PLC-MDT: A Framework for Detecting Anomalies with Digital Twins of Industrial Control Systems

The PLC-MDT approach could detect not only typical code modification attacks but also coordinated stealthy attacks that forge SCADA history logs, achieving high detection rates and low false positive rates in real time.

“The authors demonstrated that this approach could detect not only typical code modification attacks but also coordinated stealthy attacks that forge SCADA history logs, achieving high detection rates and low false positive rates in real time.”

Xu et al. [72] designed a hybrid prediction-mechanism model called PLC-MDT that leverages a Digital Twin (DT) using PLC-sensor logs from a self-built temperature control ICS testbed.

“Using PLC-sensor logs collected from a self-built temperature control ICS testbed, Xu et al. [72] designed a hybrid prediction-mechanism model called PLC-MDT that leverages a Digital Twin (DT).”

In many works, a model predicts the next-step sensor or control-signal values and computes prediction residuals, or derives an anomaly score that functions as a probabilistic or density-based residual, so that small but systematic deviations in process dynamics can be detected even when they are not visible at the network layer.

“In many of these works, a model predicts the next-step sensor or control-signal values and computes prediction residuals, or derives an anomaly score that functions as a probabilistic or density-based residual, so that small but systematic deviations in process dynamics can be detected even when they are not visible at the network layer [67,69,70,72,73,75].”

Prediction-residual-oriented methods are powerful for detecting subtle and coordinated process anomalies, including multi-point stealthy attacks that forge SCADA histories or slowly drive the system toward unsafe states.

“Third, in terms of detection capability and failure modes, the results indicate that prediction-residual-oriented methods are powerful for detecting subtle and coordinated process anomalies, including multi-point stealthy attacks that forge SCADA histories or slowly drive the system toward unsafe states [69,72,73,75,76].”

Process data are particularly suitable for attacks that perturb the physical process state while keeping network-level statistics relatively unchanged, such as false data injection, malicious command or parameter manipulation, process-oriented attacks, and stealthy drifts in sensor trajectories.

“First, process data are particularly suitable for attacks that perturb the physical process state while keeping network-level statistics relatively unchanged-such as false data injection, malicious command or parameter manipulation, process-oriented attacks, and stealthy drifts in sensor trajectories [67,69-73,75,76].”

The distribution of datasets shows a strong reliance on SWaT and WADI for benchmarking prediction-residual-based methods, with additional evidence from custom-built avionics, robotics, temperature-control, offshore wind farm, and simulation-based CPS testbeds.

“Finally, the distribution of datasets shows a strong reliance on SWaT and WADI for benchmarking prediction-residual-based methods, with additional evidence from custombuilt avionics, robotics, temperature-control, offshore wind farm, and simulation-based CPS testbeds [67-73,75,76].”