Summary
It’s hard to figure out what attackers did inside industrial systems by just looking at the system data, because the data shows physical changes, not the attacker’s actions directly. The authors created a method using digital twins—virtual models of the real system—to better understand and describe these changes. They then used advanced language models to connect these descriptions to known cyberattack behaviors. Their approach reduced false alarms in some tests but didn’t always improve overall accuracy, and it didn’t work as well on other datasets. This shows digital twins can help security analysis, but they don’t yet give a clear, automatic way to identify attacks.
What this means in practice
- •For industrial cybersecurity teams: Improve mapping of telemetry data to known cyberattack behaviors using digital twin context to reduce false positive alerts in specific scenarios.
- •For oil and gas operations teams: Assist in analyzing suspicious system changes by linking telemetry and process states to attack models for better situational awareness.
Authors
Konstantinos E. Kampourakis, Vyron Kampourakis, Vasileios Gkioulos, Sokratis Katsikas
Abstract
Reconstructing adversarial behavior from Industrial Control System (ICS) telemetry is difficult because process observations reveal physical changes more directly than the actions that produced them. This paper presents a Digital Twin (DT)-assisted framework that extracts synchronized state changes, converts them into evidence-preserving descriptions, maps them to ATT&CK for ICS through retrieval-augmented Large Language Model (LLM) reasoning, and constructs a typed dependency graph. Evaluation comprises a four-configuration ablation on nine held-out SWaT scenarios containing ten telemetry-evaluable ground-truth episodes, three independent generations of the principal mapping configurations, and external evaluation on BATADAL and WADI. Across the three SWaT generations, DT-enriched mapping produces fewer annotation-relative False Positive (FP) episodes in every run, with a mean per-run reduction of 34.1%. Both configurations obtain a mean recall of 0.633, although recall varies between 0.50 and 0.70 and DT enrichment does not improve F1 in every run. These observations are descriptive: the primary-run paired comparisons do not reach statistical significance, and the mapping advantage does not transfer to either external dataset. An exploratory positive-only dependency benchmark recovers eight of nine documented Co-occurrence relationships with DT context. A separate end-to-end benchmark containing one positive pair and 25 negative controls exposes propagation of mapping errors into unsupported edges. The findings identify both the potential and limitations of DT context for semantic security interpretation, without establishing reliable autonomous attribution, general causal reconstruction, or practical analyst benefit.