BALLAST: Physics-Aware Moving Target Defense for Industrial Control Systems Using a Digital Twin Safety Oracle

Graphical Abstract BALLAST: Physics-Aware Moving Target Defense for Industrial Control Systems Using a Digital Twin Safety Oracle

arXiv:2610.18311v1 [cs.CR] 13 Oct 2026

Oscar Mogollon-Gutierrez, Mohammadhossein Homaei, Alberto López-Trigo, Andres Caro, Mar Avila

Adversary maps the plant

Addresses keep moving

A Digital Twin gates the move

The plant carries on

A low-and-slow sweep hunts for the PLCs behind the wire

An RL policy reshuffles the mapping over an SDN fabric

The forecast must clear the safe envelope before any rule is installed

In-flight Modbus transactions are drained, not cut, at every handover

3600 probes · 30 min

≈22.5 mutations / hour

≈10% of moves masked

0.08% packet loss

RESULTS Physics-agnostic MTD

5

the closest baseline, RL-MTD

0.920

40.6

BALLAST

0

the twin inside the decision loop

0.048

8.9

safety violations

tracking error

P99 jitter (ms)

safety violations

tracking error

P99 jitter (ms)

across 50 runs

physical MSE

data plane

across 50 runs

physical MSE

data plane

-SWaT water treatment testbed · 50 Monte Carlo runs · reconnaissance success cut by 85 percent

Highlights BALLAST: Physics-Aware Moving Target Defense for Industrial Control Systems Using a Digital Twin Safety Oracle Oscar Mogollon-Gutierrez, Mohammadhossein Homaei, Alberto López-Trigo, Andres Caro, Mar Avila • A learned Digital Twin vetoes any network mutation that would breach plant safety. • Ballast cuts reconnaissance scan success by 85% on the SWaT testbed. • No safety violation in 50 runs, against five for the closest RL-based MTD. • Connection draining cuts P99 jitter to 8.9 ms, within the 50 ms control budget.

BALLAST: Physics-Aware Moving Target Defense for Industrial Control Systems Using a Digital Twin Safety Oracle Oscar Mogollon-Gutierreza , Mohammadhossein Homaeia , Alberto López-Trigoa , Andres Caroa and Mar Avilaa,∗ a Departamento de Ingeniería de Sistemas Informáticos y Telemáticos, Universidad de Extremadura, Av. Universidad

s/n, Cáceres, 10003, Extremadura, Spain

ARTICLE INFO

Abstract

Keywords: Moving Target Defense Digital Twin Industrial Control Systems Safe Reinforcement Learning Software-Defined Networking

Industrial Control Systems run on static network configurations, which leaves an attacker unlimited time to map the plant. Moving Target Defense answers this by shuffling addresses, but almost every published scheme never checks whether the reconfiguration will itself disturb the physical process it protects, so the defense can destabilise a control loop or trip an actuator. We present BALLAST, which places a learned Digital Twin between the security policy and the plant as a safety oracle. A physicsinformed LSTM surrogate forecasts the physical effect of a candidate network change, a reinforcement learning agent trades security entropy against process stability, and a connection-draining handover lets in-flight Modbus transactions complete before the old mapping is withdrawn. An explicit shield rejects any action whose predicted trajectory would leave the safe operating envelope. On the SWaT water treatment testbed, Ballast cut the success rate of an adversary’s reconnaissance sweep by 85 percent and recorded no safety violation across 50 runs, a 95 percent upper bound of 5.8 percent on the violation rate, against five violations and a tracking error 19 times larger for RL-MTD, the closest published analogue to our design. Measured against the strongest baseline on the physical metrics, a threshold-triggered scheme that itself records one violation rather than RL-MTD’s five, Ballast still improves the tracking error by a factor of 2.5 and removes that remaining violation. The gain costs a small and deliberate concession in raw deterrence. Twin inference meets the 50 ms budget on a workstation core and an embedded GPU, and is projected to meet it on both edge CPUs when the three envelope stages are evaluated in a single batched call; the complete decision-to-enforcement path was measured only on the workstation.

