Digital Twin Degradation: Detecting Cyber Physical Attacks via Temporal Inconsistencies
2026-08-17 • Cryptography and Security
Cryptography and SecurityArtificial IntelligenceMachine Learning
AI summaryⓘ
The authors present a method to detect cyber attacks on physical systems by watching for mismatches between a digital model (Digital Twin) and the real system. They train their model only on normal system behavior to predict short-term outcomes and then look for unusual differences over time. Their method works well even if the digital twin data is partially lost or delayed, unlike usual detection methods that need examples of attacks. Tests on industrial datasets showed high accuracy and low false alarms. The authors highlight that issues with the digital twin data can actually help spot attacks rather than just cause problems.
Digital TwinCyber Physical SystemsTemporal ConsistencyAnomaly DetectionUnsupervised LearningIndustrial Control SystemsPrediction ResidualsChange DetectionSensor DegradationData Desynchronization
Authors
Konstantinos E. Kampourakis, Vasileios Gkioulos, Sokratis Katsikas
Abstract
Digital Twins (DTs) are increasingly used to monitor and analyze Cyber Physical Systems (CPS). However, in adversarial environments, the fidelity of a DT cannot be assumed. Communication delays, data manipulation, sensor degradation, or partial information loss may cause the DT state to diverge from the physical process it represents. Such divergence creates temporal inconsistencies that may reveal cyber physical attacks. This paper proposes a detection framework that monitors temporal consistency between the physical system and a potentially degraded DT view. A DT predictor is trained exclusively on normal system behavior to model short-term system dynamics. During operation, discrepancies between predicted and observed states are transformed into multi-horizon temporal features capturing the magnitude, persistence, and evolution of prediction residuals. An unsupervised density model characterizes normal consistency patterns, while a sequential change detection mechanism identifies sustained deviations indicative of attacks. The approach is evaluated on three widely used Industrial Control System (ICS) datasets, SWaT, HAI, and BATADAL, under multiple DT degradation scenarios, including time desynchronization and partial observability loss. Results show that temporal inconsistency patterns enable reliable event-level attack detection with bounded false alarm rates and low detection latency. The proposed method achieves up to 98% detection reliability on SWaT and false alarm rates below 2%. Unlike conventional anomaly detection methods, the proposed framework does not require attack signatures or labeled attack data and remains effective even when the DT view is degraded. These results suggest that DT degradation, often treated as a limitation, can instead serve as a useful signal for cyber physical security monitoring.