PLC-MDT: A Framework for Detecting Anomalies With Digital Twins of Industrial Control Systems

The attack events (such as the Stuxnet and BlackEnergy) that targeted the industrial control system (ICS) have validated its vulnerability to cyber intrusions. The prevention of ICS from cyberattacks is undoubtedly important and practical as it operates dangerous equipment and produces products that people need. Traditional anomaly detection methods, which rely heavily on SCADA data, are often unreliable due to the limitation of such data in accurately reflecting real-time system states under attacks. Therefore, we propose PLC-MDT, a novel anomaly detection method based on digital twins (DTs), exploiting the modern communication technology and computing resources of ICS. PLC-MDT does not depend solely on SCADA data; instead, it leverages the interaction between DT and real-world ICS, utilizing both DT and field-site data to perform anomaly detection. Specifically, for PLC-MDT, the prediction model in DT is trained based on historical data, and the predicted values are used as input to the mechanism model in DT to generate simulated data. The networked structure of ICS guarantees real-time data collected from field sites for DT. Therefore, PLC-MDT detects attacks by monitoring the difference between the predicted and real-time data, revealing control channel corruption when the difference exceeds a threshold. The effectiveness of PLC-MDT is demonstrated through experiments on real-world systems, showing its potential for real-time detection of anomalies in ICS.