# Causal Digital Twins for Cyber-Physical Security: A Framework for Robust Anomaly Detection in Industrial Control Systems

arXiv: https://arxiv.org/abs/2510.09616 · HTML: https://mlsanity.com/paper/2510.09616/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 3 of its 31 references that are in the map.
- First posted on arXiv 16 Sep 2025.

## Builds on (most cited first, 3 of 3)

- [Detecting Cyberattacks in Industrial Control Systems Using Convolutional Neural Networks](https://mlsanity.com/paper/1806.08110/) (2018)
- [A Review of Digital Twins and their Application in Cybersecurity based on Artificial Intelligence](https://mlsanity.com/paper/2311.01154/) (2023)
- [Causal discovery in a complex industrial system: A time series benchmark](https://mlsanity.com/paper/2310.18654/) (2023)

## Built on by (most cited first, 4 of 4)

- [Graph Attention Networks with Physical Constraints for Anomaly Detection](https://mlsanity.com/paper/2601.12426/) (2026)
- [Cyber-Resilient Digital Twins: Discriminating Attacks for Safe Critical Infrastructure Control](https://mlsanity.com/paper/2603.18613/) (2026)
- [Ti-iLSTM: A TinyDL Approach for Logic-Level Anomaly Detection in Industrial Water Treatment Systems](https://mlsanity.com/paper/2605.15874/) (2026)
- [Physics-Constrained Digital Twins for Sensor Integrity in Urban Pedestrian Flow: Detecting Stealthy False Data Injection with Conformal Guarantees](https://mlsanity.com/paper/2609.17635/) (2026)

## Abstract (arXiv)

Industrial Control Systems (ICS) in water distribution and treatment face cyber-physical attacks exploiting network and physical vulnerabilities. Current water system anomaly detection methods rely on correlations, yielding high false alarms and poor root cause analysis. We propose a Causal Digital Twin (CDT) framework for water infrastructures, combining causal inference with digital twin modeling. CDT supports association for pattern detection, intervention for system response, and counterfactual analysis for water attack prevention. Evaluated on water-related datasets SWaT, WADI, and HAI, CDT shows 90.8% compliance with physical constraints and structural Hamming distance 0.133 ± 0.02. F1-scores are 0.944 ± 0.014 (SWaT), 0.902 ± 0.021 (WADI), 0.923 ± 0.018 (HAI, p<0.0024). CDT reduces false positives by 74%, achieves 78.4% root cause accuracy, and enables counterfactual defenses reducing attack success by 73.2%. Real-time performance at 3.2 ms latency ensures safe and interpretable operation for medium-scale water systems.