Cyber-Resilient Digital Twins: Discriminating Attacks for Safe Critical Infrastructure Control

Mohammadhossein Homaei; Iman Khazrak; Rubén Molano; Andrés Caro; Mar Ávila

cs.CRMar 19, 2026

Cyber-Resilient Digital Twins: Discriminating Attacks for Safe Critical Infrastructure Control

Authors: Mohammadhossein Homaei, Iman Khazrak, Rubén Molano, Andrés Caro, Mar Ávila

Organizations: Departamento de Ingeniería de Sistemas Informáticos y Telemáticos, Universidad de Extremadura, Av. Universidad S/N, Escuela Politécnica, Cáceres, 10003, Extremadura, Spain · Department of Computer Science, Bowling Green State University, Bowling Green, 43403, OH, USA

Abstract

Industrial Cyber-Physical Systems (ICPS) face growing threats from cyber-attacks that exploit sensor and control vulnerabilities. Digital Twin (DT) technology can detect anomalies via predictive modelling, but current methods cannot distinguish attack types and often rely on costly full-system shutdowns. This paper presents i-SDT (intelligent Self-Defending DT), combining hydraulically-regularized predictive modelling, multi-class attack discrimination, and adaptive resilient control. Temporal Convolutional Networks (TCNs) with differentiable conservation constraints capture nominal dynamics and improve robustness to adversarial manipulations. A recurrent residual encoder with Maximum Mean Discrepancy (MMD) separates normal operation from single- and multi-stage attacks in latent space. When attacks are confirmed, Model Predictive Control (MPC) uses uncertainty-aware DT predictions to keep operations safe without shutdown. Evaluation on SWaT and WADI datasets shows major gains in detection accuracy, 44.1% fewer false alarms, and 56.3% lower operational costs in simulation-in-the-loop evaluation. with sub-second inference latency confirming real-time feasibility on plant-level workstations, i-SDT advances autonomous cyber-physical defense while maintaining operational resilience.

Figures & tables

Approach	Physics Informed	Attack Taxonomy	Uncertainty Aware	Resilient Control
TranAD (2022) ( Tuli et al., 2022 )	✗	✗	✗	✗
LGAT (2025) ( Wen et al., 2025 )	✗	✗	✗	✗
CDT (2026) ( Homaei et al., 2026 )	✓	✗	✗	✗
DT-MPC (2025) ( Zhang et al., 2025 )	✗	✗	✗	✓
Secure RMPC (2025) ( Xie et al., 2025 )	✗	✗	✗	✓
i-SDT (Proposed)	✓ †	✓	✓	✓

Table 1: Comparison of i-SDT with State-of-the-Art Approaches

Symbol	Description	Symbol	Description
System States and Signals
$\mathbf{X}(t)\in\mathbb{R}^{d_{x}}$	Physical state vector at time $t$	$\mathbf{u}(t)\in\mathbb{R}^{d_{u}}$	Control input vector at time $t$
$\mathbf{Y}_{\text{measured}}(t)$	Observed sensor measurements (potentially compromised)	$\hat{\mathbf{Y}}(t)$	Digital Twin predicted measurements
$\mathbf{R}(t)$	Residual vector: $\mathbf{Y}_{\text{measured}}(t)-\hat{\mathbf{Y}}(t)$	$\mathbf{R}_{W}(t)\in\mathbb{R}^{W\times d_{y}}$	Sliding residual window of length $W$
$\mathbf{X}_{\tau}(t)$	Temporal context window $[\mathbf{X}(t{-}\tau),\ldots,\mathbf{X}(t{-}1)]$	$\mathbf{z}(t)\in\mathbb{R}^{2d_{h}}$	ADE latent embedding vector
Noise and Uncertainty