1. Introduction The fourth industrial revolution has reshaped manufacturing by folding digital technology into practices that were once entirely mechanical [1, 2, 3]. The defining feature of this shift is the convergence of Information Technology and Operational Technology, which has turned historically isolated Industrial Control Systems (ICS) into interconnected Cyber-Physical Systems [4, 5]. The gain in efficiency and analytics is real, but so is the cost: the attack surface of critical infrastructure has widened dramatically [6]. Recent surveys report that the connectivity introduced by the Industrial Internet of Things and edge computing exposes legacy equipment to threats that air-gapping used to absorb [7, 8]. Dynamic defense is an appealing answer, yet deploying Moving Target Defense (MTD) inside a live plant is harder than the literature often admits. An enterprise network tolerates occasional jitter. An industrial control loop does not. Latency introduced by reconfiguration or by Software-Defined Networking (SDN) overhead translates directly into dropped Modbus/TCP commands [9, 10]. Several authors warn that blind IP shuffling or topology mutation, applied without regard to the physical state, can desynchronise actuators and cause real damage in high-inertia systems such as power ∗ Corresponding author

oscarmg@unex.es (O. Mogollon-Gutierrez); mhomaein@alumnos.unex.es (M. Homaei); albertolt@unex.es (A. López-Trigo); andresc@unex.es (A. Caro); mmavila@unex.es (M. Avila) ORCID (s):

O Mogollon-Gutierrez et al.: Preprint submitted to Elsevier

grids and water treatment plants [11]. Legacy field devices compound the problem, since they often lack the headroom for frequent re-authentication or large flow-rule updates, so an aggressive mutation schedule can starve the controller in much the same way a denial-of-service attack would [12, 13]. What is missing, therefore, is a physics-aware defense that balances security entropy against the operational stability of the process. Resolving that conflict calls for a change of stance, from blind network mutation to physics-aware active defense. Tuning network parameters is not enough. In critical infrastructure the physical state has to enter the decision as a constraint, not as a metric consulted after the fact [12]. This in turn requires an architecture that can forecast the physical consequence of a cyber manoeuvre before the manoeuvre is committed. Seen this way, the Digital Twin stops being a monitoring dashboard and becomes a safety oracle that closes the semantic gap between the control plane and the plant [14]. By simulating how control commands and network latency interact, a physics-informed model can locate the windows in which reconfiguration is safe, which turns MTD from a hazard into a usable security layer. This paper puts that idea into practice through BALLAST, a physics-aware defense framework that couples a Digital Twin with SDN-based mutation. We pose the defense as a Safe Reinforcement Learning problem. A Proximal Policy Optimization agent maximises security entropy, while an explicit shield driven by a physics-informed LSTM surrogate masks every action whose predicted trajectory would Page 1 of 23

Physics-Aware Moving Target Defense

leave the safe operating envelope. We chose an explicit shield over a Lagrangian constrained formulation because a constraint that is only satisfied in expectation is of little use when a single excursion can damage equipment. To address the synchronisation latency reported in earlier work, we add a Make-Before-Break handover that drains established TCP sessions instead of severing them. On the Secure Water Treatment (SWaT) testbed, Ballast reduces the success rate of a reconnaissance sweep by 85 percent, the phase of an attack that an address-mutation defense is designed to act on, and produces no safety violation in 50 nominal runs, with a 95 percent upper bound of 5.8 percent on the violation rate. It also achieves 98.6 percent lower packet loss than RL-MTD, the learning-based baseline it is paired against throughout, and 92.7 percent lower than Adaptive Path, the learning-based baseline with the lowest loss of the four. A dual-validation mechanism keeps it stable under simulated sensor drift. The remainder of the paper is organised as follows. Section 2 reviews related work. Section 3 states the problem and the threat model. Section 4 describes the Ballast framework, and Section 5 gives implementation details. Section 6 reports the experimental results, Section 7 measures the decision latency across deployment platforms and bounds how it scales with plant size, and Sections 8 and 9 discuss the findings and conclude.

2. Related Work This section reviews the defense of Industrial Control Systems along four lines of development: the migration of MTD from IT to OT through SDN, the use of artificial intelligence for adaptive defense, the rise of Digital Twins as security components, and the introduction of physical process semantics into security mechanisms. The final subsection draws these together and isolates the gap that Ballast addresses.

