his/her
Keywords—security training, cyber range, security assurance,
behavior in the digital world accordingly. On the contrary,
learning path, security assessment, smart energy, smart shipping, several research activities have revealed that only a small
healthcare percentage of the learnt concepts (around 10%-40%) is
automatically embraced by individuals. This is an important
I. INTRODUCTION problem for organizations, especially those ones that operate
critical infrastructures, as non-compliance of their personnel to
The evolution of the Information and Communications
Technology (ICT) has created a new technological landscape the defined security policies is deriving the deployed protection
mechanisms inadequate and the underlying systems vulnerable
[1]-[2], exploiting among others high-performance computing,
to attacks. Thus, the real efficacy of training itself, even with
5G communications, advance machine learning (ML) and
advanced CRs, is still a perspective that needs to be significantly
artificial intelligence (AI), augmented and virtual realities (AR
improved.
and VR), Big Data analytics, social networking, mobility, and
the Internet of Things (IoT). This paper presents the EU-funded CR, called THREAT-
ARREST (www.threat-arrest.eu). The platform marshals
The increased systems’ interactions and complexity leave
modern training methods (i.e. emulation, simulation, serious
fruitful space for the currently known security vulnerabilities to
gaming, and fabrication of realistic synthetic data) to enhance
survive and expand, as well as for new threats to emerge [3]. The
the learning experience for trainees. The overall process is
market demand for skillful professionals is expected to grow
fortified with pedagogical methodologies (i.e. Bloom’s revisited
drastically, and security awareness and training programmes are
taxonomy and Kolb’s experience gaining life-cycle) to define
going to become a necessity, both for individuals and
the learning path and ensure the learning outcomes. Moreover,
organizations.
the educational scope can be designed in such a way that it will
Cyber ranges (CRs) form a special method of cyber security cover the requirements and demands for professional
training and is considered as a promising solution for the certification schemes from organizations like ISACA and ISC2.
educational needs of this digital era [4]-[5]. Apart from the This option will further increase the acceptability of a specific
traditional in-class or on-line educational means (e.g. lectures, CR platform in the market.
tutorials, reading material, etc.), with CRs the learner has the
opportunity to gain hands-on experience on setting, defending,

978-1-6654-0285-9/21/$31.00 ©2021 IEEE

422
Authorized licensed use limited to: J.R.D. Tata Memorial Library Indian Institute of Science Bengaluru. Downloaded on February 07,2025 at 04:04:13 UTC from IEEE Xplore. Restrictions apply.
 The paper is structured as follows. Section II positions the reinforcement, and/or simulated phishing campaigns. The
THREAT-ARREST CR with respect to the related work. platform monitors the learners’ progress through a user-friendly
Section III presents the main CR capabilities and the tools dashboard, providing also forecasts, trends, and live data
implementing those capabilities, while Section IV draws tracking.
conclusions and future work.
CyberBit’s platform offers realistic simulation of cyber-
II. RELATED WORKS attacks in a mirror system of a real network with a security
operations center (SOC) [18]. This CR is composed of a virtual
A. Cyber Range Platforms network (digital twin of a real setting), the traffic generator
Overviews of cyber security training in critical (benign data), the attack engine (malicious traffic), and the
infrastructures (e.g. nuclear energy, conventional energy, virtual SOC (learners’ point of view). The target is to simulate
healthcare, transportation, and aviation sectors), are documented hyper-realistic CRs. This solution offers various training
in [6]-[7]. Today, the demand for security experts is scenarios, like penetration testing and incident response. The
continuously increasing [7]. CRs constitute a promising solution educators set up the training sessions that include session
of advanced training, which could fill the gap by enhancing monitoring, trainee assessment, debriefing, and scenario
educational material with hands-on experiences. administration. Scenario customizations are also supported
through a graphical interface.
