A Review of Cyber-Ranges and Test-Beds: Current and Future Trends

1. Introduction

• Cyberattacks are growing in number and complexity, with deeper consequences and increased targeting of critical infrastructure and the public.The passage also notes that global events such as the COVID-19 pandemic fueled this impact.Source: §1 · p. 1
• Cyber-ranges and test-beds emulate adaptable IT and OT networks, respectively, where users can train to identify attacks and practice mitigation strategies.Scenarios can vary in attack type and complexity, and teams can train remotely on coordinated responses.Source: §1 · p. 2
• The paper presents an extensive analysis of cyber-ranges and test-beds and develops two taxonomies describing their dimensions.The authors describe this review as addressing a resource gap for researchers.Source: §1 · p. 2

2.1. Overview

• The review follows a systematic process of planning, selection, extraction, and execution, using existing literature and sector practices to examine cyber-range and test-bed knowledge.It frames prediction of future training needs amid evolving infrastructures as a challenge.Source: §2.1 · pp. 2–3

2.2. Aim and Objectives

• The review aims to map cyber-range and test-bed applications and training, classify platforms, examine threat analysis, and develop taxonomies informed by reported research.Its objectives include insights into future trends, technologies, application areas, and training for interconnected, multi-domain infrastructures.Source: §2.2 · p. 3

2.3. CRs and TBs Survey

• The survey establishes a reference of current platform features and training tools, with its test-bed search focused on Smart Grids and future-facing IoT and smart devices.It considered cyber-range applications in Military, Education, and Industry to examine threat dynamics and emerging countermeasures.Source: §2.3 · p. 3, §2.3.3 · pp. 3–4

2.3.1. Classification and Research Criteria

• The review considered publications from 2015–2020 and used cyber-range and test-bed search terms spanning defense, industry, education, IoT, Smart Grid, and Cloud.Relevant foundational research outside that period was also considered.Source: §2.3.1 · p. 3, §2.3.2 · p. 3

2.3.2. Selection Criteria

• Test-bed publication numbers increased across IoT, Smart Grid, and Cloud from 2015 to 2020.The review searched ScienceDirect, IEEE Explore, Springer, Wiley, and ACM, while also considering relevant research outside the stated period.Source: §2.3.2 · p. 3

2.3.3. Extraction Criteria and Results

• Springer’s IoT test-bed publications were 25% journal articles and 44% conference papers; Smart Grid conference proceedings were 11%, while Cloud conference proceedings were 80%.The cited percentages describe publication types in the reviewed databases.Source: §2.3.3 · p. 4, Figure 1 · p. 4
• 82% of cyber-range publications were research articles, compared with 13% book chapters and 5% review articles.ACM publication numbers grew from 2015 through 2019; ACM published more cyber-range papers than the other compared databases.Source: §2.3.3 · p. 4
• Cyber-range publications in ACM were concentrated in Education, while Wiley, ScienceDirect, Springer, and IEEE published more Industry papers than Education or Military papers.Across the three domains, ACM published more cyber-range papers than Wiley, ScienceDirect, Springer, and IEEE, in that order.Source: §2.3.3 · p. 5, Figure 3 · p. 5

3. Related Work

• Leblanc et al.’s 2011 survey classified 13 simulation-centric cyber-ranges by private, academic, and public-sector research, but its age limits predictive value.The authors cite advances in technology functionality and threat dynamics as the reason.Source: §3 · p. 6
• Davis and Magrath’s 2013 survey covered 30 public cyber-ranges and highlighted a trade-off between robust, functional environments and implementation costs.It described simulation-based ranges as scalable and emulation-driven ranges as more readily validated for performance.Source: §3 · p. 6
• A 2018 review defined an “Ideal CR” using the University of Delaware platform as a foundation but did not benchmark application needs for training, education, or research against recent and future threats.Source: §3 · p. 6
• Yamin et al. proposed a taxonomy organized around architecture, scenarios, capabilities, roles, and tools as a baseline for developing and evaluating cyber-ranges.Source: §3 · p. 6
• Earlier reviews’ conclusions have limited value for predicting future cyber-range and test-bed capabilities as technologies and threats rapidly develop.The authors argue that taxonomies need to be re-established in light of recent advances.Source: §3 · p. 6

