Cyber-Resilient Digital Twins: Discriminating Attacks for Safe Critical Infrastructure Control
This work addresses cyber-attack discrimination for critical infrastructure control, offering an incremental improvement over existing methods that cannot distinguish attack types and rely on costly shutdowns.
The paper tackled the problem of distinguishing cyber-attack types in Industrial Cyber-Physical Systems using Digital Twin technology, achieving major gains in detection accuracy, 44.1% fewer false alarms, and 56.3% lower operational costs in evaluations on SWaT and WADI datasets.
Industrial Cyber-Physical Systems (ICPS) face growing threats from cyber-attacks that exploit sensor and control vulnerabilities. Digital Twin (DT) technology can detect anomalies via predictive modelling, but current methods cannot distinguish attack types and often rely on costly full-system shutdowns. This paper presents i-SDT (intelligent Self-Defending DT), combining hydraulically-regularized predictive modelling, multi-class attack discrimination, and adaptive resilient control. Temporal Convolutional Networks (TCNs) with differentiable conservation constraints capture nominal dynamics and improve robustness to adversarial manipulations. A recurrent residual encoder with Maximum Mean Discrepancy (MMD) separates normal operation from single- and multi-stage attacks in latent space. When attacks are confirmed, Model Predictive Control (MPC) uses uncertainty-aware DT predictions to keep operations safe without shutdown. Evaluation on SWaT and WADI datasets shows major gains in detection accuracy, 44.1% fewer false alarms, and 56.3% lower operational costs in simulation-in-the-loop evaluation. with sub-second inference latency confirming real-time feasibility on plant-level workstations, i-SDT advances autonomous cyber-physical defense while maintaining operational resilience.