The majority of the CR platforms are developing automated
mechanisms to ease the implementation of training scenarios, The THREAT-ARREST solution supports training on
virtual labs, and the trainees’ evaluation [6]-[9]. known as well as new advanced cyber attack scenarios, taking
different type of actions, such as preparedness, detection and
Online platforms, like, edX, Coursera, and Udacity, provide analysis, incident response, and post incident response.
general-purpose training and offer main cyber security courses THREAT-ARREST offers monitoring, assessment, and security
[6]. Specialized platforms, such as SANS [10], Cybrary [11], testing for various layers in the implementation stack, like:
StationX [12], CyberInternAcademy [13], and AwareGO [14]
focus on individual learners whose target is to sharpen existing • Network layer modules (such as honey pots/honeynet,
or develop new skills. Nonetheless, such solutions fail when it firewalls, intrusion detection systems, etc.),
comes to hands-on experiences on actual systems or CRs.
• Infrastructure layer (e.g. passive and active penetration
BeOne Development has developed its own platform for testing, security monitors, etc.),
security awareness training [15]. This solution involves
awareness videos, e-learning modules, and simulation modules. • Application layer (like code analysis, security monitors,
Thereupon, the BePhished simulator is used especially for and penetration testing).
training on phishing attacks. To ease the creation of training The overall process starts by assessing the organization’s
exercises, BeOne implements the Security Awareness Library security posture. The Assurance Tool estimates the current level
that includes 28 learning contents. Cultural differences and of security and reports the most critical security issues, based on
multinational working environments are considered, as which the training process is designed. Thereafter, hybrid
education is more effective if the learnt examples are correlated training programmes are developed, customized to the
with the trainees’ daily activities. This platform provides generic organization’s demands and the underlying trainee groups. This
and pre-packaged programmes, organization-specific look and involves the educational material along with serious games and
feel, or customized programmes which are designed in close the emulation/simulation of the CR system. THREAT-ARREST
collaboration with a client’s experts. The BeOne solution offers also supports continuous evaluation of: (a) the individual
generic teaching procedures for the core training and the trainees’ performance in specific courses; and (b) the efficacy of
advanced simulation-centric training focuses on phishing complete programmes across trainees’ groups and the
assaults. organization as a whole. Those assessments are utilized for the
ISACA implemented the CyberSecurity Nexus (CSX) customization of programmes to the skills of individual trainees
platform [16]. It offers lectures and hands-on lab exercises on or adjustment at a more macroscopic perspective.
real systems. The learner gains experience by practicing main Table 1 documents a qualitative comparison for the above
concepts and industry-leading methodologies. Capture-the-flag mentioned CR platforms. THREAT-ARREST incorporates all
(CTF) exercises are also provided, improving the learners’ modern training features of serious gaming, simulation, and
technical capabilities. Trainees are evaluated and the target is to emulation in a unified manner, and provides continuous security
gain related professional certifications. Thereafter, the chief assessment and training adaptation based on the trainee’s
information security officer (CISO) for an organization can hire capabilities.
personnel with the required skills.
Kaspersky provides enhanced computer-based training
programmes for all organizational layers [17]. Apart from online
training, the tool offers benchmarking against industry/world
averages, as well as realistic gamification and simulation. It
implements an internal learning and educational schedule with
constant reinforcement, provided automatically via a mixture of
training formats, involving learning modules, tests, email
This work has received funding from the European Union Horizon’s
2020 research and innovation programme under the grant agreements No.
786890 (THREAT-ARREST) and No. 830927 (CONCORDIA).
423
Authorized licensed use limited to: J.R.D. Tata Memorial Library Indian Institute of Science Bengaluru. Downloaded on February 07,2025 at 04:04:13 UTC from IEEE Xplore. Restrictions apply.
 TABLE I. CYBER-SECURITY TRAINING PLATFORMS: A) THREAT- main concern of novel cyber security training platforms. This is
ARREST, B) BEONE, C) KASPERSKY, D) ISACA CSX, E) CYBERBIT, F)
ONLINE TRAINING PLATFORMS. THE FOLLOWING NOTATIONS ARE UTILIZED
also one of the main THREAT-ARREST goals including the
FOR (Y)ES, (N)O, AND (P)ARIAL. developed continuous adaptation and assurance mechanisms,
which are presented in the following section.
