# Digital Twin-based Intrusion Detection for Industrial Control Systems

arXiv: https://arxiv.org/abs/2207.09999 · HTML: https://mlsanity.com/paper/2207.09999/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 3 of its 22 references that are in the map.
- First posted on arXiv 20 Jul 2022.

## Builds on (most cited first, 3 of 3)

- [Machine Learning Based Network Vulnerability Analysis of Industrial Internet of Things](https://mlsanity.com/paper/1911.05771/) (2019)
- [MiniCPS: A toolkit for security research on CPS Networks](https://mlsanity.com/paper/1507.04860/) (2015)
- [Synchronization in Digital Twins for Industrial Control Systems](https://mlsanity.com/paper/2006.03447/) (2020)

## Built on by (most cited first, 2 of 2)

- [Anomaly Detection Dataset for Industrial Control Systems](https://mlsanity.com/paper/2305.09678/) (2023)
- [DETECTA 2.0: Research into non-intrusive methodologies supported by Industry 4.0 enabling technologies for predictive and cyber-secure maintenance in SMEs](https://mlsanity.com/paper/2405.15832/) (2024)

## Abstract (arXiv)

Digital twins have recently gained significant interest in simulation, optimization, and predictive maintenance of Industrial Control Systems (ICS). Recent studies discuss the possibility of using digital twins for intrusion detection in industrial systems. Accordingly, this study contributes to a digital twin-based security framework for industrial control systems, extending its capabilities for simulation of attacks and defense mechanisms. Four types of process-aware attack scenarios are implemented on a standalone open-source digital twin of an industrial filling plant: command injection, network Denial of Service (DoS), calculated measurement modification, and naive measurement modification. A stacked ensemble classifier is proposed as the real-time intrusion detection, based on the offline evaluation of eight supervised machine learning algorithms. The designed stacked model outperforms previous methods in terms of F1-Score and accuracy, by combining the predictions of various algorithms, while it can detect and classify intrusions in near real-time (0.1 seconds). This study also discusses the practicality and benefits of the proposed digital twin-based security framework.