Digital Twin-Driven Intrusion Detection for Industrial SCADA: A Cyber-Physical Case Study

Abstract

The convergence of operational technology (OT) and information technology (IT) in industrial environments, such as water treatment plants, has significantly increased the attack surface of Supervisory Control and Data Acquisition (SCADA) systems. Traditional intrusion detection systems (IDS), which focus solely on network traffic, often fail to detect stealthy, process-level attacks. This paper proposes a Digital Twin-driven Intrusion Detection (DT-ID) framework that integrates high-fidelity process simulation, real-time sensor modeling, adversarial attack injection, and hybrid anomaly detection using both physical residuals and machine learning. We evaluate the DT-ID framework using a simulated water treatment plant environment, testing against false data injection (FDI), denial-of-service (DoS), and command injection attacks. The system achieves a detection F1-score of 96.3%, a false positive rate below 2.5%, and an average detection latency under 500 ms, demonstrating substantial improvement over conventional rule-based and physics-only IDS in identifying stealthy anomalies. Our findings highlight the potential of cyber-physical digital twins to enhance SCADA security in critical infrastructure.

1. Introduction

Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) networks are central to the operation of critical infrastructure in sectors such as water, energy, and oil and gas. While these systems were originally deployed in isolated, air-gapped environments with minimal cybersecurity, most ICS and SCADA installations now face increased cyber risk due to the integration of operational technology (OT) with information technology (IT), enabled by the Industrial Internet of Things (IIoT), remote monitoring, and data-driven optimization [1].

This growing connectivity introduces new vectors for sophisticated cyber-physical threats. High-profile incidents such as Stuxnet, Industroyer, and Triton illustrate how attackers can manipulate control logic, falsify sensor readings, or disrupt communication protocols, causing significant real-world damage [2–4].

Most current intrusion detection systems (IDS) in industrial networks are adapted from IT security practices, relying on signature-based methods or network anomaly detection [5–7]. However, these solutions often fail to detect process-aware threats where attackers subtly manipulate sensor readings or actuator commands to disrupt operations while keeping network traffic within expected norms, thereby evading traditional alarms [8,9]. Recent research has begun to explore process-aware and hybrid IDS approaches, including those based on Digital Twins (DTs), virtual replicas that simulate physical systems using process models and real-time data [10–15]. Despite this progress, existing DT-based solutions still struggle to reliably detect stealthy attacks that subtly alter process states.

In summary, this paper offers several novel contributions beyond the current state-of-the-art in ICS security. (1) We introduce a digital twin-driven IDS for SCADA that tightly integrates high-fidelity physics simulation with live SCADA network traffic via OPC UA, enabling process-aware detection not achievable by prior DT-based IDS [13,14]. (2) We develop an adversarial attack simulation toolkit to inject both cyber (network) and physical process attacks, providing a rigorous and repeatable evaluation environment. (3) We propose a hybrid anomaly detection engine that fuses physics-based residual analysis and machine learning (LSTM for network anomalies, one-class SVM for process anomalies) in a unified framework. (4) We present extensive experimental results against stealthy, multi-stage attacks on a 72 h SCADA dataset, demonstrating improved detection over traditional IDS baselines. The remainder of this paper is structured as follows. Section 2 reviews related work in SCADA security, Digital Twin applications, and ML-based intrusion detection. Section 3 presents the architecture of the proposed DT-ID framework. Section 4 describes the case study setup and experimental methodology. Section 5 discusses the results and system performance. Section 6 concludes the paper and outlines future work.

2. Related Work

Industrial control systems and SCADA networks have traditionally relied on intrusion detection systems derived from information technology environments. Signature-based and network anomaly detection tools such as Snort [5] and Suricata [6] have long served as primary defenses in industrial networks. Network monitors like Bro (now Zeek) [7] have improved protocol inspection granularity but still operate primarily at the packet or flow level rather than at the process level. While effective at detecting known attack signatures and obvious network anomalies, these methods generally lack awareness of the physical processes they protect, limiting their effectiveness against stealthy, process-level attacks that manipulate sensor values or control logic without generating conspicuous network events [8,9,18].

