<p>Industrial Control Systems (ICS) are increasingly exposed to sophisticated cyber-physical attacks that traditional Intrusion Detection Systems (IDS) often fail to detect due to their limited awareness of physical process dynamics. To address this challenge, we propose a Digital Twin (DT)-enabled IDS framework that combines deep learning with real-time process simulation. Specifically, the detection algorithm is implemented using a hybrid model that integrates a Temporal Convolutional Network (TCN) to extract short-term temporal dependencies and a Transformer encoder to capture long-range semantic relationships. A feature-level fusion strategy unifies cyber data (network/application logs) and physical process data (sensor/actuator signals) into a shared representation, which is then classified by the TCN–Transformer model. The system is further optimized using the Tornado Optimizer, a bio-inspired metaheuristic that automatically tunes hyperparameters to improve accuracy and generalization. Experiments conducted on two benchmark datasets, Honeypot 2022 (cyber-only) and SWaT (cyber-physical), demonstrate that the proposed framework achieves 97.2% accuracy and a 96.9% F1-score on the SWaT dataset. The model consistently outperforms the evaluated representative baseline IDS methods under identical experimental conditions. Robustness analysis further confirms its resilience to noise, missing data, and adversarial perturbations.</p>

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Secure intrusion detection system for industrial control systems using digital twins

  • Yousef Sanjalawe,
  • Sharif Naser Makhadmeh,
  • Salam Al-E’mari,
  • Emran Alzubi

摘要

Industrial Control Systems (ICS) are increasingly exposed to sophisticated cyber-physical attacks that traditional Intrusion Detection Systems (IDS) often fail to detect due to their limited awareness of physical process dynamics. To address this challenge, we propose a Digital Twin (DT)-enabled IDS framework that combines deep learning with real-time process simulation. Specifically, the detection algorithm is implemented using a hybrid model that integrates a Temporal Convolutional Network (TCN) to extract short-term temporal dependencies and a Transformer encoder to capture long-range semantic relationships. A feature-level fusion strategy unifies cyber data (network/application logs) and physical process data (sensor/actuator signals) into a shared representation, which is then classified by the TCN–Transformer model. The system is further optimized using the Tornado Optimizer, a bio-inspired metaheuristic that automatically tunes hyperparameters to improve accuracy and generalization. Experiments conducted on two benchmark datasets, Honeypot 2022 (cyber-only) and SWaT (cyber-physical), demonstrate that the proposed framework achieves 97.2% accuracy and a 96.9% F1-score on the SWaT dataset. The model consistently outperforms the evaluated representative baseline IDS methods under identical experimental conditions. Robustness analysis further confirms its resilience to noise, missing data, and adversarial perturbations.