NotLine: A Non-Intrusive Automated Platform to Build a Digital Twin

Digital twin technology is revolutionizing cyber-security by providing real-time, data-driven replicas of ICT infrastructures without impacting live production systems. We present NotLine, a non-intrusive, fully automated pipeline platform that builds and updates digital twins through the continuous passive collection of multiprotocol network traffic metadata. NotLine filters and normalizes the data to remove noise and then correlates events to generate a dynamic topology graph. This non-intrusive approach enhances network monitoring and mitigates the risks and overhead associated with active scanning. It also offers superior scalability and enables continuous threat hunting, risk assessment, and accelerated remediation. The resulting digital twin extends traditional static inventories with real-time vulnerability mapping through CVE lookups. It also supports AI -driven adversary simulations based on Monte Carlo methods. Furthermore, we explore how integrating non-intrusive host-level telemetry, threat intelligence feeds, and re-inforcement learning can evolve the digital twin into a self-optimizing cybersecurity guardian. Experiments in production environments demonstrate that passive monitoring over extended periods, spanning multiple days, is essential for accurately capturing daily and weekly usage patterns across diverse protocol families. A quantitative analysis is presented that establishes benchmarks for digital twin fidelity in networked environments.