cs.CRAug 17, 2026

Digital Twin Degradation: Detecting Cyber Physical Attacks via Temporal Inconsistencies

Authors: Konstantinos E. Kampourakis, Vasileios Gkioulos, Sokratis Katsikas

Organizations: Norwegian University of Science and Technology (NTNU), 2802 Gjøvik, Norway

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Digital Twins (DTs) are increasingly used to monitor and analyze Cyber Physical Systems (CPS). However, in adversarial environments, the fidelity of a DT cannot be assumed. Communication delays, data manipulation, sensor degradation, or partial information loss may cause the DT state to diverge from the physical process it represents. Such divergence creates temporal inconsistencies that may reveal cyber physical attacks. This paper proposes a detection framework that monitors temporal consistency between the physical system and a potentially degraded DT view. A DT predictor is trained exclusively on normal system behavior to model short-term system dynamics. During operation, discrepancies between predicted and observed states are transformed into multi-horizon temporal features capturing the magnitude, persistence, and evolution of prediction residuals. An unsupervised density model characterizes normal consistency patterns, while a sequential change detection mechanism identifies sustained deviations indicative of attacks. The approach is evaluated on three widely used Industrial Control System (ICS) datasets, SWaT, HAI, and BATADAL, under multiple DT degradation scenarios, including time desynchronization and partial observability loss. Results show that temporal inconsistency patterns enable reliable event-level attack detection with bounded false alarm rates and low detection latency. The proposed method achieves up to 98% detection reliability on SWaT and false alarm rates below 2%. Unlike conventional anomaly detection methods, the proposed framework does not require attack signatures or labeled attack data and remains effective even when the DT view is degraded. These results suggest that DT degradation, often treated as a limitation, can instead serve as a useful signal for cyber physical security monitoring.

Figures & tables

Figure 1: Digital Twin inconsistency detection pipeline.
Figure 2: Full detection timeline on the SWaT dataset under clean DT conditions.
DatasetConditionSegDetRecallDelay (Time-Steps)FPRReliability
SWaTClean35/351.00∼\sim 221.38%0.986
 Degraded35/351.00∼\sim 261.65%0.984
HAIClean48/500.96∼\sim 280.48%0.955
 Degraded49/500.98∼\sim 441.67%0.964
BATADALClean2/50.40∼\sim 100.50%0.396
 Degraded4/50.80∼\sim 121.67%0.796
Table 1: Event-level detection performance under clean and degraded DT conditions.
MethodDT-awareSequential DetectionEvent-level Focus
CNN Residual Thresholding×\times×\times×\times
MAD-GAN×\times×\times△\triangle
SOMAD×\times△\triangle△\triangle
Predictor + CUSUM×\times✓\checkmark△\triangle
Proposed Framework✓\checkmark✓\checkmark✓\checkmark
Table 2: Qualitative comparison with representative ICS anomaly detection methods. ✓\checkmark indicates full support, ×\times indicates absence, and △\triangle denotes partial capability.
More in this topic

CPS Security

See all 25 papers

Explore similar work

CardsList
Mar 19, 2026

Cyber-Resilient Digital Twins: Discriminating Attacks for Safe Critical Infrastructure Control

Industrial Cyber-Physical Systems (ICPS) face growing threats from cyber-attacks that exploit sensor and control vulnerabilities. Digital Twin (DT) technology can detect anomalies via predictive modelling, but current methods cannot distinguish attack types and often rely on costly full-system shutdowns. This paper presents i-SDT (intelligent Self-Defending DT), combining hydraulically-regularized predictive modelling, multi-class attack discrimination, and adaptive resilient control. Temporal Convolutional Networks (TCNs) with differentiable conservation constraints capture nominal dynamics and improve robustness to adversarial manipulations. A recurrent residual encoder with Maximum Mean Discrepancy (MMD) separates normal operation from single- and multi-stage attacks in latent space. When attacks are confirmed, Model Predictive Control (MPC) uses uncertainty-aware DT predictions to keep operations safe without shutdown. Evaluation on SWaT and WADI datasets shows major gains in detection accuracy, 44.1% fewer false alarms, and 56.3% lower operational costs in simulation-in-the-loop evaluation. with sub-second inference latency confirming real-time feasibility on plant-level workstations, i-SDT advances autonomous cyber-physical defense while maintaining operational resilience.

