Digital Twin-Driven Intrusion Detection for Industrial SCADA: A Cyber-Physical Case Study
Open accessAbstract
The convergence of operational technology (OT) and information technology (IT) in industrial environments, such as water treatment plants, has significantly increased the attack surface of Supervisory Control and Data Acquisition (SCADA) systems. Traditional intrusion detection systems (IDS), which focus solely on network traffic, often fail to detect stealthy, process-level attacks. This paper proposes a Digital Twin-driven Intrusion Detection (DT-ID) framework that integrates high-fidelity process simulation, real-time sensor modeling, adversarial attack injection, and hybrid anomaly detection using both physical residuals and machine learning. We evaluate the DT-ID framework using a simulated water treatment plant environment, testing against false data injection (FDI), denial-of-service (DoS), and command injection attacks. The system achieves a detection F1-score of 96.3%, a false positive rate below 2.5%, and an average detection latency under 500 ms, demonstrating substantial improvement over conventional rule-based and physics-only IDS in identifying stealthy anomalies. Our findings highlight the potential of cyber-physical digital twins to enhance SCADA security in critical infrastructure. In the following sections, we present the motivation and approach underlying this framework.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Sayghe's water-treatment IDS achieved an F1 score of 96.3% with sub-500 ms detection latency on the SWaT testbed.
“this is the architecture used in DT-driven intrusion detection systems such as Sayghe's water-treatment IDS, which achieved an F1 score of 96.3% with sub-500 ms detection latency on the SWaT testbed [25].”
From Crypto-Agile Zero Trust Architecture for IT-OT Convergence in Industrial Control Systems: A Digital Twin-Driven Framework over 5G/TSN with Post-Quantum Cryptography (2026) · cites this paper as [25]
Section 5.2 reports an F1-score of 96.3% and average alert latency of roughly 480 ms for the DT-ID system. But Section 4.1 says it was evaluated in a simulated water-treatment-plant environment, not on the SWaT testbed; the SWaT mention found in our copy is a reference to its dataset. (LLM, conf=0.90)
Experimental — accuracy not yet measuredThe DT concept has matured from manufacturing-optimization research into a candidate cybersecurity primitive over the past five years.
“The DT concept has matured from manufacturing-optimization research into a candidate cybersecurity primitive over the past five years [25], [26], [27], [54], [55], [56].”
From Crypto-Agile Zero Trust Architecture for IT-OT Convergence in Industrial Control Systems: A Digital Twin-Driven Framework over 5G/TSN with Post-Quantum Cryptography (2026) · cites this paper as [25]
The Introduction and Related Work (pages not provided) describe recent digital-twin research in smart manufacturing and its use for industrial cybersecurity monitoring and intrusion detection. They support the move into cybersecurity, but do not establish that the concept matured from manufacturing-optimization research specifically over the past five years. (LLM, conf=0.84)
Experimental — accuracy not yet measuredSayghe [25] evaluated a DT-driven IDS on the SWaT water-treatment testbed against false data injection, denial-of-service, and command-injection attacks, achieving an F1 score of 96.3% with sub-500 ms detection latency.
“Sayghe [25] reports the most empirically grounded DT-based intrusion-detection work in this space, evaluating a Digital Twindriven IDS on the SWaT water-treatment testbed against false data injection, denial-of-service, and command-injection attacks. The system achieves an F1 score of 96.3% with sub-500 ms detection latency.”
From Crypto-Agile Zero Trust Architecture for IT-OT Convergence in Industrial Control Systems: A Digital Twin-Driven Framework over 5G/TSN with Post-Quantum Cryptography (2026) · cites this paper as [25]
Section 5 (Simulation Results) reports an F1 score of 96.3%, average detection latency under 500 ms, and evaluation against false data injection, denial-of-service, and reconnaissance/command-injection attacks. But Section 4.1 (Testbed Configuration) says the evaluation used a simulated water-treatment plant, not the SWaT testbed. No page numbers are available in our copy. (LLM, conf=0.92)
Experimental — accuracy not yet measuredDigital Twins can support process-residual-based intrusion detection with F1 scores above 96% on water-treatment SCADA testbeds.
“Recent work has demonstrated that DTs can host real-time anomaly detection [25], support process-residual-based intrusion detection with F1 scores above 96% on water-treatment SCADA testbeds [25], and provide situational awareness of device trust states in industrial IoT [27].”
Sayghe demonstrates that DT-based detection can be process-aware in ways that pure network-traffic analysis cannot.
“Importantly, Sayghe demonstrates that DT-based detection can be process-aware in ways that pure network-traffic analysis cannot, providing strong empirical motivation for our use of the DT as the PDP.”
The integration of DTs with ZT decision logic has been treated only at a conceptual level, and never in the IT-OT converged setting considered here.
“but the integration of DTs with ZT decision logic has been treated only at a conceptual level, and never in the IT-OT converged setting we consider here.”
