Cyber-Resilient Digital Twins: Discriminating Attacks for Safe Critical Infrastructure Control

TL;DR

This paper introduces i-SDT, a novel digital twin framework that detects, discriminates, and responds to cyber-attacks in industrial systems, enhancing safety, reducing false alarms, and lowering operational costs with real-time capabilities.

Contribution

The paper presents a new cyber-resilient digital twin approach combining advanced predictive modeling, attack discrimination, and adaptive control for industrial cyber-physical systems.

Findings

Improved attack detection accuracy

44.1% reduction in false alarms

56.3% lower operational costs

Abstract

Industrial Cyber-Physical Systems (ICPS) face growing threats from cyber-attacks that exploit sensor and control vulnerabilities. Digital Twin (DT) technology can detect anomalies via predictive modelling, but current methods cannot distinguish attack types and often rely on costly full-system shutdowns. This paper presents i-SDT (intelligent Self-Defending DT), combining hydraulically-regularized predictive modelling, multi-class attack discrimination, and adaptive resilient control. Temporal Convolutional Networks (TCNs) with differentiable conservation constraints capture nominal dynamics and improve robustness to adversarial manipulations. A recurrent residual encoder with Maximum Mean Discrepancy (MMD) separates normal operation from single- and multi-stage attacks in latent space. When attacks are confirmed, Model Predictive Control (MPC) uses uncertainty-aware DT predictions to keep operations safe without shutdown. Evaluation on SWaT and WADI datasets shows major gains in detection accuracy, 44.1% fewer false alarms, and 56.3% lower operational costs in simulation-in-the-loop evaluation. with sub-second inference latency confirming real-time feasibility on plant-level workstations, i-SDT advances autonomous cyber-physical defense while maintaining operational resilience.