Using Digital Twin to Detect Cyber-Attacks in Industrial Control Systems

The digital transition is largely impacting industrial control systems. The integration of information and communication technologies in industrial control systems on the one hand is improving the related functionalities, on the other hand is increasing the related vulnerabilities and the attack surfaces of industrial systems. This results in the non-negligible need for protection of the operational and production processes. Although many tools are available from the Information Technology sector, these are currently not appropriate to guarantee confidentiality, integrity, and availability in the industrial domain. As a consequence, it is crucial to investigate the proper strategies and methodologies to guarantee the protection of industrial control systems. In this context, this paper aims at defining a novel tool for the detection of cyber-attacks in industrial control systems, which is based on the implementation of a virtual model for both the physical and the control layers to detect attacks. In fact, the majority of literature contributions consider the implementation of a virtual model for the only physical layer. In this paper, the virtual model for the physical and the control layers is defined as a digital twin based on a hybrid automaton. The effectiveness of the proposed approach is demonstrated by considering its application to a water distribution system case study.