Table 2: Nomenclature and Variable Definitions

Method	Normal ( $\mathcal{N}$ )			Single-Stage ( $\mathcal{A}_{S}$ )			Multi-Stage ( $\mathcal{A}_{M}$ )			Overall		MTTD (s)
Method	Prec.	Rec.	$F1$	Prec.	Rec.	$F1$	Prec.	Rec.	$F1$	FAR	$F1_{\mathcal{A}}$	MTTD (s)
OmniAnomaly ( Su et al., 2019 )	0.903	0.941	0.922	0.791	0.748	0.769	0.763	0.694	0.727	0.091	0.748	98.4
USAD ( Audibert et al., 2020 )	0.918	0.949	0.933	0.812	0.771	0.791	0.779	0.724	0.751	0.076	0.771	87.6
MTAD-GAT ( Zhao et al., 2020 )	0.931	0.958	0.944	0.836	0.803	0.819	0.804	0.771	0.787	0.067	0.803	74.2
TranAD ( Tuli et al., 2022 )	0.942	0.964	0.953	0.851	0.821	0.836	0.816	0.787	0.801	0.059	0.819	68.5
i-SDT ( $\gamma=0.80$ )	0.967 †	0.981 †	0.974 †	0.912 †	0.894 †	0.903 †	0.897 †	0.871 †	0.884 †	0.033 †	0.894 †	43.7 †

Table 3: Multi-class attack detection on SWaT (36 scenarios). All baselines evaluated via Linear Probing on frozen latent representations; this protocol structurally favours i-SDT whose encoder is natively regularised for taxonomy separation via MMD, and the reported gains should be interpreted accordingly. Bold = best, † = significant (

p<0.05

, paired bootstrap,

10^{4}

resamples). Evaluated on NVIDIA RTX 4070 (12 GB).

Method	Normal ( $\mathcal{N}$ )			Single-Stage ( $\mathcal{A}_{S}$ )			Multi-Stage ( $\mathcal{A}_{M}$ )			Overall		MTTD (s)
Method	Prec.	Rec.	$F1$	Prec.	Rec.	$F1$	Prec.	Rec.	$F1$	FAR	$F1_{\mathcal{A}}$	MTTD (s)
OmniAnomaly ( Su et al., 2019 )	0.881	0.928	0.904	0.717	0.669	0.692	0.694	0.631	0.661	0.119	0.677	112.7
USAD ( Audibert et al., 2020 )	0.897	0.939	0.918	0.749	0.703	0.725	0.718	0.662	0.689	0.098	0.707	95.3
MTAD-GAT ( Zhao et al., 2020 )	0.916	0.954	0.935	0.803	0.774	0.788	0.771	0.738	0.754	0.081	0.771	81.6
TranAD ( Tuli et al., 2022 )	0.924	0.958	0.941	0.814	0.786	0.800	0.783	0.749	0.766	0.074	0.783	76.9
i-SDT ( $\gamma=0.80$ , Proposed)	0.958 †	0.976 †	0.967 †	0.887 †	0.864 †	0.875 †	0.871 †	0.842 †	0.856 †	0.042 †	0.866 †	51.4 †

Table 4: Multi-class attack detection on WADI (15 scenarios). Same Linear Probing evaluation protocol as Table 3 ; the same structural caveat applies. Results for

\gamma{=}0.80

. Bold = best, † = significant (

p<0.05

). Evaluated on NVIDIA RTX 4070 (12 GB).

Method	SWaT		WADI
Method	MMD 2	Sil. Coeff.	MMD 2	Sil. Coeff.
OmniAnomaly ( Su et al., 2019 )	0.038	0.297	0.034	0.274
USAD ( Audibert et al., 2020 )	0.051	0.348	0.046	0.321
MTAD-GAT ( Zhao et al., 2020 )	0.069	0.433	0.063	0.411
TranAD ( Tuli et al., 2022 )	0.078	0.468	0.071	0.439
i-SDT (Proposed)	0.142 †	0.673 †	0.131 †	0.641 †

Table 5: ADE embedding separation of single- vs. multi-stage attacks (higher MMD = better).

Mitigation Strategy	SWaT (36 Attacks)				WADI (15 Attacks)
Mitigation Strategy	$\mathcal{D}_{\text{rel}}$	Safety Viol.	$T_{\text{recovery}}$ (s)	Act. Sat.	$\mathcal{D}_{\text{rel}}$	Safety Viol.	$T_{\text{recovery}}$ (s)	Act. Sat.
Immediate Shutdown	1.000	0%	3847	0%	1.000	0%	4231	0%
DT-MPC ( Zhang et al., 2025 )	0.614	6.9%	378	9.8%	0.639	8.1%	401	11.3%
i-SDT w/o Robust Margin	0.563	8.3%	412	12.5%	0.591	9.7%	438	14.2%
i-SDT (Full Robust MPC)	0.437 †	2.1% †	267 †	3.8% †	0.461 †	2.9% †	284 †	4.6% †
Target Objective	$\leq 0.50$	$\leq 5\%$	$<300$	–	$\leq 0.50$	$\leq 5\%$	$<300$	–

Table 6: Disruption mitigation and resilience (simulation-in-the-loop evaluation; see Section 3.1 ).