The emergence of Digital Twin technology has provided new opportunities to improve ICS and SCADA security. DTs are high-fidelity, real-time virtual models of physical systems capable of synchronizing with live data streams to simulate, monitor, and optimize process behavior. Oyekan and Hu [11] demonstrated a DT-based cybersecurity monitoring framework for pipeline systems, while Zhang et al. [12] integrated DTs with process analytics for smart manufacturing. Recent studies such as Zhao et al. [13] and Lin et al. [14] leveraged cloud-based DT platforms and edge analytics for anomaly detection in industrial IoT environments, and Xu et al. [15] employed generative adversarial networks (GANs) to enhance the robustness of DT-based anomaly detection in water treatment plants. Hybrid systems combining machine learning with process models have also gained momentum: Pan et al. [16] introduced a hybrid deep learning and physics-guided DT architecture, and Xu et al. [17] proposed a fusion approach for zero-day attack detection in smart manufacturing. Nevertheless, adversarial machine learning remains a persistent challenge, as GAN-based attacks can generate process-consistent yet malicious sensor data that bypasses even advanced hybrid detectors [19].

Compared to existing systems, the DT-ID framework offers a more comprehensive and adaptive defense strategy. While prior DT-plus-ML systems achieve good detection rates, they focus on either network attacks or simplified process models and do not incorporate an integrated attack simulation environment or real-time control response; our framework blends a high-fidelity process twin with local ML analysis and a response module, evaluated under live adversarial conditions [13,14]. Xu et al. [15] emphasize offline analysis over a narrow set of attacks, whereas our work performs online detection over a broader spectrum including adaptive and zero-day scenarios. Recent hybrid methods [16,17] report high accuracy on standard datasets but generally assume well-labeled attack data or pre-recorded incidents. Our system advances beyond these efforts by providing real-time closed-loop detection with the twin synchronized at 100 Hz, actively challenging the IDS with adversarially crafted stealthy attacks, and integrating an automated response mechanism. Industry incident reports [1] and benchmark datasets such as SWaT [20], WADI [21], and BATADAL [22] further indicate that most validations remain confined to testbeds, while real deployments add sensor drift, incomplete observability, and evolving adversarial tactics.

3. Core Components

The architecture of the proposed DT-ID system is composed of four tightly integrated modules: a high-fidelity virtual SCADA model (Digital Twin), an adversarial attack simulation engine, a hybrid anomaly detector, and a multi-stage response module. Together, these modules enable real-time monitoring, robust adversarial testing, adaptive anomaly detection, and automated mitigation in industrial SCADA environments.

The Virtual SCADA Model serves as a high-fidelity digital twin, emulating the core dynamics of a water treatment process, including tank hydraulics and chemical dosing. The twin and process simulation were implemented in MATLAB Simulink, with data handling and synchronization routines in Python 3.10. The hydraulic behavior of each storage tank is modeled by Bernoulli's principle (Equation 1), and pH control dynamics are captured by a kinetic dosing model (Equation 2). To maintain alignment with the real or simulated plant, the twin performs state synchronization at 100 Hz using a delta-based update formalized in Algorithm 1: if the absolute difference between physical and virtual parameters exceeds a tolerance derived from sensor resolution and expected physical noise (e.g., ±0.5% for tank level sensors), the virtual state is resynchronized. This millisecond-level coupling ensures that even subtle or fast transients are reflected in the DT, which is critical for catching stealthy attacks in real time.