4.1. Cyber-Ranges and Test-Beds

• The review’s five-year summary categorizes CRs and TBs across application, deployment, specialty, type, team, testing-environment, and experimentation dimensions.The table is presented as a basis for reviewing technological advancement.Source: §4.1 · pp. 6–7, Table 1 · p. 7
• Academic education and research account for 31% of 44 surveyed CRs, while enterprise/commercial and military/defense/intelligence applications each account for 24%.Government accounts for 15%; law enforcement, service providers, and open-source applications each constitute only 2% of the surveyed manuscripts.Source: §4.1 · p. 9
• Public and federated CRs each represent 30% of surveyed types, followed by private CRs at 24% and public-private combinations at 11%.Federated-public-private and federated-public combinations account for 3% and 2%, respectively.Source: §4.1 · p. 10
• Red-blue teams are the most common formation at 67%, and operational training constrains threat conditions because it can compromise business continuity.Red-blue-grey teams account for 9%; several other listed formations each account for 8%.Source: §4.1 · p. 10
• Simulation is the most common experimentation method at 60%, followed by emulation at 38%, overlay at 8%, and live demonstrations at 4%.Source: §4.1 · p. 10

4.2. Technologies

• CRs combine core technologies such as virtualization, simulation, containerization, and physical hardware, while many TBs rely on physical hardware for OT/IT training.Some CRs combine virtualization with physical hardware; TBs also use simulation and emulation.Source: §4.2 · p. 11

4.2.1. Core Technologies

• Hybrid virtualization and physical hardware can place operational and information technologies in one scenario, combining features of CRs and TBs.Source: §4.2.1 · p. 11
• Containers are more scalable than VMs, while VMs offer greater flexibility and security; the choice depends on need, with possible future cloud portability through merging.Containerization is described as a lightweight approach in which applications can be stored, transported, and deployed.Source: §4.2.1 · p. 11

5.1. CRs and TBs Scenarios

• TBs predominantly emulate attacks on critical infrastructure, while CRs more often simulate attacks on interconnected IT/OT networks.TB examples include relay disruption and false alarms; CR examples include SQL injection, ransomware and SCADA HMI attacks.Source: §5.1 · p. 17

5.1.1. Scenario Design, Validation and Deployment •

• Effective scenario design combines functional, non-functional and team requirements with attack trees grounded in vulnerability and impact assessment.This approach supports representative breach conditions and evaluation of countermeasures.Source: §5.1.1 · p. 17
• Scenario validation can automate checks against design errors before deployment, while tools such as CRACK and ADLES support scenario specification and deployment.ADLES also supports instructor-designed training scenarios, tutorials and competitions.Source: §5.1.1 · p. 17

5.2. CR and TB Applications

• CRs serve broad commercial, academic and military applications, while TBs are especially prevalent in Smart Grids and IoT.Smart Grid test-beds separate power-system and cyber/communication simulations because attacks can target both domains.Source: §5.2 · pp. 18–19

5.3. CR and TB Realisation

• Test-bed realization proceeds from infrastructure classification and vulnerability identification to software selection, modular verification, test creation and user training.The software choice depends on the application and infrastructure; a Smart Grid example combines OPAL-RT power simulation with a discrete-event network simulator.Source: §5.3 · p. 20

6. Analysis and Taxonomies

• The review establishes two taxonomies for CRs and TBs based on the literature, reflecting distinct services and training aims despite close coupling between the platforms.The review associates CRs chiefly with IT and TBs with OT environments.Source: §6 · pp. 20–21
• CR training is oriented toward users with a general understanding of simulated architecture, whereas TB use often requires domain knowledge.Source: §6 · p. 21
• The review concludes that the differences between CRs and TBs warrant separate taxonomies.Source: §6 · p. 21

6.1.1. Management

• CR management provides user interfaces for scenario and interaction data, dashboards, user roles and reporting.Source: §6.1.1 · p. 22

6.1.2. Monitoring

• CR monitoring tracks user progress and performance, supports remote-user connections and checks platform and scenario health.Source: §6.1.2 · p. 22

6.1.3. Econometrics

• The econometrics component evaluates the economic impact of users’ actions in scenarios as one way to estimate situational awareness.Source: §6.1.3 · p. 22