Feature A B C D E F III. THE THREAT-ARREST PLATFORM
A high-level view of the THREAT-ARREST platform is
Automatic security vulnerability analysis of a Y N N N N N depicted in Fig. 1. The main components are presented in the
pilot system subsections below.
Multi-layer modelling Y P Y Y Y P
Continuous security assurance Y N N Y Y N
Serious gaming Y N Y Y N P
Realistic simulation of cyber systems Y P Y Y Y N
Combination of emulated and real equipment Y N P Y N N
Programme runtime evaluation Y N N Y Y Y
Programme runtime adaptation Y N Y Y N P

B. Adopting Training in the Workplace

Even though there is an increasing need for modern security
training and advance CR platforms (e.g. with serious games,
simulation, emulation, etc.), the transfer of the learned
capabilities from the trainees to their workplace and the Fig. 1. The THREAT-ARREST platform
adaptation of the organizational operations have been totally
neglected in almost all cases (e.g. ([7], [8], [9]). Noncompliance A. The Assurance Tool
of users with the security policies that the organization has
defined is of main concern ([20], [8], [19]). If the personnel do The Assurance Tool provides continuous evaluation of the
not totally follow such policies, the effectiveness of the deployed operational system’s security posture via the integration of
defenses is lost. From the different compliance methods, dynamic testing and runtime monitoring [4]. The tool also
effectual training is the most widely used one. gathers system events at runtime and produces notifications
which identifies the basis for designing realistic virtual labs
Nonetheless, only a few studies are assessing the effects of (with emulated/simulated components and serious games).
professional training to organizations and promote compliance
policies in the workplace ([20], [8]). Also, only in rare cases The Assurance Tool performs a continuous runtime
theory is used to evaluate the aspects that affect trainees’ evaluation of system aspects that are significant for the
compliance with security policies or even present empirical definition of a Cyber Threat and Training Preparation (CTTP)
evidence from actual training. Ordinarily, it is believed that programme. These features are determined in the CTTP model
training programmes have to utilize procedures and material (security assurance sub-model). For example, the CTTP model
which can actively engage learners and motivate them to determines the system components which should be monitored,
systematic cognitive processing of the underlying contents ([7], the relevant events that are of importance (like user actions,
[6]). Apart from novel technical features (such as serious external service calls, operating system calls, etc.), and the
gaming and simulation), the continual communication between conditions which they have to satisfy. Moreover, it deploys
the instructor with the trainees is vital for the enhancement of dynamic system tests which are performed at runtime and are
the individuals security compliance ([7], [20], [6]). incorporated with monitoring to implement hybrid security
evaluations [23], [24]. The gathered monitoring information and
Researchers usually integrate pedagogical principles as the testing results are the operational system evidence. This data is
main approach to advance learners’ compliance ([8], [19], [6]). parsed to simulation components and enables statistical
In 1998, Baldwin and Ford [21] defined the transfer of learning profiling, as well as the production of realistic simulations.
to the workplace as “the degree to which trainees effectively
apply the knowledge, skills, and attitudes gained in the training B. Hybrid Training
context to the job”. The CTTP models can define virtual labs with hybrid
training scenarios by combining emulated and simulated
However, it is recorded that approximately only 10%-40% components. In this case, some of the system components are
of all training experiences would be transferred to the working emulated (implementation of the full component functionality,
environment ([22], [7], [8]). Furthermore, as time passes from i.e. a VM) while the rest ones are simulated (only deployment of
the programme’s completion, trainees tend to become less the main part of the component’s functionality/interactions, e.g.
motivated in retaining the obtained operational behaviors (i.e. a simple programme that outputs a temperature value,
after twelve months). Therefore, for the currently supported representing a sensor of a smart home). Hybrid training becomes
technical solutions and methodologies, only a small percent of quite useful when the emulation of the entire system is not
the learnt outcomes would be permanently transferred to the feasible or required, and obtaining hands-on experiences is
workplace. Thus, improving learning transfer constitutes the requested for specific system components. With hybrid

424
Authorized licensed use limited to: J.R.D. Tata Memorial Library Indian Institute of Science Bengaluru. Downloaded on February 07,2025 at 04:04:13 UTC from IEEE Xplore. Restrictions apply.