2.1. Evolution of MTD in Industrial Networks The static character of legacy ICS has long given adversaries the time they need for reconnaissance. MTD counters this asymmetry, and it has grown from simple IP hopping in enterprise networks into SDN-enabled architectures shaped for OT. Etxezarreta et al. [15] proposed DEFCLON, a replica-based mechanism that duplicates packets across multiple paths and raises attacker uncertainty without relying on signatures. Kpoze et al. [16] showed that SDN-orchestrated reconfiguration can frustrate stealthy false data injection in Smart Grid SCADA by mutating the attack surface in response to the observed network state. Later work has combined MTD with adjacent paradigms. Bose et al. [17] introduced ZT-MTD for Distributed Energy Resources, pairing Zero Trust authentication with dynamic mutation to narrow the window for lateral movement, although the integration cost on legacy hardware remains high. Qin et al. [18] coupled optimal shuffling with cyber deception, so that the adversary pays for both uncertainty and misdirection. O Mogollon-Gutierrez et al.: Preprint submitted to Elsevier

Operational performance nonetheless remains the binding constraint. Etxezarreta et al. [19] proposed a low-delay randomisation technique that keeps reconfiguration overhead small enough to avoid communication errors in timecritical loops. Their target, however, is network-level latency, not the physical safety of the process during the transition. That distinction recurs across the field. Modern MTD is agile and well engineered, yet it optimises throughput and jitter while treating the plant as a passive endpoint rather than an active constraint.

2.2. Intelligent Defense: RL and AI in Cyber-Physical Security Artificial intelligence and reinforcement learning have become standard tools for adaptive defense in Industrial Internet of Things settings. Mohammed et al. [20] built a deep learning intrusion detector for smart grids that identifies false data injection from temporal patterns in measurement streams. Arulkumar and K. [21] combined ensemble deep learning with blockchain to detect advanced persistent threats, arguing for multi-stage detection against stealthy adversaries. Ma et al. [22] developed an explainable defense for industrial object detectors so that vision-based monitoring survives adversarial perturbation. A common limitation runs through this body of work. These systems operate in the cyber domain and treat the plant as an abstract data source rather than a dynamical system with inertia and hard limits. Yin and Varga [23] observe in their review that most models optimise detection accuracy or classification speed while ignoring resilience latency, meaning the window inside which a countermeasure must land if physical damage is to be avoided. Pasikhani et al. [24] go further and show that AI-protected infrastructure remains exposed to deceptive adversaries who exploit exactly this absence of physical semantics. Defense therefore needs more than pattern matching; it needs process knowledge inside the decision loop. A parallel line of work addresses this constraint directly. In safe reinforcement learning, a correctness shield filters actions against a formal specification [25], constrained policy optimisation enforces limits in expectation [26], and model-predictive shielding verifies online that a recovery policy remains available [27]. All three presuppose a known transition model and a discrete or low-dimensional state. None addresses the case treated here, in which the only available model of the process is a learned surrogate and the specification is a continuous operating envelope.

2.3. Digital Twins as Security Enablers Digital Twins have moved beyond predictive maintenance and into security architecture. Otoom [28] describes their growing use in risk auditing, where a high-fidelity replica lets an analyst rehearse attacks without touching production. Krishnaveni et al. [14] proposed TwinSec-IDS, which pairs SDN with a Digital Twin and cross-checks network traffic against expected physical behaviour, exposing the slow process drifts that signature-based detectors routinely miss. Page 2 of 23

Physics-Aware Moving Target Defense

Even so, the Digital Twin usually stays in a passive or diagnostic role. Aghazadeh Ardebili et al. [29] apply twins to resilience monitoring in smart energy systems, with the emphasis on post-event recovery rather than prevention. Bajestani et al. [30] rely on twins mainly for state estimation and situational awareness within a Self-X manufacturing framework for Industry 5.0. A few frameworks do let the twin act: Homaei et al. [31] drive model predictive control from a hydraulically regularised twin, and their causal twin [32] selects a mitigation through counterfactual queries. Both respond through the control law, leaving the attack surface untouched. The unexploited opportunity is to let the twin govern the network defense, not only the control loop. Instead of reporting that the plant is under attack, the twin should certify that an automated countermeasure is safe before it reaches the physical layer.

2.4. Physics-Awareness in Critical Infrastructure Protection Recognising the limits of purely cyber defenses, several groups have begun to encode process semantics into security mechanisms. Valderrama et al. [33] designed a physicsbased neural network for photovoltaic generators that detects intrusion by testing electrical output against irradiation laws. Hemmati and Saboori [34] combined data-driven learning with physics-informed constraints to reconstruct attacks in electrical grids while keeping control decisions inside feasible bounds. Related efforts target protocol semantics. Yang et al. [35] infer the meaning of obscure industrial protocol fields so that control commands can be validated at the packet level. Menzel et al. [36] demonstrate in a real energy infrastructure that correlating traffic with physical measurements sharply reduces false positives in process-aware intrusion detection. Homaei et al. [37] embed conservation law residuals as features in a graph attention detector and report tolerance to 15 percent error in the hydraulic parameters. The shared limitation is one of direction. Physics is used as a filter on incoming data or as a forensic instrument after the event. None of these frameworks uses a physical model to orchestrate a defensive manoeuvre, which leaves the initiative with the attacker.

