Search papers, labs, and topics across Lattice.
This paper introduces a framework for detecting cyber physical attacks by monitoring temporal inconsistencies between a Digital Twin (DT) and its physical counterpart, addressing the challenge of DT degradation in adversarial environments. By training a DT predictor on normal system behavior, the authors transform discrepancies into multi-horizon temporal features that capture the dynamics of prediction residuals. Evaluated on three Industrial Control System datasets, the method achieves up to 98% detection reliability with low false alarm rates, highlighting the potential of DT degradation as a valuable signal for security monitoring.
Temporal inconsistencies in Digital Twins can serve as powerful indicators of cyber physical attacks, achieving up to 98% detection reliability without needing labeled attack data.
Digital Twins (DTs) are increasingly used to monitor and analyze Cyber Physical Systems (CPS). However, in adversarial environments, the fidelity of a DT cannot be assumed. Communication delays, data manipulation, sensor degradation, or partial information loss may cause the DT state to diverge from the physical process it represents. Such divergence creates temporal inconsistencies that may reveal cyber physical attacks. This paper proposes a detection framework that monitors temporal consistency between the physical system and a potentially degraded DT view. A DT predictor is trained exclusively on normal system behavior to model short-term system dynamics. During operation, discrepancies between predicted and observed states are transformed into multi-horizon temporal features capturing the magnitude, persistence, and evolution of prediction residuals. An unsupervised density model characterizes normal consistency patterns, while a sequential change detection mechanism identifies sustained deviations indicative of attacks. The approach is evaluated on three widely used Industrial Control System (ICS) datasets, SWaT, HAI, and BATADAL, under multiple DT degradation scenarios, including time desynchronization and partial observability loss. Results show that temporal inconsistency patterns enable reliable event-level attack detection with bounded false alarm rates and low detection latency. The proposed method achieves up to 98% detection reliability on SWaT and false alarm rates below 2%. Unlike conventional anomaly detection methods, the proposed framework does not require attack signatures or labeled attack data and remains effective even when the DT view is degraded. These results suggest that DT degradation, often treated as a limitation, can instead serve as a useful signal for cyber physical security monitoring.
