KDDT: Knowledge Distillation-Empowered Digital Twin for Anomaly Detection
Open accessAbstract
Cyber-physical systems (CPSs), like train control and management systems (TCMS), are becoming ubiquitous in critical infrastructures. As safety-critical systems, ensuring their dependability during operation is crucial. Digital twins (DTs) have been increasingly studied for this purpose owing to their capability of runtime monitoring and warning, prediction and detection of anomalies, etc. However, constructing a DT for anomaly detection in TCMS necessitates sufficient training data and extracting both chronological and context features with high quality. Hence, in this paper, we propose a novel method named KDDT for TCMS anomaly detection. KDDT harnesses a language model (LM) and a long short-term memory (LSTM) network to extract contexts and chronological features, respectively. To enrich data volume, KDDT benefits from out-of-domain data with knowledge distillation (KD). We evaluated KDDT with two datasets from our industry partner Alstom and obtained the F1 scores of 0.931 and 0.915, respectively, demonstrating the effectiveness of KDDT. We also explored individual contributions of the DT model, LM, and KD to the overall performance of KDDT, via a comprehensive empirical study, and observed average F1 score improvements of 12.4%, 3%, and 6.05%, respectively.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The dataset distribution for time-series dependency-based techniques reveals a concentration on a limited set of benchmarks, with CIC-IDS2017, UNSW-NB15, IoT-23, LITNET-2020, NetML-2020, CIC-DDoS2019, and N-BaIoT widely used, especially for botnet, DDoS, and generic network intrusions, while only a subset of studies leverage ICS/CPS-specific traces such as Alstom TCMS traffic, multi-domain ICS-CPS
“Fourth, the dataset distribution again reveals a concentration on a limited set of benchmarks. CIC-IDS2017, UNSW-NB15, IoT-23, LITNET-2020, NetML-2020, CIC-DDoS2019, and N-BaIoT are widely used to evaluate time-series dependency-based techniques, especially for botnet, DDoS, and generic network intrusions [35,38,40,43]. Only a subset of studies leverage ICS/CPS-specific traces such as Alstom TCMS”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [39]
Split into 2 atoms — 1 confirmed, 0 partially supported, 0 disputed, 0 misattributed, 1 unverifiable. Expand the claim to see per-atom verdicts.
Experimental — accuracy not yet measuredTime-series dependency-based methods incorporate sequential context such as burstiness, periodicity, and long-range dependencies via LSTM, BLSTM, GRU, SARIMA, or hybrid architectures, allowing them to capture more subtle deviations in normal traffic dynamics at the cost of higher model complexity, stricter requirements on ordering and timestamp quality, and increased sensitivity to concept drift.
“While statistical and entropy-based approaches treat each flow or aggregate independently, time-series dependency-based methods incorporate sequential context-such as burstiness, periodicity, and long-range dependencies-via LSTM, BLSTM, GRU, SARIMA, or hybrid architectures [33,38-40,44,45]. This allows them to capture more subtle deviations in normal traffic dynamics, at the cost of higher model c”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [39]
Split into 2 atoms — 0 confirmed, 2 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.
Experimental — accuracy not yet measuredSupervised sequence classifiers and hybrid ensemble models dominate the time-series literature and typically report very high accuracy and F1-scores when sufficient labeled attack data are available.
“Finally, with respect to detection paradigms, supervised sequence classifiers and hybrid ensemble models dominate the literature and typically report very high accuracy and F1-scores when sufficient labeled attack data are available [35,39,40,45].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [39]
Section 3.1 describes KDDT as a supervised method requiring labelled data, and Section 5.1 reports F1 scores above 0.91 on two TCMS packet datasets. The Network Anomaly detection section says neural networks have been widely explored, but the paper does not establish that supervised sequence classifiers and hybrid ensembles dominate the time-series literature, or that such models typically report high accuracy and F1-scores when sufficient labelled attack data are available. (LLM, conf=0.86)
Experimental — accuracy not yet measuredDeep sequence models (LSTM, BLSTM-GRU, CNN + Bi-GRU) and generative architectures (FID-GAN, VAE-based digital twins) are able to exploit complex temporal patterns and achieve strong detection or classification performance on benchmark datasets.
