Addressing Cybersecurity Data and Workforce Scarcity with TROY: Testbed for Resilient Operational sYstems

The advent and proliferation of machine learning techniques across industries has led to a gold rush for one commodity: data. However, in many niche fields of cybersecurity with sensitive information, data is often non-existent or not publicly available. This has required researchers to simulate scenarios and craft testbeds for specific use cases to gain the data necessary to train models, teach students, and test realistic attack and defense scenarios. However, many of these datasets and testbeds use outdated attacks and protocols, have insufficient system and network fidelity, simulate unrealistic network topologies, and lack the heterogeneity needed for machine learning applications. Thus, a multi-faceted cybersecurity testbed is proposed: TROY: Testbed for Resilient Operational sYstems. This collaborative project implements a virtualized and easily reproducible IT/OT network according to the NIST 800-82r3 guidelines with active services ranging from DNS, IDS, email, historians, webservers, Hardware-in-the-Loop (HIL) systems, Supervisory Control and Data Acquisition (SCADA), and more. In this paper, we first survey and compare existing open-source cybersecurity datasets and testbeds. We then outline the design and approach of TROY dictated by the NIST 800-82r3 guidelines and discuss the improvements it makes over existing testbeds. Finally, we discuss its applications in cybersecurity experimentation, data generation, and workforce development.