2.5. Research Gap and Motivation A gap therefore persists between cyber agility and physical stability. As Table 1 summarises, the literature tends to occupy one of two positions. 1. Cyber-centric agility. Frameworks such as Deep-Shield [38] maximise security entropy through hierarchical reinforcement learning but treat the plant as a black box. They optimise shuffling speed and mitigation success while ignoring the deterministic timing that ICS protocols demand. The result is a blind spot in which the defense can disrupt operations more severely than the attack it prevents. 2. Passive physical awareness. Physics-aware methods [33, 14] employ Digital Twins or invariant checks for O Mogollon-Gutierrez et al.: Preprint submitted to Elsevier

monitoring and after-the-fact anomaly detection. They can recognise an unsafe state but cannot act on it, so the twin observes the defense loop instead of participating in it. Bridging the gap. Across the SDN-MTD, safe reinforcement learning and Digital Twin security literature surveyed in this section, the twin is used in one of two ways: to observe, as in the detection and auditing work above, or to drive the control law, as in the predictive and causal twins of Homaei et al. [31, 32]. Neither places it between the security policy and the network. We find no framework in which a Digital Twin constrains the action space of an MTD agent, so that a reconfiguration is cleared or rejected before it reaches the data plane. Ballast unifies the three ingredients: the agility of SDN-based mutation, the adaptivity of reinforcement learning, and the foresight of a physics-informed twin. Rather than trading stability for security, it enforces physical safety through an explicit, high-confidence action mask instead of a soft penalty term, so unsafe manoeuvres are never attempted rather than merely discouraged.

3. Problem Statement and Threat Model 3.1. System Model We consider a networked ICS of the kind found in modern critical infrastructure and modelled on the SWaT testbed. The system comprises a set of physical processes  governed by conservation laws, and a cyber layer of nodes  = {𝑛1 , … , 𝑛| | } representing Programmable Logic Controllers, Human-Machine Interfaces and field devices. These nodes communicate over a logical graph 𝐺 = ( , ) using static industrial protocols such as Modbus/TCP or EtherNet/IP. In a conventional deployment the configuration 𝐶𝑠𝑡𝑎𝑡𝑖𝑐 , meaning addresses, ports and routing state, does not change with time 𝑡. Let  denote an adversary with persistent network access. Because the attack surface is stationary, every probe narrows the search and none is invalidated, so the probability of successful reconnaissance 𝑃𝑟𝑒𝑐 (𝑡) is nondecreasing and approaches one: lim 𝑃𝑟𝑒𝑐 (𝑡 ∣ 𝐶𝑠𝑡𝑎𝑡𝑖𝑐 ) = 1.

𝑡→∞

(1)

Once the mapping 𝑀 ∶  → IP is known, the adversary can inject false measurements or issue malicious commands, for instance by driving the motorised valve 𝑀𝑉101 or by falsifying the level indicator 𝐿𝐼𝑇101 in SWaT Stage 1, both of which lead to physical state violations.

3.2. Safe Operating Envelope Because the violation count is the central metric of this paper, we state it explicitly rather than leaving it implicit. Definition 1 (Safe operating envelope). For SWaT we instantiate Ω𝑠𝑎𝑓 𝑒 from the plant’s documented alarm thresholds: LIT101 ∈ [500, 800] mm, LIT301 ∈ [800, 1000] mm and the Stage 2 pH reading AIT202 ∈ [6.75, 7.25]. A Page 3 of 23

Physics-Aware Moving Target Defense Table 1 Positioning of Ballast with respect to the state of the art Reference

Technique

Active Defense

Physics-Aware

SDN-based MTD approaches Etxezarreta et al. (2026) [15]

Replica MTD

✓

×

✓

×

Bose et al. (2025) [17]

Dynamic reconfiguration Zero-Trust MTD

✓

×

AI and RL for defense Mohammed et al. (2026) [20]

DL-based IDS

×

×

Arulkumar et al. (2026) [21] Cao et al. (2025) [38]

