Scholarlink

<p>Industrial Control Systems (ICS) face escalating cyber threats as adversaries increasingly exploit artificial intelligence (AI) to evade conventional defenses. This paper introduces a Digital Twin-enhanced security framework in which a real-time, physics-consistent virtual replica of the controlled industrial process is synchronized with sensor and actuator telemetry from the physical plant and used to validate, suppress, or confirm anomaly scores produced by a deep-learning ensemble. The physical twin is the closed-loop ICS plant (water treatment, water distribution, or chemical process); the Digital Twin is a state-space process model coupled to an Extended Kalman Filter that predicts the next sensor measurement and emits a residual whenever the observation deviates from the physics-consistent prediction. The detection layer combines this Digital-Twin residual signal with a Long Short-Term Memory (LSTM) autoencoder, an attention-based transformer, and an Isolation Forest, fused through a calibrated weighted score that is gated by the residual, so that purely data-driven anomalies that do not violate physics are downweighted and stealthy attacks that violate physics are escalated. Evaluated on three benchmark datasets (Secure Water Treatment testbed [SWaT], Water Distribution [WADI], and Tennessee Eastman) comprising 56 attack scenarios, the framework achieves 97.6% precision, 96.2% recall, an F1-score of 96.9%, and sub-50&#xa0;ms inference latency. This corresponds to a 3.2 percentage-point F1-score improvement over the strongest baseline (transformer at 93.7%) and a roughly 50% reduction in residual error. Interpretability is supported through attention visualization and Digital-Twin residual analysis, enabling operators to validate detection outcomes. With native Message Queuing Telemetry Transport (MQTT) and Open Platform Communications Unified Architecture (OPC UA) integration, Byzantine fault-tolerant consensus for distributed deployments, and formal verification of safety properties, the framework supports deployment-oriented protection for critical infrastructure aligned with International Electrotechnical Commission (IEC) 62443-4-2 requirements.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

A digital twin and deep-learning ensemble for cyber attack detection in industrial control systems at the IoT edge

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年5月22日

查看全文
  • Ali Sayghe,
  • Mohammad D. Alahmadi,
  • Abdulrahman A. Gharawi

摘要

Industrial Control Systems (ICS) face escalating cyber threats as adversaries increasingly exploit artificial intelligence (AI) to evade conventional defenses. This paper introduces a Digital Twin-enhanced security framework in which a real-time, physics-consistent virtual replica of the controlled industrial process is synchronized with sensor and actuator telemetry from the physical plant and used to validate, suppress, or confirm anomaly scores produced by a deep-learning ensemble. The physical twin is the closed-loop ICS plant (water treatment, water distribution, or chemical process); the Digital Twin is a state-space process model coupled to an Extended Kalman Filter that predicts the next sensor measurement and emits a residual whenever the observation deviates from the physics-consistent prediction. The detection layer combines this Digital-Twin residual signal with a Long Short-Term Memory (LSTM) autoencoder, an attention-based transformer, and an Isolation Forest, fused through a calibrated weighted score that is gated by the residual, so that purely data-driven anomalies that do not violate physics are downweighted and stealthy attacks that violate physics are escalated. Evaluated on three benchmark datasets (Secure Water Treatment testbed [SWaT], Water Distribution [WADI], and Tennessee Eastman) comprising 56 attack scenarios, the framework achieves 97.6% precision, 96.2% recall, an F1-score of 96.9%, and sub-50 ms inference latency. This corresponds to a 3.2 percentage-point F1-score improvement over the strongest baseline (transformer at 93.7%) and a roughly 50% reduction in residual error. Interpretability is supported through attention visualization and Digital-Twin residual analysis, enabling operators to validate detection outcomes. With native Message Queuing Telemetry Transport (MQTT) and Open Platform Communications Unified Architecture (OPC UA) integration, Byzantine fault-tolerant consensus for distributed deployments, and formal verification of safety properties, the framework supports deployment-oriented protection for critical infrastructure aligned with International Electrotechnical Commission (IEC) 62443-4-2 requirements.