Real-time, Simulation-based Identification of Cyber-Security Attacks of Industrial Plants

This paper considers the problem of cyber attacks onto industrial plants and proposes to use a digital twin to detect and localize such attacks. The digital twin consists of a representation of the nominal plant behavior, i.e., not under attack, for which differential-algebraic equation systems or discrete state models may be used. By simulating the nominal behavior of the system online, i.e., in parallel to the process, and continuously comparing the simulated behavior to the measured values allows to detect attacks. Their localization is facilitated through a root-cause analysis, which is also based on the model description of the plant. The concept has been implemented and tested on a small scale industrial prototype.