6.1.4. Types

• Hardware-based CRs support operational-technology training, while simulation/emulation CRs offer scalability and lower cost but may struggle to reproduce architecture accurately.Federated CRs connect platforms for scenarios spanning environments; hybrid CRs combine hardware and software solutions for scalability and affordability.Source: §6.1.4 · p. 23

6.1.5. Teaming

• CR team roles span platform management, security enhancement, education and scenario development, defense, offense and combined defensive-offensive skills.Source: §6.1.5 · p. 24

6.1.6. Recovery

• The recovery component maintains CR operations, updates policies and patches, backs up data and restricts attacks from spilling beyond the range.It also supports post-incident digital forensics.Source: §6.1.6 · p. 24

6.1.7. Attack Types

• The attack-types component describes scenario attacks and their security configurations, with vulnerabilities mapped at high and low levels against the OSI model.Source: §6.1.7 · p. 24

6.1.8. Scenarios

• CR scenarios combine a narrative and domain with education, gamification and either static single-goal or dynamically evolving objectives.Education can include tutoring, scoring, demonstration, analysis and review of user actions.Source: §6.1.8 · p. 24

6.2.1. Education

• The TB education component explores security scenarios and can assess formative learning and ease of implementation.Source: §6.2.1 · p. 24

6.2.2. Model

• The modelling component creates and processes an innovation model in a controlled environment under specified constraints.Source: §6.2.2 · p. 25

6.2.3. Generation

• The generation component supplies information about underlying technologies and vendors to inform an innovation’s features and deployment.Source: §6.2.3 · p. 25

6.2.4. Execution

• Real-time, configuration-based remote creation of an innovation provides insight into its effects on the system being modelled or tested.Testing resilience also entails evaluating system behaviour across execution scenarios in a controlled test-bed environment.Source: §6.2.4 · p. 25

6.2.5. Evaluation

• TB model evaluation may be manual, with human intervention, or automatic, using an algorithm based on key system variables.Source: §6.2.5 · p. 25

6.2.6. Management

• Management components provide user interfaces, traffic management, activity logs, reports, and feedback; accurate energy-cyber interdependency models support attack-impact evaluation and countermeasure selection.SCADA Test-Beds may use Human Machine Interfaces server software, software-based Relay Terminal Units, and Relay Programmers.Source: §6.2.6 · p. 25

6.2.7. Types

• Hybrid Test-Beds combine cyber and physical environments, using networked and isolated hardware and software to provide operational-technology training, scalability, and affordability.Source: §6.2.7 · p. 26

6.2.8. Post-Incident

• Post-incident investigation reviews incidents from start to finish; standard reviews detail each phase, while forensics scientifically collects, validates, identifies, analyzes, and interprets digital evidence.Situation-awareness reviews require cross-functional participation to determine an attack’s root cause and full scope.Source: §6.2.8 · p. 26

6.2.9. Recovery

• Recovery keeps policies current, maintains operational state, and supports regular backups; after incidents, it also supports forensics and helps isolate systems under investigation.Source: §6.2.9 · p. 26

6.2.10. Attacks

• The Attack component describes potential attacks and scenario security configurations, mapping a vulnerability database’s high- and low-level descriptions to the OSI model.Source: §6.2.10 · p. 26

6.2.11. Trainee

• The Trainee component records domain knowledge, module progress, and performance measures, usually presenting reports through a trainee dashboard.Source: §6.2.11 · p. 26

• The training framework groups methods into coach-trainee approaches using courses, certification, and presentations, and newer approaches relying more on gamification and video-assisted techniques.Source: §7 · p. 26
• Classical training moves from acquiring facts to organizing them and critically analyzing them, supporting timely responses to malicious activity and cyber-situation awareness.Its coach-to-trainee information flow is generally one-way, as in courses and presentations where trainees passively receive information.Source: §7 · pp. 26–27
• Cyber-Ranges create realistic scenarios for response training, while Test-Beds emulate attack impacts, let trainees adjust attack parameters and test responses, and report infrastructure security across scenarios.Test-Beds provide the practical elements of training.Source: §7 · p. 27
• Training methods include gamification to increase engagement and motivation, mock attacks that tailor training to user reactions, and role-based scenarios assigning roles such as attacker, defender, or instructor.Attacker-centric gamification lets trainees assume attacker roles; role assignments may vary by exercise and be customized to emulate enterprises.Source: §7 · p. 27
• Hands-on competitions, including Capture-the-Flag and Cyber Defense Exercises, aim to develop problem-solving, proficiency, teamwork, and cyber-defense skills in real-world scenarios.Source: §7 · p. 27