\mathcal{D}_{\text{rel}}

: normalized cost;

T_{\text{recovery}}

: recovery time.

Metric	Value	Notes
Training (Offline):
DT training time	2.8 hrs	SWaT, $E{=}200$ , early-stop
ADE training time	1.4 hrs	SWaT, $E{=}150$ , early-stop
Fine-tuning (10%)	0.5 hrs	New-plant adaptation
Inference (Online, per 1 Hz cycle):
DT inference (TCN + $N_{\text{MC}}{=}50$ )	16.1 ms	50 stochastic fwd. passes

Table 7: Computational Performance on Evaluation Platform (Intel Core i9-14900K, NVIDIA RTX 4070 12 GB, 64 GB RAM, PyTorch 2.0, CUDA 11.8). All inference timings averaged over

10^{3}

consecutive cycles on the SWaT test set (

d=51

). Edge deployment is reserved as future work (Section 6 ).

Attack Type	$\boldsymbol{\epsilon=0.1}$		$\boldsymbol{\epsilon=0.3}$
Attack Type	$F1_{\mathcal{A}}$	Evasion	$F1_{\mathcal{A}}$	Evasion
No Attack (Clean)	0.894	–	0.894	–
FGSM (White-box)	0.862	5.6%	0.781	16.7%
PGD (White-box)	0.847	8.3%	0.753	22.2%
Black-box Transfer	0.876	2.8%	0.829	8.3%
Avg. Degradation	-3.5%	–	-12.6%	–

Table 8: Robustness to adversarial attacks on SWaT.

\epsilon

: perturbation size; evasion rate = fraction evading detection (

F1<0.5

Dropout Rate ( $p$ )	$\boldsymbol{F1_{\mathcal{A}}}$ (SWaT)	$\boldsymbol{F1_{\mathcal{A}}}$ (WADI)	MTTD (s)
$p=0.0$ (No Dropout)	0.894	0.866	43.7
$p=0.1$	0.871	0.847	51.2
$p=0.2$	0.834	0.812	63.8
$p=0.3$	0.781	0.762	82.5
Degradation at $p=0.2$	-6.7%	-6.2%	+46.0%

Table 9: Performance under random sensor dropout.

p

: fraction of sensors unavailable per step.

Configuration	$\boldsymbol{F1_{\mathcal{A}}}$	FAR
No Transfer (Train on WADI)	0.866	0.042
Direct Transfer (Zero-shot)	0.647	0.183
Fine-tune 10% WADI Normal	0.782	0.089
Fine-tune 50% WADI Normal	0.831	0.061
Gap (10% Fine-tune)	-9.7%	+111.9%

Table 10: Cross-Domain Transfer (SWaT

\to

WADI). Note: 9.7% gap indicates domain-specific tuning remains necessary despite physics priors; transfer learning reduces labeling burden by 90% but cannot eliminate it entirely.

Configuration	$\boldsymbol{F1_{\mathcal{A}}}$	FAR	$\boldsymbol{\mathcal{D}_{\text{rel}}}$	Safety Viol.	MTTD (s)	Notes
i-SDT (Full)	0.894	0.033	0.437	2.1%	43.7	Baseline
Physics Weight Ablation:
$\alpha_{0}=0$ (no mass balance)	0.853	0.067	0.512	3.8%	62.3	$-4.6\%$
$\lambda_{p}=0$ (no pipe physics)	0.864	0.058	0.491	3.2%	58.1	$-3.3\%$
$\alpha_{0}=0.01$	0.871	0.051	0.478	2.9%	53.1	$-2.6\%$
$\alpha_{0}=0.10$	0.882	0.041	0.461	2.5%	48.2	$-1.3\%$