The Attack Simulation Engine systematically injects adversarial scenarios to rigorously validate the DT-ID framework. Three representative classes of cyber-physical threats are implemented: False Data Injection (FDI) introducing up to ±20% sensor bias or ramps in tank level and pH readings; Denial of Service (DoS) flooding the PLC-HMI channel with 10^4 malformed Modbus packets per second; and Reconnaissance/Command Injection performing automated port scans and unauthorized command injection. Attack events are scheduled in non-overlapping 10 min intervals randomized over a 72 h simulation period, with target components drawn from a uniform random distribution, and the library additionally includes stealthy zero-day attacks generated with GAN-inspired adversarial techniques to falsify sensor readings while preserving statistical normalcy [19].

The Hybrid Anomaly Detector captures both cyber (network-level) and physical (process-level) anomalies by integrating deep learning and physics-based machine learning. The cyber module processes sliding windows of Modbus/TCP traffic using a three-layer Long Short-Term Memory (LSTM) network (128 units per layer) augmented with attention over 60-timestep windows, outputting a cyber anomaly probability Pcyber. The physical module analyzes process residuals r(t) = |ysensor(t) − yDT(t)| with a one-class Support Vector Machine (RBF kernel, ν = 0.01, γ = 0.1), producing Pphysical. A dynamic decision fusion mechanism combines both scores with empirically tuned weights (0.3/0.7), with the ensemble threshold Pfinal > 0.85 selected by ROC analysis. The multi-stage response module escalates from operator alerts to automated failover to redundant controllers, while LSTM and SVM models are retrained every 24 h with Page–Hinkley drift monitoring, and anomaly scores are smoothed with a moving average filter to suppress transient-triggered false alerts.

4. Case Study: Water Treatment Plant

The DT-ID framework is evaluated using a simulated water treatment plant (WTP) environment developed with Python (SimPy) for discrete-event process modeling and Scapy for network attack emulation. The testbed includes three 500 L storage tanks instrumented with ultrasonic level sensors, two chemical dosing pumps for pH adjustment, and Siemens S7-1200 programmable logic controllers running conventional PID-based control strategies. The plant network adopts a star topology with Cisco 2960 switches, supporting Modbus/TCP (PLC-HMI) and Ethernet/IP (PLC-PLC) protocols, with a baseline traffic load of approximately 1200 packets per second [1]. The simulation supports dynamic scaling of tanks, sensors, and actuators, and all scripts and parameters are available from the authors upon reasonable request.

The digital twin module provides a high-fidelity virtual replica of the water treatment process, realized in a dual-environment approach: core process dynamics in MATLAB/Simulink with a Python 3.10 runtime managing real-time integration through OPC UA interfaces and a Modbus/TCP interface via pymodbus, alongside InfluxDB time-series logging, a time-indexed replay buffer for forensic back-testing, Unity 3D real-time visualization, and AWS IoT TwinMaker asset management. The twin synchronizes with the simulated plant at 100 Hz with delta-based correction, and a 3–5 ms computation per 10 ms step keeps CPU utilization below 30%. The repeated implementation description (Section 4.3) confirms the same physics models, synchronization strategy, logging, and visualization stack as the deployable configuration.

To evaluate robustness, three principal attack classes are implemented — FDI sensor spoofing (bias ±20%), DoS packet flooding (10^4/s), and reconnaissance/command injection — scheduled in randomized non-overlapping 10 min windows over 72 h with GAN-inspired stealthy zero-day variants [19]. Performance is measured with detection F1-score, precision, recall, false positive rate, and detection latency against ground truth from scheduler logs, with the ensemble threshold tuned by ROC analysis on a held-out validation set and a 70/30 training/testing split. Two baselines are compared: a signature-based Snort IDS with Modbus/TCP rules, and a physics-only residual detector without learning.

Benchmarking confirms real-time feasibility: the complete DT-ID system sustains 100 Hz updates on a standard PC (Intel Core i7, 3.4 GHz) with end-to-end detection latency around 480 ms, comparable to recent edge-deployed digital twin IDS results [17]. For legacy SCADA integration the prototype links the twin with PLCs through OPC UA with minimal changes to operational systems, and for resource-constrained settings the framework can use simplified physics models, lower update rates, or cloud/edge offloading. An ablation study replacing the LSTM-attention network with a 1D CNN and the one-class SVM with an isolation forest dropped performance to 88.1% F1 with 8% FPR (versus 96.3% and 2.4%), validating the chosen hybrid architecture.

