Industrial Control Systems attack detection by hybrid digital twin

The massive digital transformation of industrial control systems, based on tight integration between information and telecommunication technologies, has enlarged the attack surfaces of the industrial systems, thus increasing the need to protect the operational and production processes. Information Technology tools are currently not able to guarantee confidentiality, integrity, and availability in the industrial domain, therefore it is of paramount importance to understand the interaction of the physical components with the information networks. This paper aims to provide a novel Intrusion Detection System for identifying cyber-attacks in cyber-physical systems: the key novel idea is to consider a virtual model for both the plant and the controller to detect attacks. In fact, most of the approaches presented in literature rely on a virtual model representing only the plant, while in this contribution we consider the plant and the controller as a system to be replicated in the digital twin and resulting in a hybrid automata. This allows the detection of attacks to the actuators, that otherwise cannot be revealed. Advantages of this approach are demonstrated by exploiting data from a water distribution system.