From Crypto-Agile Zero Trust Architecture for IT-OT Convergence in Industrial Control Systems: A Digital Twin-Driven Framework over 5G/TSN with Post-Quantum Cryptography (2026) · cites this paper as [25]
The Related Work section discusses digital-twin intrusion detection, and Section 4.2 describes an implemented SCADA digital twin, but neither addresses integration with zero-trust (ZT) decision logic. Searches for zero-trust, ZT decision logic, and IT–OT convergence found no passage assessing whether such integration has been only conceptual or absent from converged settings. (LLM, conf=0.76)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Digital Twin: Mitigating Unpredictable, Undesirable Emergent Behavior in Complex Systems
Grieves, M., & Vickers, J. (2017) · Transdisciplinary Perspectives on Complex Systems · doi:10.1007/978-3-319-38756-7_4 · Cited by 3,727 · see citing works
A survey of physics-based attack detection in cyber-physical systems
Giraldo, J., Urbina, D., Cardenas, A., Valente, J., Faisal, M., Ruths, J., Tippenhauer, N. O., Sandberg, H., & Candell, R. (2019) · ACM Computing Surveys · doi:10.1145/3203245 · Cited by 535 · see citing works
Flagged first, then by citations
Research works printed but not linked: 12
- [1]Dragos Inc The Industrial Security Year in Review 2024 Available online: https://www.dragos.com (accessed on 11 January 2025)
- [5]Roesch M. Snort: Lightweight intrusion detection for networks Proceedings of the 13th USENIX Conference on System Administration Berkeley, CA, USA 7–12 November 1999 229 238
- [7]Paxson V. Bro: A system for detecting network intruders in real-time Comput. Netw. 1999 31 2435 2463 10.1016/S1389-1286(99)00112-7 · DOI · Paper page
- [9]Langner R. Stuxnet: Dissecting a cyberwarfare weapon IEEE Secur. Priv. 2011 9 49 51 10.1109/MSP.2011.67 · DOI · Paper page
- [11]Oyekan J. Hu H. A digital twin framework for cyber-security monitoring in pipeline transport systems IEEE Access 2021 9 155532 155543
- [13]Zhao R. Yan D. Liu Q. Leng J. Wan J. Chen X. Zhang X. Digital Twin-Driven Cyber-Physical System for Autonomously Controlling of Micro Punching System IEEE 2023 10 10345 10356 10.1109/ACCESS.2019.2891060 · DOI
- [14]Lin H. Xie S. Zheng R. Real-Time Hybrid Anomaly Detection for SCADA Systems Using Digital Twins and Deep Learning ISA Trans. 2024 145 78 89 10.1016/j.isatra.2024.01.021 · DOI
- [15]Xu Q. Ali S. Yue T. Digital Twin-based Anomaly Detection in Cyber-physical Systems Proceedings of the 2021 14th IEEE Conference on Software Testing, Verification and Validation (ICST) Porto de Galinhas, Brazil 12–16 April 2021 IEEE New York, NY, USA 2021 205 216 10.1109/ICST49551.2021.00031 · DOI
- [17]Xu Y. Yang Z. He D. Towards Zero-Day Attack Detection in Smart Manufacturing: A Digital Twin and Deep Learning Fusion IEEE Trans. Ind. Informatics 2024 20 6001 6012
- [18]Mitchell R. Chen I.R. A survey of intrusion detection techniques for cyber-physical systems ACM Comput. Surv. 2014 46 1 29 10.1145/2542049 · DOI · Paper page
- [19]Creswell A. White T. Dumoulin V. Arulkumaran K. Sengupta B. Bharath A.A. Generative adversarial networks: An overview IEEE Signal Process. Mag. 2018 35 53 65 10.1109/MSP.2017.2765202 · DOI · Paper page
- [22]Alves T. BATADAL: A realistic, scenario-based dataset for testing anomaly detection in water distribution systems Proceedings of the 3rd International Workshop on Cyber-Physical Systems for Smart Water Networks Pittsburgh, PA, USA 21 April 2017
Cited by
Sorted by citations
Qadri, S. M. (2026) · Frontiers in Computer Science and Artificial Intelligence · doi:10.32996/fcsai.2026.5.9.2
“Sayghe [25] reports the most empirically grounded DT-based intrusion-detection work in this space, evaluating a Digital Twin-driven IDS on the SWaT water-treatment testbed against false data injection, denial-of-service, and command-injection attacks.”
Influential
- Authors
- Sayghe, A.
- Affiliations
- Yanbu Industrial College (SA)
- Corresponding author
- Sayghe, Ali
- ORCID
- Sayghe, Ali
- Venue
- Sensors
- Publisher
- MDPI AG
- Published
- 2025-08-11
- Volume
- 25
- Issue
- 16
- Pages
- 4963
- ISSN
- 1424-8220 (ISSN-L)
- PMC
- PMC12390215
- OpenAlex
- W4413129789
- Cited by
- 30
- References
- 2
- Citations by year
- 2026: 30
- FWCI
- 11.02
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Licence
- Locations
- Sensors (publishedVersion, cc-by)
- Preprints.org (acceptedVersion, cc-by)
- Europe PMC (PubMed Central) (publishedVersion, cc-by)
- PubMed Central (publishedVersion, cc-by)
- PubMed (publishedVersion)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Topics
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Engineering › Control and Systems Engineering › Fault Detection and Control Systems
- Keywords
- digital twin, intrusion detection, SCADA security, cyber-physical systems, water treatment plant, false data injection attacks, denial-of-service attacks, hybrid anomaly detection, sensor modeling, critical infrastructure cybersecurity
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