“Third, in terms of model behavior and failure modes, the surveyed work shows that deep sequence models (LSTM, BLSTM-GRU, CNN + Bi-GRU) and generative architectures (FID-GAN, VAE-based digital twins) are able to exploit complex temporal patterns and achieve strong detection or classification performance on benchmark datasets [35,38-40,42,44,45].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [39]
Split into 2 atoms — 1 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.
Experimental — accuracy not yet measuredXu et al. [39] introduced KDDT, a digital-twin-based time-series anomaly detection framework using knowledge distillation, using packet traffic captured from the TCMS of Alstom railway vehicles via Wireshark.
“Using packet traffic captured from the TCMS of Alstom railway vehicles via Wireshark, Xu et al. [39] introduced KDDT, a digital-twin-based time-series anomaly detection framework using knowledge distillation.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [39]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
The citation lists haven’t been fetched yet
References 30 · Cited by 11
Research works printed but not linked: 7
- R Anushiya and V S Lavanya. 2021. A COMPARATIVE STUDY ON INTRUSION DETECTION SYSTEMS FOR SECURED COMMUNICATION IN INTERNET OF THINGS. ICTACT JOURNAL ON COMMUNICATION TECHNOLOGY 12, 03 (2021).
- Ulf Lamping and Ed Warnicke. 2004. Wireshark user's guide. Interface 4, 6 (2004), 1.
- Zhipeng Li, Zheng Qin, Kai Huang, Xiao Yang, and Shuxiong Ye. 2017. Intrusion Detection Using Convolutional Neural Networks for Representation Learning. In Neural Information Processing, Derong Liu, Shengli Xie, Yuanqing Li, Dongbin Zhao, and El-Sayed M. El-Alfy (Eds.). Springer International Publishing, Cham, 858-866.
- Mamoru Mimura and Hidema Tanaka. 2018. Reading network packets as a natural language for intrusion detection. In Information Security and Cryptology-ICISC 2017: 20th International Conference, Seoul, South Korea, November 29-December 1, 2017, Revised Selected Papers 20. Springer, 339-350.
- Athanasios Voulodimos, Nikolaos Doulamis, Anastasios Doulamis, Eftychios Protopapadakis, et al. 2018. Deep learning for computer vision: A brief review. Computational intelligence and neuroscience 2018 (2018).
- Qinghua Xu, Shaukat Ali, Tao Yue, Nedim Zaimovic, and Singh Inderjeet. 2023. Uncertainty-Aware Transfer Learning to Evolve Digital Twins for Industrial Elevators. In Proceedings of the 31th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (San Fran- cisco, CA, USA) (ESEC/FSE 2023). Association for Computing Machinery, New York, NY, USA, 11 pages. https://doi.org/10.1145/3611643.3613879
- Yong Yu, Xiaosheng Si, Changhua Hu, and Jianxun Zhang. 2019. A review of recurrent neural networks: LSTM cells and network architectures. Neural computation 31, 7 (2019), 1235-1270.
- Authors
- Xu, Q., Ali, S., Yue, T., Nedim, Z., & Singh, I.
- Affiliations
- University of Oslo (NO)
- OsloMet – Oslo Metropolitan University (NO)
- Simula Research Laboratory (NO)
- Alstom Rail, Västerås, Sweden
- Alstom (Sweden) (SE)
- Venue
- Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering
- Publisher
- ACM
- Published
- 2023-11-30
- Pages
- 1867-1878
- OpenAlex
- W4386719732
- Cited by
- 11
- References
- 30
- Citations by year
- 2025: 5 · 2024: 4 · 2023: 2
- FWCI
- 1.95
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) (publishedVersion)
- arXiv (Cornell University) (submittedVersion, cc-by)
- arXiv (Cornell University) (cc-by)
- Funders
- Horizon 2020 Framework Programme (871319)
- Norges Forskningsråd (314544)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
- Physical Sciences › Computer Science › Computer Graphics and Computer-Aided Design › Transportation Systems and Safety
- Physical Sciences › Engineering › Control and Systems Engineering › Fault Detection and Control Systems
- Keywords
- digital twin, anomaly detection, knowledge distillation, language models, long short-term memory networks, out-of-domain data, cyber-physical systems, safety-critical systems
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