Mohammadhossein Homaei, Iman Khazrak, Rubén Molano +2

Departamento de Ingeniería de Sistemas Informáticos y Telemáticos, Universidad de Extremadura, Av. Universidad S/N, Escuela Politécnica, Cáceres, 10003, Extremadura, Spain · Department of Computer Science, Bowling Green State University, Bowling Green, 43403, OH, USA

CPS SecurityIndustrial Control System SecurityDigital TwinsIndustrial Anomaly Detection
AskPDF
May 24, 2026

ASTRO: Adaptive Spatio-Temporal Reinforcement Optimization for GNN Powered Anomly Detection in Cyber Physical Systems

Anomaly detection in Industrial Internet of Things (IIoT) environments is essential to protect the Industrial Control Systems (ICS) and Cyber-Physical Systems (CPS) from occuring run time false data injection and other malicious attacks. The increasing complexity of sensor networks and interconnected control loops makes it difficult to identify anomalous behavior hidden within high-dimensional and time-dependent signals. To address these challenges, this article introduces Adaptive Spatio-Temporal Reinforcement Optimization ASTRO (ASTRO), a novel anomaly detection framework that pioneers the use of reinforcement learning for dynamic threshold optimization. By integrating a Deep Q-Network (DQN) with Graph Neural Networks (GNNs), temporal modelling and a Multi-Head Attention mechanism, ASTRO continuously adapts its decision boundaries to improve detection accuracy. The GNN component models the spatial relations among sensors, Temporal model captures time series dependencies and the attention layer highlights most informative time steps. The model generates continuous anomaly scores, which are transformed into binary decisions using an adaptive threshold, optimized via a Deep Q-Network (DQN). The ASTRO approach is evaluated on two real world industrial benchmarks: the Secure Water Treatment (SWaT) and Water Distribution (WADI) datasets. The proposed model achieves an exceptional performance on the SWaT with F1 score of 0.990. Moreover, on highly complex 127 end devices WADI dataset, it secures F1 score of 0.788, outperforming state-of-the-art baselines by nearly 14%. Results across multiple runs confirm consistent generalization and stability. These experiments demonstrate that the ASTRO framework is highly practical and scalable method for strengthening the large scale cyber physical infrastructures

Rai Ali Yar, Umaisa Lail, Anwar Shah

Department of Computer Science, FAST NUCES, Development Sector, Faisalabad, Pakistan · Department of Information Technology, Riphah International University, Faisalabad, Pakistan

Industrial Anomaly DetectionOnline Anomaly DetectionIoT Intrusion DetectionCyber-Physical SystemsSpatiotemporal GNNsTime-Series Anomaly Detection+1
AskPDF
Aug 17, 2026

Digital Twin-Based Intrusion Detection for Vehicle Powertrain CAN Bus Systems

Existing automotive intrusion detection systems (IDSs) for the Controller Area Network (CAN) largely target discrepancies in message timing, frequency, or sequencing and cannot detect attacks that preserve these properties while manipulating the payload. Digital twins (DTs) have been used to emulate CAN traffic and generate attack scenarios for IDS evaluation, but their use for intrusion detection remains unexplored. This study develops a DT-based IDS that jointly models physical relationships among decoded powertrain signals and identifies attacks through residuals between predicted and observed behavior. A shared-encoder LSTM DT was trained on 17 decoded signals from a real Hyundai/Kia CAN log to jointly predict seven numeric and two categorical gear signals over a 24-step window. A timestep is flagged when a residual exceeds a calibrated threshold, while adaptive rollout protects the twin's input history from sustained contamination. Four attacks (plateau, continuous drift, masquerade, and gear masquerade) were evaluated against the twin and a range-and-plausibility baseline. The DT outperformed the baseline across all attacks, achieving detection rates of 94.6% for continuous drift and 89.2% for masquerade, while the baseline detected almost none of the fabricated payload attacks. These results demonstrate that learning coupled vehicle dynamics enables detection of stealthy payload manipulations that preserve normal CAN communication patterns. False positive rates reached 39.6%, highlighting the need for improved robustness under sustained attacks. The DT-based IDS shows promise for detecting stealthy payload-level CAN attacks that preserve normal communication patterns, supporting behavior-based cybersecurity for connected and automated vehicles.

Araf Rahman, M Sabbir Salek, Mashrur Chowdhury

Glenn Department of Civil Engineering Clemson University, Clemson, South Carolina, 29634

Network Intrusion DetectionCybersecurityTime-Series Anomaly DetectionDigital Twins
AskPDF