# NotLine

> NotLine is a non-intrusive, automated platform that builds and continuously updates a
> digital twin of ICT/OT network infrastructures through passive monitoring. It reconstructs
> the network topology and supports risk assessment without sending any traffic into the
> monitored network. It is a research platform developed at the University of Pisa.

- **Site:** https://ilsamaritano.github.io/notline/
- **Authors:** Fabrizio Baiardi, Vincenzo Sammartino, Salvatore Ruggieri — University of Pisa
- **Contact:** via https://ilsamaritano.github.io/#contact

## Key facts

- **Passive only:** NotLine listens to traffic that is already on the network. It sends no
  probes and runs no active scans, so it can be used on industrial systems that must not be scanned.
- **What it produces:** a structural and behavioural model of the network (hosts, links, who
  talks to whom) that serves as its digital twin.
- **Continuously updated:** monitoring does not stop, so the twin follows the network as it changes.
- **Built on:** the open-source network monitors Zeek and ntopng.
- **Used for:** network visibility, topology reconstruction, risk assessment, and as the model
  behind a Security Twin, where attacker behaviour is simulated instead of tested on live systems.
- **Trade-off:** like any passive approach, a host becomes visible only once it communicates.

## Publications

- F. Baiardi, V. Sammartino, S. Ruggieri. *NotLine: A Non-Intrusive Automated Platform to Build
  a Digital Twin.* 29th International Symposium on Distributed Simulation and Real Time
  Applications (DS-RT 2025), IEEE. https://doi.org/10.1109/DS-RT68115.2025.11185873
- V. Sammartino. *NotLine: Dynamic Network Topology and Risk Assessment Through Passive
  Discovery.* Poster, FAIR General Conference, Rome, 10–12 December 2025.
  https://arpi.unipi.it/handle/11568/1338870

## Notes for crawlers

Single static page (HTML, CSS and JavaScript, no build step); all content is present in the
served HTML. The network animation on the page is an illustrative simulation, not live data.
schema.org JSON-LD is embedded in the page. Indexing and citation are allowed.