## 3 State of the Art in Digital Twins and Cyber-Ranges
### Cyber-Range Concept and Definition  
The term of Cyber-Range (CR) is probably less popular than that of DT and potentially even more ambiguous as it was originally forged in the context of military use for cyber-defense professional training, before it became a standard of the cybersecurity industry to designate more widely simulation, testing and training platforms. It takes its roots in an analogy with Shooting Ranges, which are specialized facilities designed for firearms qualifications, training or practice [104]. The rationale for broadening the definition and scope of application of CRs is that an IT network simulation capacity, realistic enough to support training of cybersecurity professionals, can equally serve a number of other use-cases. CRs have been used as testbeds for the development of novel detection algorithms, as virtual environment for the demonstration of new security products [105], as a means for massive realistic data generation to train novel AI algorithms [106], as testing environment for the certification of IT and security equipment [107] and as instruments for decision making in cyber-incident response [108]. The classical attributes of a Cyber-Range are:  
* Deployment mode: CR platforms can be fixed, mobile or hosted in the cloud. Fixed CRs answer the need for permanent training in dedicated premises with high performance servers and the ability to scale-up or customize simulation capacity. Mobile CRs enable supporting temporary use in events such as hackathons. They are less scalable but more flexible for non-permanent uses. Cloud-hosted CRs enable supporting geographically distributed exercises with minimal computing configuration. * Traffic generator: To reproduce realistic conditions of a cyber-defense scenario, most cyber-ranges are offered with one or several traffic generators or which inject real network traffic or emulate human activity on the system. Legitimate traffic is generated in requested quantity and diversity to produce the noise characteristic of real conditions. Attack traffic is generated to test detection performance and reaction ability of the blue team. Most CRs enable recording and replaying recorded traffic in virtual infrastructures. * Virtual Machines (VMs): Most cyber-ranges replicate physical IT infrastructure in virtual environments by the use of VMs such as VMware and Docker. The performance of CRs and their scalability greatly depend on that of VM technologies underneath, as do their limitations. Network frames are commonly managed by a distributed virtual switch. This component creates virtual networks associated with a VLAN number and from which the virtual machines are connected. * Catalogues: CRs may offer a variety of catalogues containing elementary templates of Operating Systems (OS), servers, other network equipment and security appliances such as firewalls and Intrusion Detection Sensors (IDS) or known cyber-threats, as well as complex training and testing scenarios to choose from in the preparation of exercises. In some CRs, catalogues can be enriched by the users in a collaborative mode. * Design interface: Most CRs provide an interface enabling users to model virtual IT infrastructure and create own scenarios based on catalogue content and, in some cases, own real or virtual equipment. They typically rely on web and micro-services, simplifying the deployment of virtualized infrastructures. Topologies are created in separate work zones and can be stored in libraries for future reuse. Topologies from different work zones may however be brought together to form more complex topologies. Execution conditions of the attacks (source, destination, frequency and any specific parameters) can be set by the user in this interface. Users with administrator privilege can add or modify attacks. They can also export/import attacks to make them available to other users.