5. Simulation Results

The DT-ID framework achieves a detection F1-score of 96.3%, a false positive rate below 2.5%, and an average detection latency under 500 ms, demonstrating significant improvement over traditional detection approaches (Table 4). Detection probability curves for FDI, DoS, and reconnaissance attacks show consistently timely and robust alerts during attack windows, and the confusion matrix confirms high true positive rates with low false negatives across all attack types.

During deployment, four implementation challenges were identified and addressed. Sensor drift and false residuals were mitigated with periodic auto-calibration against recent attack-free data windows building on the delta-synchronization algorithm. False negatives in the cyber module against novel Modbus/TCP patterns were addressed by augmenting training with GAN-generated synthetic attack traces [15]. Real-time synchronization bottlenecks in the Python-OPC UA interface were resolved by caching redundant state updates and batching non-critical telemetry. Response trigger sensitivity during process transients was addressed by smoothing anomaly scores with a moving average filter (window size 3) and hold times (e.g., 5 s) before higher-severity escalation.

The framework introduces six technical innovations: physics-guided hybrid detection fusing model-based residuals with LSTM cyber scores; an adversarial-aware attack simulation engine covering conventional and GAN-generated zero-day threats; adaptive decision fusion with empirically tuned weights (0.3/0.7) and ROC-calibrated thresholds; edge-cloud operational synergy with edge scoring and cloud retraining; resilience via concept drift adaptation with 24 h retraining and Page–Hinkley monitoring; and integrated Unity 3D replay and TwinMaker visualization bridging technical alerts and operator action.

Comparative evaluation confirms the value of hybrid fusion: Snort achieved only 80.5% F1 with ≈4.7% FPR and ∼1650 ms latency; the physics-only baseline reached ≈89.2% F1 but suffered ≈7.8% FPR; and an ML-only LSTM baseline scored in the mid-80% range with ≈5% FPR, missing subtle process deviations. Against recent state-of-the-art DT-based IDS [13–17] (Table 5) — Zhao et al. 90.0%, Lin et al. 94.1% at 950 ms, Xu et al. 91.7%, Pan et al. 93.8% at 700 ms, Xu et al. 99.0% in smart manufacturing at 600 ms — DT-ID achieves 96.3% F1 with 2.4% FPR and 480 ms latency, uniquely validated under stealthy adversarially generated attacks over a 72 h live simulation. Direct comparisons remain nuanced across systems and attack sets, but the results substantiate that combining physics-based models with advanced ML yields superior ICS security.

6. Conclusions

This work introduced a digital twin-driven, hybrid intrusion detection framework (DT-ID) for securing industrial SCADA systems. By combining physics-based residual analysis with data-driven machine learning, the proposed system offers clear improvements over traditional IDS and previous digital twin-based approaches, particularly for detecting stealthy and process-aware attacks. Evaluation on a high-fidelity 72 h simulation testbed covering a broad spectrum of adversarial scenarios reflecting real-world attack behaviors achieved a detection F1-score of 96.3% with low false alarm rates and sub-second alert latency, and an ablation study confirmed that the LSTM-attention plus one-class SVM architecture outperforms CNN and isolation forest alternatives. Practical challenges including sensor drift, synchronization strategy, and computational overhead were addressed, with benchmarking showing real-time operation on standard hardware and OPC UA-based integration with legacy SCADA environments.

Nonetheless, results are based on simulated data with injected sensor noise and drift; actual industrial datasets and field deployments will introduce further complexity including non-ideal noise, unknown disturbances, and operational variability. A key direction for future work is therefore validation on real SCADA datasets such as the WADI water distribution dataset [21] to confirm robustness under practical threats and protocol-specific anomalies. All core code, models, and simulation parameters are described for reproducibility and are available upon request.