Digital Twin-Driven Intrusion Detection for Industrial SCADA: A Cyber-Physical Case Study

Area of Science:

• Cyber-Physical Systems Security
• Industrial Control Systems Security
• Digital Twin Technology

Background:

• The integration of operational technology (OT) and information technology (IT) expands the attack surface of Supervisory Control and Data Acquisition (SCADA) systems in critical infrastructure.
• Traditional intrusion detection systems (IDS) are insufficient for detecting sophisticated, process-level cyber-attacks targeting industrial environments.
• Water treatment plants exemplify critical infrastructure vulnerable to SCADA system compromises.

Purpose of the Study:

• To propose and evaluate a novel Digital Twin-driven Intrusion Detection (DT-ID) framework for enhancing SCADA system security.
• To address the limitations of conventional IDS in detecting stealthy, process-level attacks.
• To demonstrate the efficacy of integrating cyber-physical digital twins for critical infrastructure protection.

Main Methods:

• Development of a DT-ID framework incorporating high-fidelity process simulation and real-time sensor modeling.
• Integration of adversarial attack injection capabilities for realistic threat simulation.
• Implementation of hybrid anomaly detection combining physical residuals and machine learning algorithms.

Main Results:

• The DT-ID framework achieved a 96.3% F1-score in detecting various attacks (FDI, DoS, command injection) in a simulated water treatment plant.
• The system demonstrated a false positive rate below 2.5% and an average detection latency under 500 ms.
• Significant improvements in identifying stealthy anomalies compared to rule-based and physics-only IDS were observed.

Conclusions:

• Cyber-physical digital twins offer a promising approach to bolster SCADA security in critical infrastructure.
• The DT-ID framework provides a robust solution for detecting advanced threats in industrial control systems.
• This research underscores the potential of advanced simulation and hybrid detection methods for cybersecurity in the operational technology domain.