 scenarios, learners are expected to monitor, test, and act on programmes. Finally, this tool interacts with the Visualization
emulated components, while observing the effects to the Tool for the effective training delivery.
remaining cyber system and their propagation through
simulation. In some occasions, simulation may be also preferred C. Serious Games
to retain the CR resources, as in practice it will be less Except from emulation, simulation, and hybrid-based
demanding than emulation. The CR platform could also training, a CTTP model can also configure serious games for
terminate specific emulated components at some time-point and different training modalities. Such training aims to advance
continue with their simulated versions (e.g. in case that they skills to defend against attacks targeting users by exploiting
would not be needed for a certain training phase), or decide to human weaknesses (e.g. social engineering). By adjusting the
emulate components that were simulated in a previous training games to the users’ skills serious games can gradually advance
stage. Totally, the training scenarios that can be deployed by the users’ ability to defend against attacks. On the one hand this
THREAT-ARREST vary based on: can be done by training the user to react in a certain way, i.e.
following the assumptions from the assurance submodel as also
• The system coverage level: With respect to this factor, specified within the security policies (PROTECT [26]). For
scenarios can be distinguished into those engaging example, if the targeted system applies a two-factor user
attacks that focus on: (i) single system components, (ii) authentication mechanism, requiring security tokens and
clusters (e.g. subsets of interconnected) of system passwords, it is considered that users would alter their
components, or (iii) all system components. passwords in a frequent basis and refrain from sharing the
• The attacks type: With respect to this factor, scenarios tokens. A relevant scenario in the serious game would cover this
are distinguished into those performing: (i) historic topic and aim to train the user to act according to the
attacks, or (ii) live attacks that are executed as the assumptions. For instance, trainees can be asked to share their
simulated/emulated scenario is propagated by the CR security tokens to favor another person who gained their trust in
platform. the game (simulating a phishing attempt), but would be
rewarded for the strategy of not sharing their token. On the other
• The required response type: With respect to this factor, hand, users can learn about recent attacks in a quiz game which
scenarios are differentiated based on the required is provided with questions on recent social engineering attacks
response to a security incident. Different responses are (CyberSecurity Awareness Quiz [27]), allowing the users to
determined according to the different training stages. keep their knowledge about attacks up to date.
Such responses include [25]: (i) preparation/preventive
actions, (ii) analysis and detection, (iii) containment, Games are also utilized for the initial profiling of trainees in
eradication, and recovery activities, and/or (iv) post- order to disclose the trainee’s cyber security skills and determine
incident actions. the appropriate form of training (and its difficulty) which could
be sufficient for them. For example, an introductory game could
• The trainee’s profile: With respect to this factor, be utilized for the evaluation of the trainee’s familiarity with
scenarios are differentiated based on the cognitive access controls, and based on it, drive any follow up training
trainee’s profile, as disclosed by introductory security towards, for instance, emulation for a more hands-on exposure
games and the trainee’s performance on the training to access control aspects.
scenarios where he/she has been exposed so far.
The Gamification Tool hosts various serious games (i.e.
The permitted variability forms based on the criteria above, PROTECT [26] and the CyberSecurity Awareness Quiz [27]),
are determined as part of scenarios constructing the CTTP scenarios, and training evaluation mechanisms, which allow a
programme. Via an Editor, the Training Tool supports the trainee to develop skills in preventing and being resilient to
definition of CTTP models and programmes, the assignment of social engineering assaults (e.g. phishing campaigns,
learning exercises/materials for CTTP programmes, allow impersonation attempts). These games are driven by the
trainees’ responses to deployed threats, communication with the assumptions and threats from the related security assurance
emulated/simulated components, assessment of the trainees’ CTTP models.
performance, as well as evaluation and adaptation of a CTTP
Finally, this tool can facilitate post training evaluations of
programme as a whole.