8.1.1. AI-based Attacks

• AI-enhanced attacks, including malware, voice synthesis, password attacks, social bots, and adversarial training, target interconnected smart cyber-physical systems; their growth has prompted calls for adapted training.The review links the trend to cyber-criminal use of AI and deep and reinforcement learning, [88].Source: §8.1.1 · p. 28

8.1.2. Bio-Inspired Attacks

• Bio-inspired attacks include BSA- and PSO-based active system identification and transmissive attacks that use epidemic models to propagate stealthily without requiring network-topology knowledge [100].Source: §8.1.2 · p. 28

8.2. Threat Analyses

• Threat analysis identifies exploitable threats, weaknesses, and vulnerabilities to inform prevention and mitigation; security-performance metrics remain a challenge for assessing network robustness.Source: §8.2 · p. 28

8.2.1. Intrusion Detection System

• IDS effectiveness involves detection, false-positive rates, transparency, safety, memory, power, and throughput; classical signature and anomaly-based systems have limits in distinguishing novel attacks from normal traffic.Machine-learning and AI-based IDS, including an ANN approach for detecting DoS and DDoS attacks in IoT networks, are proposed as alternatives [108].Source: §8.2.1 · pp. 28–29

8.2.2. Modelling-based Approach

• Threat models for unknown attacks depend on the system’s actual vulnerabilities and security defaults, as well as local network configuration and architecture.Examples include [S-TLA+] for reconstructing VoIP attack evidence and an integrated modeling and simulation tool chain for assessing smart-building security.Source: §8.2.2 · p. 29

9.1. Future Trends •

• Automated range tools build or prepare cyber-range infrastructure from configuration files or specifications, while ALPACA uses AI planning, vulnerability data, and machine-specific parameters to generate vulnerable virtual machines.ALIVE automates virtual machines and network components; CyRIS assists scenario managers or instructors with infrastructure and security settings.Source: §9.1 · pp. 29–30
• Pharos supports repeatable evaluation of mobile cyber-physical systems in live networks, while Cybertropolis combines virtual ICT with live cyber-physical, RF, and IoT systems.Augmented-reality ranges may visualize attack progression, support portable training, and allow new scenarios to be added.Source: §9.1 · p. 30

9.2. Future Technologies •

• 5G/6G capabilities, including low latency, bandwidth, and machine-to-machine communication, are presented as opportunities for faster, lower-latency range deployments using virtual machines, sandboxes, or containers.Source: §9.2 · pp. 30–31
• Compared with pre-copy VM migration, LXD/CR container migration reduced downtime by 76.66%, migration time by 65.55%, data transferred by 76.63%, pages transferred by 76.78%, CPU utilization costs by 55.89%, and RAM utilization costs by 76.52%.The review also describes container-based platforms as supporting scalability, portability, flexibility, extensibility, and easier deployment.Source: §9.2 · p. 31

9.3. Future Application Areas •

• Smart cyber-physical systems’ use of multiple data streams and AI-enabled processes coincides with more sophisticated automated attacks, motivating range training for detection and mitigation.Source: §9.3 · p. 31
• Future factories, smart cities, aerospace, and satellite infrastructure present application areas for cyber-range and Test-Bed research, with aerospace and satellite modeling requiring attention to infrastructure components and sensitive information.CyberFactory#1 addresses security threats associated with digital factories; the review also identifies predicting attacker strategies as central to choosing countermeasures.Source: §9.3 · pp. 31–32

• The review evaluates prominent Cyber-Range and Test-Bed platforms by type, technology, threat scenarios, applications, and attainable training scope.Source: §10 · p. 32
• A novel taxonomy for Cyber-Ranges and Test-Beds is presented as a foundation for predicting their evolution.Source: §10 · p. 32
• Training in non-operational environments should provide real-time threat information, early identification and characterisation, and effective countermeasures.Source: §10 · p. 32
• Automation has accentuated a rapidly diminishing differentiation between Cyber-Ranges’ and Test-Beds’ respective application areas.Source: §10 · p. 32