Ensemble DL HDRL-MTD

× ✓

× ×

Digital Twin and physics-aware security Krishnaveni et al. (2025) [14] DT-IDS Valderrama et al. (2026) [33] Physics-NN Hemmati et al. (2026) [34] Hybrid DT Homaei et al. (2026) [31] DT + MPC

× × × ✓

✓ ✓ ✓ ✓

Monitoring only, no proactive mitigation Detection only, no response mechanism Energy management focus, not cyber-defense Twin drives the control law; the network configuration is static

Ballast (ours)

✓

✓

Proactive defense with an empirically bounded safety margin

Kpoze et al. (2025) [16]

DT-RL-MTD

safety violation is recorded when any of these variables is observed outside its interval in two consecutive samples of the 1 Hz historian stream, which bounds the excursion below at one second and so at more than one 500 ms PLC scan cycle. A single out-of-range sample is not counted, because the 1 Hz grid cannot resolve an excursion shorter than its own period. Violation counts reported in every table are totals aggregated over the 50 Monte Carlo runs, not per-run averages.

3.3. Trust Boundary We assume the SDN controller and the TPM-attested LSTM weights form the trusted computing base. The adversary controls arbitrary network endpoints, may inject or replay traffic, and may poison up to 10 percent of the historian records used for periodic retraining of the twin. The adversary cannot modify controller code or the attested model binary. This is what allows us both to treat the twin as an oracle during a single deployment cycle and to evaluate poisoning of its training corpus as a distinct threat, which would otherwise read as a contradiction.

3.4. Advanced Threat Scenarios 3.4.1. Adaptive attacker with machine learning An adversary 𝑀𝐿 observes the mapping over a window 𝑇𝑜𝑏𝑠 and fits a predictor of the next assignment. Two regularities give it purchase. The first is the schedule: if the mutation epoch is deterministic, the adversary knows when to probe and spends no budget on stale addresses. The second is the shuffling strategy: under subnet-preserving mutation each host remains inside its own subnet, so the candidate set for the next address is a strict subset of the pool  of 32 virtual addresses from which the mapping draws, rather than all of it. An attacker exploiting both predicts the next address far above the 1∕|| = 3.1 percent chance rate. ̄ and Defense. The policy selects a( target interval Δ𝑡 ) ̄ the realised interval is Δ𝑡 = clip Δ𝑡(1 + 𝑢), 𝑇𝑚𝑖𝑛 , 𝑇𝑚𝑎𝑥 , O Mogollon-Gutierrez et al.: Preprint submitted to Elsevier

Primary Limitation Optimises network latency, does not model physical safety Reactive to attacks, high reconfiguration overhead Focused on authentication, not process stability Learns measurement patterns, no first-principles model Computational cost, opaque decisions Optimises kill-chain mitigation, ignores process dynamics

where [𝑇𝑚𝑖𝑛 , 𝑇𝑚𝑎𝑥 ] = [120, 600] s bounds the interval and 𝑢 is drawn from a cryptographically secure generator on [−0.25, 0.25], so the epoch carries irreducible entropy whatever the policy has learned. Subnet-preserving mutation is permitted at most on alternate epochs, so the candidate set is not persistently constrained. A rejection test on the serial correlation of the last ten intervals is not usable at that sample size, since the standard error √ of the sample correlation 𝜌̂ under independence is 1∕ 𝑛 − 1 = 0.33 for 𝑛 = 10: a threshold of 0.1 would reject roughly three quarters of genuinely random sequences and bias the survivors towards anticorrelation. We therefore audit the correlation over a 200-epoch window offline rather than filtering online.

3.4.2. Digital Twin poisoning Defense. We pair the LSTM twin with an independent physics-based residual monitor, giving a dual-validation architecture. The monitor applies first-principles mass balance for tank 𝑖: | 𝑑𝑉 | 𝑟𝑖 (𝑡) = || 𝑖 − 𝜂𝑣𝑎𝑙𝑣𝑒 (𝑢𝑣𝑎𝑙𝑣𝑒 ) + 𝜂𝑝𝑢𝑚𝑝 (𝑢𝑝𝑢𝑚𝑝 )|| , (2) | 𝑑𝑡 | where 𝜂𝑣𝑎𝑙𝑣𝑒 is the inflow through the motorised inlet valve MV101 and 𝜂𝑝𝑢𝑚𝑝 the outflow of pump P101, with nominal rates of 2.5 m3 ∕h and 1.8 m3 ∕h respectively, cross-checked against the FIT101 flow meter. The command states 𝑢𝑣𝑎𝑙𝑣𝑒 and 𝑢𝑝𝑢𝑚𝑝 are read from Modbus function code 0x01. The cross-validation rule is ⎧1, ⎪ PoisoningFlag = ⎨ ⎪0, ⎩

if ‖𝑆sensor − 𝑆̂LSTM ‖∞ < 𝜖𝑑𝑡 ∧ 𝑟𝑖 > 𝛿𝑝ℎ𝑦 , otherwise.

