A Digital Twin-Based Approach for Detecting Cyber–Physical Attacks in ICS Using Knowledge Discovery
Source abstract
Abstract
The integration and automation of industrial processes has brought significant gains in efficiency and productivity but also elevated cybersecurity risks, especially in the process industry. This paper introduces a methodology utilizing process mining and digital twins to enhance anomaly detection in Industrial Control Systems (ICS). By converting raw device logs into event logs, we uncover patterns and anomalies indicative of cyberattacks even when such attacks are masked by normal operational data. We present a detailed case study replicating an industrial process to demonstrate the practical application of our approach. Experimental results confirm the effectiveness of our method in identifying cyber–physical attacks within a realistic industrial setting.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Information and Cyber Security · Smart Grid Security and Resilience · Digital and Cyber Forensics
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Electronics, Computer Science and Systems, University of Calabria, 87036 Rende, Italy
Funding
European Union—NextGenerationEU
References (55)
Show source-provided references
1. (2022). Information Security, Cybersecurity and Privacy Protection–Information Security Management Systems–Requirements (Standard No. ISO/IEC 27001:2022).
2. Pascoe, C., Quinn, S., and Scarfone, K. (2024). The NIST Cybersecurity Framework (CSF) 2.0, NIST Cybersecurity White Papers (CSWP), National Institute of Standards and Technology.10.6028/NIST.SP.1304.ipd ↗
3. Lucchese, M., Lupia, F., Merro, M., Paci, F., Zannone, N., and Furfaro, A. (September, January 29). HoneyICS: A High-interaction Physics-aware Honeynet for Industrial Control Systems. Proceedings of the 18th International Conference on Availability, Reliability and Security, ARES ’23, Benevento, Italy.
4. Lupia, F., Lucchese, M., Merro, M., and Zannone, N. (2023, January 15–18). ICS Honeypot Interactions: A Latitudinal Study. Proceedings of the 2023 IEEE International Conference on Big Data (BigData), Sorrento, Italy.10.1109/BigData59044.2023.10386497 ↗
5. Cybersecurity in industrial control systems: Issues, technologies, and challenges10.1016/j.comnet.2019.106946 ↗
6. Lazzaro, S., De Angelis, V., Mandalari, A.M., and Buccafurri, F. (2024, January 11–15). Is Your Kettle Smarter Than a Hacker? A Scalable Tool for Assessing Replay Attack Vulnerabilities on Consumer IoT Devices. Proceedings of the 2024 IEEE International Conference on Pervasive Computing and Communications (PerCom), Biarritz, France.10.1109/PerCom59722.2024.10494466 ↗
7. Enforcing security policies on interacting authentication systems10.1016/j.cose.2024.103771 ↗
8. Process mining usage in cybersecurity and software reliability analysis: A systematic literature review10.1016/j.array.2021.100120 ↗
9. Detecting and Preventing Cyber Insider Threats: A Survey10.1109/COMST.2018.2800740 ↗
10. Barker, K., and Ghazinour, K. (2021, January 19–20). A Digital Twin-Based Cyber Range for SOC Analysts. Proceedings of the Data and Applications Security and Privacy XXXV, Calgary, Canada.10.1007/978-3-030-81242-3 ↗
11. Digital twins in cyber effects modelling of IoT/CPS points of low resilience10.1016/j.simpat.2023.102744 ↗
12. LiDiTE: A Full-Fledged and Featherweight Digital Twin Framework10.1109/TDSC.2023.3236798 ↗
13. (2024, September 22). IEC 61131; International Electrotechnical Commission: Geneva, Switzerland. Available online: https://webstore.iec.ch/en/publication/62427.
14. Introduction to the modbus protocol
15. Swales, A. (2024, September 22). OPEN Modbus/TCP SPECIFICATION Release 1.0; Schneider Electric. Available online: https://wingpath.co.uk/docs/modbus_tcp_specification.pdf.
16. van der Aalst, W.M.P. (2011). Process Mining: Discovery, Conformance and Enhancement of Business Processes, Springer Publishing Company, Incorporated. [1st ed.].10.1007/978-3-642-19345-3 ↗
17. Agrawal, R., Gunopulos, D., and Leymann, F. (1998, January 23–27). Mining process models from workflow logs. Proceedings of the International Conference on Extending Database Technology, Valencia, Spain.10.1007/BFb0101003 ↗
18. Rediscovering workflow models from event-based data using little thumb10.3233/ICA-2003-10205 ↗
19. Discovering expressive process models by clustering log traces10.1109/TKDE.2006.123 ↗
20. ter Hofstede, A., and Schimm, G. (2003, January 26–27). Mining most specific workflow models from event-based data. Proceedings of the Business Process Management: International Conference, BPM 2003, Eindhoven, The Netherlands. Proceedings 1.