trainees’ awareness (in terms of knowledge and attitudes) for the
Except from the CTTP models and programme definitions, trained attack types.
the Training Tool supports a high interactivity level of the
trainee with a training scenario, allowing him/her to respond D. Emulation
and/or send appropriate commands to emulated/simulated Based on the CTTP model, the Emulation Tool can emulate
components. Moreover, it continuously collects information software and hardware components, defined as Software
concerning the emulation and simulation status, assesses in real Architecture Layer (SAL) and Physical Architecture Layer
time the scenario progress based on trainee’s responses and their (PAL) elements [5]. The tool creates live instances of SAL and
effects on components, and calculates the overall trainee’s PAL components like VMs, performing the available
performance. The tool also validates the assumptions defined in operations/services for them, and enabling data and stimuli
the assurance model based on the trainee’s responses to the flows utilizing the deployment and network links connecting
instantiated scenario and produces notifications when such them in the SAL, PAL, and deployment sub-models. Emulation
assumptions get violated. The Training Tool evaluates the is utilized when the behavior of specific SAL/PAL components
trainee’s performance and assesses and adapts the whole CTTP cannot be sufficiently described in detail to permit the

425
Authorized licensed use limited to: J.R.D. Tata Memorial Library Indian Institute of Science Bengaluru. Downloaded on February 07,2025 at 04:04:13 UTC from IEEE Xplore. Restrictions apply.
 simulation of its behavior, or when trainee’s hands-on submodels described in the sections above, and present the
experience in controlling and observing these components is relevant graphs to the users. The operator can use those graphs
necessary. to pick the system parts that will be emulated or simulated. The
Visualization Tool is also responsible for the representation of
With emulations, there are also emulated clients of the cyber the status of the emulated/simulated components and the effects
system requesting services from it, and trainees have to interact of the training actions.
with the emulated components (e.g. login a VM) and execute
specified actions to defend the related components, and via G. Data Fabrication
them, wider parts of or even the entire emulated setting. For The Data Fabrication Platform (DFP) [28] is a web-based
instance, after accessing a VM, trainees can make use of platform for generating high-quality structured data for testing,
monitoring and testing tools to identify attacks, examine them, development, and training. The methodology used is termed
and respond to them in real time (e.g. strengthening access “model-based rule-guided fabrication”. DFP consumes data
restrictions, deactivating some functionality, etc.). Learners can declaration directives (data model or metadata) along with user-
also be assigned to groups with accountability of defending defined rules as input, creates a Constraint Satisfaction Problem
certain system components or even act as attackers to insight on (CSP), and solves the problem using a proprietary CSP Solver,
how an attack can be performed. which has been used for verifying IBM hardware systems for
E. Simulation over a decade.
The CTTP model can deploy the simulation of attacks on Two types of synthetic data have been used for the THREAT-
some system components or the propagation of the side-effects ARREST objectives:
on other parts of this system [5]. For example, the provided (i) Static general-purpose synthetic data, such as health
CTTP model information can drive the simulation of distributed records, for the needs of setting/performing a given
denial of service (DDoS) attack propagation, targeting a smart training scenario;
home gateway, as well as the effects on the simulated SAL and
PAL components. The propagation of those side-effects is (ii) Static or dynamic (interactive) security (event) logs for
controlled by simulating the response operations determined for cybersecurity training in the context of a training
SAL and PAL elements and enabling data and other stimuli (e.g. scenario, such as security logs regarding malicious
calls) flow across components via the links of the SAL and PAL (anomalous) accesses to a server hosting a database of
sub-models. The attacks’ side-effects might be also propagated health records.
from the PAL to the SAL level (and vice versa) based on
component links determined in the deployment model of the In the first case (i), data is modelled in advance via the DFP
CTTP model. Simulations can vary based on the difficulty level web-based user interface and fabricated off-line, before a
which they present to the trainee. This level is controlled by training session starts. Fabricated data is populated in predefined
limiting the degree of information which is available for an databases and/or predefined file locations to be deployed and
attack, the time when such information becomes available consumed in a virtual lab environment.
following the attack, and the consistency of data generated by In the second case (ii), a dedicated data fabrication
the different security mechanisms of the system and the external functionality has been exposed through REST API so that other
utilized assessment tools. platform components can dynamically request data fabrication.