Table 11: Comprehensive Ablation Study on SWaT

Method	Precision	Recall	$\boldsymbol{F1}$
OmniAnomaly (2019) ( Su et al., 2019 ) ∗	0.938	0.821	0.876
USAD (2020) ( Audibert et al., 2020 ) ∗	0.946	0.837	0.888
MTAD-GAT (2020) ( Zhao et al., 2020 ) ∗	0.951	0.862	0.904
TranAD (2022) ( Tuli et al., 2022 ) ∗	0.957	0.874	0.914
LGAT (2025) ( Wen et al., 2025 ) ∗	0.961	0.891	0.925
i-SDT (Proposed)	0.967	0.918	0.942

Table 12: Comparison with recent SOTA on SWaT (binary detection, for contextual reference only ∗ ).

CPS Security

See all 25 papers

Digital Twin Degradation: Detecting Cyber Physical Attacks via Temporal Inconsistencies
Aug 17, 2026Konstantinos E. Kampourakis, Vasileios Gkioulos, Sokratis KatsikasCPS Security Cybersecurity
Norwegian University of Science and Technology (NTNU), 2802 Gjøvik, Norway
Towards a Resilience-Theoretic Foundation for Adversarial Robustness in Industrial Control System Anomaly Detection
Sep 7, 2026Branka Stojanović, Andreas Flatscher, Michael SommaCyber-Physical Systems Adversarial Robustness
1JOANNEUM RESEARCH Forschungsgesellschaft mbH, Austria · 2TU Graz, Institute for Technical Informatics, Austria
ASTRO: Adaptive Spatio-Temporal Reinforcement Optimization for GNN Powered Anomly Detection in Cyber Physical Systems
May 24, 2026Rai Ali Yar, Umaisa Lail, Anwar ShahIndustrial Anomaly Detection Online Anomaly Detection
Department of Computer Science, FAST NUCES, Development Sector, Faisalabad, Pakistan · Department of Information Technology, Riphah International University, Faisalabad, Pakistan

Aug 17, 2026J/K move · Enter open · S save

Digital Twin Degradation: Detecting Cyber Physical Attacks via Temporal Inconsistencies

Konstantinos E. Kampourakis, Vasileios Gkioulos, Sokratis Katsikas

Norwegian University of Science and Technology (NTNU), 2802 Gjøvik, Norway

CPS Security Cybersecurity Digital Twins Industrial Anomaly Detection Time-Series Anomaly Detection Change-Point Detection

Open paper AskPDF arXiv

Digital Twins (DTs) are increasingly used to monitor and analyze Cyber Physical Systems (CPS). However, in adversarial environments, the fidelity of a DT cannot be assumed. Communication delays, data manipulation, sensor degradation, or partial information loss may cause the DT state to diverge from the physical process it represents. Such divergence creates temporal inconsistencies that may reveal cyber physical attacks. This paper proposes a detection framework that monitors temporal consistency between the physical system and a potentially degraded DT view. A DT predictor is trained exclusively on normal system behavior to model short-term system dynamics. During operation, discrepancies between predicted and observed states are transformed into multi-horizon temporal features capturing the magnitude, persistence, and evolution of prediction residuals. An unsupervised density model characterizes normal consistency patterns, while a sequential change detection mechanism identifies sustained deviations indicative of attacks. The approach is evaluated on three widely used Industrial Control System (ICS) datasets, SWaT, HAI, and BATADAL, under multiple DT degradation scenarios, including time desynchronization and partial observability loss. Results show that temporal inconsistency patterns enable reliable event-level attack detection with bounded false alarm rates and low detection latency. The proposed method achieves up to 98% detection reliability on SWaT and false alarm rates below 2%. Unlike conventional anomaly detection methods, the proposed framework does not require attack signatures or labeled attack data and remains effective even when the DT view is degraded. These results suggest that DT degradation, often treated as a limitation, can instead serve as a useful signal for cyber physical security monitoring.

Abstract

CPS Security

Explore similar work

Digital Twin Degradation: Detecting Cyber Physical Attacks via Temporal Inconsistencies

Towards a Resilience-Theoretic Foundation for Adversarial Robustness in Industrial Control System Anomaly Detection

ASTRO: Adaptive Spatio-Temporal Reinforcement Optimization for GNN Powered Anomly Detection in Cyber Physical Systems