21. Integrating machine learning and workflow management to support acquisition and adaptation of workflow models10.1002/1099-1174(200006)9:2<67::AID-ISAF186>3.0.CO;2-7 ↗
22. Workflow mining with InWoLvE10.1016/j.compind.2003.10.002 ↗
23. Workflow mining: Discovering process models from event logs10.1109/TKDE.2004.47 ↗
24. Genetic process mining: An experimental evaluation10.1007/s10618-006-0061-7 ↗
25. Caselli, M., Zambon, E., and Kargl, F. (April, January 13). Sequence-aware intrusion detection in industrial control systems. Proceedings of the 1st ACM Workshop on Cyber-Physical System Security, Singapore.10.1145/2732198.2732200 ↗
26. Nivethan, J., and Papa, M. (2016, January 5–7). A SCADA intrusion detection framework that incorporates process semantics. Proceedings of the 11th Annual Cyber and Information Security Research Conference, Oak Ridge, TN, USA.10.1145/2897795.2897814 ↗
27. Yusheng, W., Kefeng, F., Yingxu, L., Zenghui, L., Ruikang, Z., Xiangzhen, Y., and Lin, L. (2017, January 22–24). Intrusion detection of industrial control system based on Modbus TCP protocol. Proceedings of the 2017 IEEE 13th International Symposium on Autonomous Decentralized System (ISADS), Bangkok, Thailand.10.1109/ISADS.2017.29 ↗
28. Fovino, I.N., Carcano, A., Murel, T.D.L., Trombetta, A., and Masera, M. (2010, January 20–23). Modbus/DNP3 state-based intrusion detection system. Proceedings of the 2010 24th IEEE International Conference on Advanced Information Networking and Applications, Perth, Australia.10.1109/AINA.2010.86 ↗
29. Katulić, F., Sumina, D., Erceg, I., and Groš, S. (2022, January 22–24). Enhancing Modbus/TCP-Based Industrial Automation and Control Systems Cybersecurity Using a Misuse-Based Intrusion Detection System. Proceedings of the 2022 International Symposium on Power Electronics, Electrical Drives, Automation and Motion (SPEEDAM), Sorrento, Italy.10.1109/SPEEDAM53979.2022.9842239 ↗
30. Behavior-Rule Based Intrusion Detection Systems for Safety Critical Smart Grid Applications10.1109/TSG.2013.2258948 ↗
31. Mehmood, M., Baig, Z., and Syed, N. (2024, January 3–7). Securing Industrial Control Systems (ICS) Through Attack Modelling and Rule-Based Learning. Proceedings of the 2024 16th International Conference on COMmunication Systems & NETworkS (COMSNETS), Bengaluru, India.10.1109/COMSNETS59351.2024.10426882 ↗
32. Phillips, B., Gamess, E., and Krishnaprasad, S. (2020, January 2–4). An evaluation of machine learning-based anomaly detection in a SCADA system using the modbus protocol. Proceedings of the 2020 ACM Southeast Conference, Tampa, FL, USA.10.1145/3374135.3385282 ↗
33. Anton, S.D., Kanoor, S., Fraunholz, D., and Schotten, H.D. (2018, January 27–30). Evaluation of machine learning-based anomaly detection algorithms on an industrial modbus/tcp data set. Proceedings of the 13th International Conference on Availability, Reliability and Security, Hamburg, Germany.10.1145/3230833.3232818 ↗
34. Radoglou-Grammatikis, P., Siniosoglou, I., Liatifis, T., Kourouniadis, A., Rompolos, K., and Sarigiannidis, P. (2020, January 7–9). Implementation and detection of modbus cyberattacks. Proceedings of the 2020 9th International Conference on Modern Circuits and Systems Technologies (MOCAST), Bremen, Germany.10.1109/MOCAST49295.2020.9200287 ↗
35. Process Mining and Security: Detecting Anomalous Process Executions and Checking Process Conformance10.1016/j.entcs.2004.10.013 ↗
36. Accorsi, R., and Stocker, T. (2012, January 26–30). On the exploitation of process mining for security audits: The conformance checking case. Proceedings of the 27th Annual ACM Symposium on Applied Computing, Trento, Italy.10.1145/2245276.2232051 ↗
37. Anomaly detection for industrial control systems using process mining10.1016/j.cose.2018.06.002 ↗
38. Bernardi, S., Trillo-Lado, R., and Merseguer, J. (2018, January 10–14). Detection of integrity attacks to smart grids using process mining and time-evolving graphs. Proceedings of the 2018 14th European Dependable Computing Conference (EDCC), Iaşi, Romania.10.1109/EDCC.2018.00032 ↗
39. Colbert, E., Sullivan, D., Hutchinson, S., Renard, K., and Smith, S. (2016, January 17–18). A process-oriented intrusion detection method for industrial control systems. Proceedings of the International Conference on Cyber Warfare and Security, Boston, MA, USA.10.1007/978-3-319-32125-7_11 ↗
40. (2024, September 10). PyModbus—A Python Modbus Stack 2014; PyModbus 3.7.3dev Documentation—Pymodbus.readthedocs.io. Available online: https://pymodbus.readthedocs.io/en/latest/source/readme.html.
