Virtual city prepares students for future of cybersecurity

The University of Arizona is training the next generation of cybersecurity professionals using CyberApolis, a virtual city built for online education and hosting cyber intelligence operations and training.

The virtual learning environment, designed in the College of Applied Science and Technology, includes a bank, hospital, large retailer, water company, power companies, an underground hacker community, an organized crime family and a growing number of smaller retailers.

It is also home to more than 15,000 virtual personas, developed by analyzing data from Twitter. Patterns in that data were used to create specific personality profiles, run by a sophisticated artificial intelligence program. Each virtual persona has more than 60 fictional data points, including full names and addresses, social security numbers, credit card information, and login credentials for social media, banking, retail and medical accounts.

Jason Denno, executive director of the college's Cyber Convergence Center, says CyberApolis is best described as a virtual city built within a closed system controlled by the university.

"We built a synthetic world that looks and feels exactly like the internet, without being on the internet," Denno said. "We have over 100 different companies, as well as five fully operational social media sites and two online news agencies like CNN and Fox News.

"Living in this virtual city are virtual personas that do everything normal humans do: They email each other, browse the web, conduct transactions in stores, maintain bank accounts, leave social media posts and comment on news stories."

The virtual learning environment is central to the College of Applied Science and Technology's cyber operations curriculum. CyberApolis acts as a secure and controlled training ground for students to practice and hone their cybersecurity skills, preparing them for real-world challenges in the field without exposing them to the risks associated with performing the same work on the open internet.

The platform can simulate various cyberattack scenarios, which allows students to gain hands-on experience identifying, mitigating and responding to threats in a secure and controlled environment.

The college is one of 24 in the nation with the National Security Agency's Center of Academic Excellence in Cyber Operations designation, as part of The National Centers of Academic Excellence in Cybersecurity program managed by NSA's National Cryptologic School. The program establishes educational standards for cybersecurity curriculum and works to develop solutions to challenges facing cybersecurity education. The program offers designations in cyber defense, research and operations.

UArizona will take its virtual city and all 15,000 of its residents on the road this month when representatives from the college and the University of Arizona Applied Research Corporation, also known as UA-ARC, showcase CyberApolis at a booth at the National TechNet Augusta conference, which takes place Aug. 14–17 in Georgia. UA-ARC was established to help leverage the university's strengths to facilitate mutually beneficial collaborations in the national security environment that require special compliance considerations.

The TechNet conference is hosted by the Armed Forces Communications and Electronics Association and is a forum for members of the U.S. Department of Defense, armed services and other intelligence professionals to discuss issues, share ideas and unveil products.

Austin Yamada, president and CEO of UA-ARC, said CyberApolis is not only the perfect tool for the university to use in educating the next generation of cyber professionals, but an extremely valuable asset for the Department of Defense and other national security interests to use in more restrictive operational environments. Tools such as CyberApolis could be used by other entities to teach both defensive and offensive strategies, tactics, techniques and procedures in a controlled environment, Yamada said.

"Creating and operating a sophisticated virtual environment like CyberApolis is no easy feat," he said. "CyberApolis is an extremely complex city in a virtual world. That is the perfect environment to teach these students how to do things like protect critical infrastructure from cyberattack and similar threats."

Other universities and the Department of Defense have already licensed CyberApolis for their own purposes, and the platform also hosts simulations for a variety of industries, such as finance and marketing, that allow companies to test different products and scenarios without allocating expenses to real-world assets and logistics.