# CYRA: A Model-Driven CYber Range Assurance Platform
## 5 Cyber Threat and Training Models and Programmes Adaptation Tool
### Adaptation Based on Sphynx's Security Assurance Platform
#### 5.1.2 Adaptation Based on Vulnerable Assets
When the CTTP Models and Programmes adaptation tool and Sphynx's Security Assurance Platform were utilised, one can observe that the mean CPU usage was increased to 30.5% while the memory usage remained at the same levels (see Figure 9). In general, CYRA's CPU and memory usage was observed to increase to around 70% only when dynamic testing and monitoring assessments were executed simultaneously. CYRA's availability (excluding planned downtime) for the monitored period is at 99.99% (see Figure 10) with around four pings per minute (see Figure 11). Figure 11: Pings per minute. Figure 8: Mean CPU and memory usage (normal platform usage). Figure 10: CYRA’s availability. Figure 9: Mean CPU and memory usage (heavy platform usage). As for the user's interaction with the platform, it is observed that CYRA receives around 2000 hits every roughly 15 min (see Figure 12). Lastly, JMeter is used to measure the elapsed time per CYRA's API. JMeter's Glossary [44] states that it measures the \"load time\" as the difference between the time when the request was sent and the time once a response has been completely received and the \"latency\" as the time from just before sending the request to just after the first response has been received. For the sake of brevity, only two REST API metrics are presented. The first one is responsible for retrieving all the training programmes, while the latter is responsible for retrieving all the training scenarios. As presented in Figure 13, the load time to fetch 547,689 bytes of data for the training programme's REST API is 1410 ms.

Lastly, as for the training scenarios, the load time to fetch 325,846 bytes of data for the Training Scenario's REST API is 1222 ms (see Figure 14). ### CTTP Model Editor Evaluation

At the time of writing, 12 external trainers and 20 trainee's of different sectors (e.g., healthcare, maritime, IoT and 5G) and expertise (foundation, practitioner, intermediate, expert) evaluated the CTTP models and programmes editor (part of the cyber range assurance platform). Only the trainers were asked to submit an evaluation report, as they were responsible for presenting the CTTP Models and programmes editor to the trainee's, and incorporate their comments into the final report. Most of the users (10 out of 12) have a technical background, while the rest are general \(\Pi\) personnel (see Figure 15a). Five of the participants considered themselves of \"practitioner\" level in terms of their cyber-security

Figure 14: Training Scenarios’ REST API (**a**) and its metrics (**b**). Figure 12: User’s interactions with CYRA. Figure 13: Training Programme’s REST API (**a**) and its metrics (**b**). skills, knowledge and abilities, one as \"foundation\", four as \"intermediate\" and two as \"expert\" (see Figure 15b). The four levels of expertise are:

1. Foundation: The trainer has a basic security knowledge and no experience in creating cyber range programmes. 2. Practitioner: The trainer has an advanced security knowledge and limited experience in creating cyber range programmes. 3. Intermediate: The trainer is a security expert with limited expertise in creating cyber range programmes. 4. Expert: The trainer is a security expert with high expertise in creating cyber range programmes. The participants were asked a total of 14 questions in order to evaluate the usefulness of the CTTP models, programmes and the editor. As shown in Figure 16, most of the participants found the CTTP models and programmes editor both easily accessible and user friendly. Next, the participants were asked about the virtual tour feature of CTTP models and programmes editor as well as the editor's waiting times. The former was created to facilitate a user on the creation of the CTTP models and programmes. This was deemed necessary as elsewhere, the user would need to go through several documents to be in a position to create CTTP models and programmes. As shown in Figure 17a, all of the participants either agreed (4 out of 12) or strongly agreed (8 out of 12) that this feature is useful.