*5.1. Components*

The components developed and deployed to verify the architecture will be described in this section. All of the developed components used Python [119–121] as the implementation language.

Following the same order as in previous sections, the data collectors were developed beforehand:


Regarding the database, Elastic Search was chosen along with Elastic Common Schema as the data model.

In addition, the data preprocessing components (Section 4.3) that were developed are the following:


**Figure 3.** Digital twin.

Furthermore, the developed machine learning components (Section 4.4) used for verifying the architecture were the following:


A model repository component was also used where pre-trained models were stored in order to feed the components which require them.

Big data statistics, the hypothesis generator, ML sequence presets and data exchangers components were also developed. It is considered interesting to highlight that data exchangers were able to query data from MITRE ATT&CK [122–124] as well as export data using STIX.

In order to interact with the system, an HMI and an External Access Gateway were also developed, acting as proxy to authenticate and authorize the requests before forwarding them to the available data exchangers.

Lastly, RabbitMQ [125–127] was used as a communications broker and a component which the OAuth 2.0 protocol implements was developed in order to manage the authentication.