41. Physics-aware targeted attacks against maritime industrial control systems
42. Process Discovery under Precedence Constraints10.1145/2710020 ↗
43. Weijters, A., and Ribeiro, J. (2011, January 11–15). Flexible Heuristics Miner (FHM). Proceedings of the 2011 IEEE Symposium on Computational Intelligence and Data Mining (CIDM), Paris, France.10.1109/CIDM.2011.5949453 ↗
44. Halpin, T., Krogstie, J., Nurcan, S., Proper, E., Schmidt, R., Soffer, P., and Ukor, R. (2009, January 8–9). Anomaly Detection Using Process Mining. Proceedings of the International Workshop on Business Process Modeling, Development and Support, Amsterdam, The Netherlands.
45. Discovering congestion dynamics models in clinical pathways using background knowledge10.1016/j.jocs.2024.102322 ↗
46. Leemans, S.J.J., Fahland, D., and van der Aalst, W.M. (2013, January 24–28). Discovering Block-Structured Process Models from Event Logs—A Constructive Approach. Proceedings of the Applications and Theory of Petri Nets, Milan, Italy.10.1007/978-3-642-38697-8_17 ↗
47. Van Zelst, S., Van Dongen, B., and Van Der Aalst, W. (2015, January 4–6). ILP-based process discovery using hybrid regions. Proceedings of the CEUR Workshop Proceedings, Gandhinagar, India.
48. PM4Py: A process mining library for Python10.1016/j.simpa.2023.100556 ↗
49. Berti, A., and van der Aalst, W.M.P. (2021). A Novel Token-Based Replay Technique to Speed Up Conformance Checking and Process Enhancement. Transactions on Petri Nets and Other Models of Concurrency XV, Springer.10.1007/978-3-662-63079-2_1 ↗
50. Farooq, H.M., and Otaibi, N.M. (2018, January 27–29). Optimal Machine Learning Algorithms for Cyber Threat Detection. Proceedings of the 2018 UKSim-AMSS 20th International Conference on Computer Modelling and Simulation (UKSim), Cambridge, UK.10.1109/UKSim.2018.00018 ↗
51. Nitesh, K.T., Thirumala, A.K., Mohammed, U.F., and Ahmed, M.R. (2023, January 17–19). Network Security Threat Detection: Leveraging Machine Learning Algorithms for Effective Prediction. Proceedings of the 2023 12th International Conference on Advanced Computing (ICoAC), Chennai, India.10.1109/ICoAC59537.2023.10249943 ↗
52. Machine Learning for Anomaly Detection: A Systematic Review10.1109/ACCESS.2021.3083060 ↗
53. A Survey on Advanced Persistent Threats: Techniques, Solutions, Challenges, and Research Opportunities10.1109/COMST.2019.2891891 ↗
54. Process mining-based anomaly detection of additive manufacturing process activities using a game theory modeling approach10.1016/j.cie.2020.106584 ↗
55. Greco, G., Lupia, F., and Scarcello, F. (2017, January 19–25). The Tractability of the Shapley Value over Bounded Treewidth Matching Games. Proceedings of the Twenty-Sixth International Joint Conference on Artificial Intelligence, IJCAI 2017, Melbourne, Australia.10.24963/ijcai.2017/145 ↗