To enable realistic simulations, the THREAT-ARREST For instance, during scenario initialisation the Training Tool
framework is continuously monitoring the real operational initialises a data fabrication process while upon successful
system and logs any significant events related to it. The events confirmation of log fabrication finalisation, the Emulation Tool
to audit and their analysis type is determined by the assessment fetches the fabricated logs and deploys those in the
measures of the assurance submodel. Then, the captured corresponding VMs of the Virtual Lab environment.
assurance relevant events are statistically profiled. Statistical IV. CONCLUSIONS
profiling covers event metadata (such as the timing of their
happening or other features like their sender and receiver) and – This paper described the THREAT-ARREST approach – a
where allowable by the applicable security policies – the actual cyber ranges platform for advanced cyber security training for
event payload (like data passed among the components, medium to large organizations. Initially, the organization’s real
parameter values for component operation calls, size of files system is analyzed, disclosing the most severe vulnerabilities
written or read, etc.). and threats. Thereupon, a training programme is developed
which adheres to the organization’s specific requirements. The
F. Visualization various elements are defined as CTTP models and the overall
The Visualization Tool enables the graphical representation learning processes are assessed and adapted at runtime. Apart
of emulations and simulations, the effect of training actions on from the typical on-line educational content (e.g. lectures,
emulated/simulated components, and the state of the relevant videos, tutorials, etc.), the advanced hybrid training incorporates
components. serious games and emulated/simulated virtual labs. The overall
solution can cover the training against known and new attacks,
Utilizing the visualization framework, the THREAT- and prepares trainees to detect, respond, and mitigate them under
ARREST platform’s operator can choose the desired training realistic conditions.
scenarios and configure their parameters. Furthermore, the
platform can parse and visualize the CTTP model and the

426
Authorized licensed use limited to: J.R.D. Tata Memorial Library Indian Institute of Science Bengaluru. Downloaded on February 07,2025 at 04:04:13 UTC from IEEE Xplore. Restrictions apply.
 Future work includes extending end user validation of [11] Cybrary: Develop security skills. https://www.cybrary.it/ .
platform capabilities with organizations of different domains [12] StationX: Online cyber security & hacking courses.
(energy, healthcare, smart shipping), extending platform https://www.stationx.net/ .
integration and federation with other Cyber Ranges both on a [13] CYBERINTERNACADEMY: Complete cybersecurity course review on
CYBERINERNACADEMY.
technical level scenario interoperation and on a conceptual https://www.cyberinternacademy.com/complete-cybersecurity-course-
(capability, taxonomy) level to further expand and align with guide-review/ .
end user needs of training. [14] AwareGO: Security awareness training. https://www.awarego.com/ .
[15] BeOne Development: Security Awareness Training.
ACKNOWLEDGMENT https://www.beonedevelopment.com/en/security-awareness/ .
This work has received funding from the European Union [16] ISACA: CyberSecurity Nexus (CSX) training platform.
Horizon’s 2020 research and innovation programme under the https://cybersecurity.isaca.org/csx-certifications/csx-training-platform .
grant agreements No. 786890 (THREAT-ARREST) and No. [17] Kaspersky: Kaspersky security awareness.
830927 (CONCORDIA). https://www.kaspersky.com/enterprise-security/security-awareness .
[18] CyberBit: Cyber Security Training Platform.
REFERENCES https://www.cyberbit.com/blog/security-training/cyber-security-training-
platform/ .
[1] Hatzivasilis, G., et al.: SPD-Safe: Secure administration of railway
intelligent transportation systems. Electronics – Special Issue on [19] Puhakainen, P., Siponen, M.: Improving employees’ compliance through
Advances in Public Transport Platform for the Development of information systems security training: an action research study. MIS
Sustainability Cities, MDPI Open Access Journal, January 2021, vol. 10, Quarterly 2010, 34, 757–778.
issue 1, article 92, pp. 1-26. [20] Abraham, S., Chengalur-Smith, I.: Evaluating the effectiveness of learner
[2] Hatzivasilis, G., et al.: AI-driven composition and security validation of controlled information security training. Computers & Security 2019, 87,
an IoT ecosystem. Applied Sciences – Special Issue on Smart City and 1–12.
Multi-Agent Systems, MDPI Open Access Journal, August 2020, vol. 10, [21] Baldwin, T.T., Ford, J.K.: Transfer of training: a review and directions
issue 14, article 4862, pp. 1-31. for future research. Personnel Psychology 1988, 41, 63–105.
[3] Maghool, S., et al.: The coevolution of contagion and behavior with [22] Velada, R., et al.: The effects of training design, individual characteristics
increasing and decreasing awareness. PLOS ONE, December 2019, vol. and work environment on transfer of training. International Journal of
14, issue 12, article: e0225447, pp. 1-22. Training and Development 2007, 11, 282–294.
[4] Smyrlis, I., et al.: CYRA: A Model-Driven Cyber Range Assurance [23] Katopodis, S., Spanoudakis, G. and Mahbub, K.: Towards hybrid cloud
Platform. Applied Sciences – Special Issue on Security Management of service certification models. International Conference on Services
5G and IoT Ecosystems, MDPI Open Access Journal, June 2021, vol. 11, Computing, June, 2014, pp. 394-399.
issue 11, article 5165, pp. 1-28. [24] Hatzivasilis, G., Papaefstathiou, I., Manifavas, C.: Software Security,
[5] Braghin, C., et al.: Towards the Monitoring and Evaluation of Trainees’ Privacy and Dependability: Metrics and Measurement. IEEE Software,
Activities in Cyber Ranges. 2nd Model-driven Simulation and Training vol. 33, issue 4, 2016, pp. 46-54.
Environments for Cybersecurity (MSTEC), ESORICS, Guildford, UK, [25] Cichonski, P., et al.: Computer security incident handling guide. NIST,
September 2020, Springer, LNCS, vol. 12512, pp. 79-91. Special Publication 800-61 v2, 2012, pp. 1-79.
[6] Hatzivasilis, G., et al.: Modern Aspects of Cyber-Security Training and [26] Goeke, L., et al.: PROTECT – An Easy Configurable Serious Game to
Continuous Adaptation of Programmes to Trainees. Applied Sciences Train Employees Against Social Engineering Attacks. 1st Model-driven
2020, 10, 1–26. Simulation and Training Environments for Cybersecurity (MSTEC),
[7] Chouliaras, N., et al.: Cyber ranges and testbeds for education, training, ESORICS, Luxembourg, September 2019, Springer, LNCS, vol. 11981,
and research. Applied Sciences 2021, 11, 1-23. pp 156-171.
[8] Chowdhury, N., Gkioulos, V.: Cyber security training for critical [27] Pape, S., et al.: Conceptualization of a CyberSecurity Awareness Quiz.
infrastructure protection: A literature review. Computer Science Review 2nd Model-driven Simulation and Training Environments for
2021, 40, 1–20. Cybersecurity (MSTEC), ESORICS, Guildford, UK, September 2020,
[9] Gustafsson, T., Almroth, J.: Cyber range automation overview with a case Springer, LNCS, vol. 12512, pp. 61-76.
study of CRATE. 25th Nordic Conference on Secure IT Systems [28] IBM, “Create high-quality test data while minimizing the risks of using
(NordSec), Springer, LNCS 2021, 12556, 192–209. sensitive production data.” IBM InfoSphere Optim Test Data Fabrication,
[10] SANS: Online cyber security training. https://www.sans.org/online- IBM, 2017, https://www.ibm.com/il-en/marketplace/infosphere-optim-
security-training/ . test-data-fabrication.

427
Authorized licensed use limited to: J.R.D. Tata Memorial Library Indian Institute of Science Bengaluru. Downloaded on February 07,2025 at 04:04:13 UTC from IEEE Xplore. Restrictions apply.