(3)

with 𝜖𝑑𝑡 = 0.05 and 𝛿𝑝ℎ𝑦 = 0.35 m3 ∕h, roughly 14 percent of nominal inflow. Every normalised quantity in this paper, 𝜖𝑑𝑡 included, is min-max scaled over the same denominator, the width of that variable’s interval in Definition 1, so the Page 4 of 23

Physics-Aware Moving Target Defense Table 2 Defense against advanced threats Attack type ML-based pattern learning DT poisoning (10% of data) Controller DoS

No defense

With defense

45.2% 78.5% 89.2%

8.3% 12.1% 18.7%

Attack success rate over 100 independent adversarial trials per attack type, without and with the corresponding defense of this section. Success means: for row 1, the adversary predicted the next mapping correctly; for row 2, a poisoned twin cleared an action that left Ω𝑠𝑎𝑓 𝑒 ; for row 3, the controller missed its mutation deadline. Row 1 is measured against a chance baseline of 1∕|| = 3.1 percent.

thresholds are directly comparable. On that scale 𝜖𝑑𝑡 = 0.05 is 5 percent of the envelope range. When the twin and the sensors agree closely yet the mass balance is violated, the sensor stream has been manipulated in a way the twin has absorbed. A second rule covers the complementary case: a divergence ‖𝑆𝑠𝑒𝑛𝑠𝑜𝑟 − 𝑆̂𝐿𝑆𝑇 𝑀 ‖∞ > 𝜖𝑑𝑡 while the mass balance closes, 𝑟𝑖 < 𝛿𝑝ℎ𝑦 , indicates that the twin rather than the plant is wrong. That signature is shared with ordinary model staleness, so the second rule fires only on an abrupt onset, defined as the divergence crossing 𝜖𝑑𝑡 within one hour of operation. Equipment degradation opens the same gap over weeks and is handled as a maintenance condition, not as an attack. The two rules together, not the first alone, are what Table 2 reports. Scope of protection. The mechanism covers naive sensor spoofing, where random values are injected, and tampering with LSTM weights, which TPM attestation catches at boot. It does not cover a physics-aware coordinated attack in which an adversary who knows Eq. (2) manipulates sensor readings and command logs together so that mass balance still closes. Such an attack requires white-box access to both the historian and the control logic, which places it outside the network-based threat model adopted here. Two extensions are natural: temporal consistency checks of the form |𝑑 2 𝑉 ∕𝑑𝑡2 | < 𝜅𝑚𝑎𝑥 , and multi-stage redundancy that compares LIT101 against a level estimate derived from flow integration.

3.4.3. Controller denial of service A flood of packet-in messages at more than 104 packets per second saturates the controller CPU and prevents mutation decisions from being issued on time. Defense. Per-source rate limiting at 1000 messages per second, combined with temporary blacklisting of persistent violators.

3.5. Reconnaissance Throttling The three scenarios above describe attacks on the defense. This subsection states the complementary mechanism, by which the defense detects an attack on the plant. A probe to a virtual address not currently bound in 𝑀𝑡 cannot originate from a legitimate Modbus endpoint, since endpoints address slaves by their real address and never see . The controller therefore counts flagged probes per source over a sliding 60 s window; a source accumulating more than O Mogollon-Gutierrez et al.: Preprint submitted to Elsevier

𝑛𝑓 𝑙𝑎𝑔 = 5 flags is rate-limited to one packet per second, and one exceeding 2𝑛𝑓 𝑙𝑎𝑔 is blacklisted for 300 s. A low-andslow adversary can evade permanent exclusion by rotating its source address after each blacklisting, which is what makes topology discovery slow rather than impossible.

3.6. The MTD Dilemma in ICS MTD introduces dynamism by shifting the configuration 𝐶 within a pool ℂ at intervals Δ𝑡, with the aim of maximising the entropy 𝐻(𝐶) seen by the attacker. Unlike enterprise networks, an ICS imposes a hard timing requirement on delivery. Writing 𝜏(𝑝𝑖,𝑗 ) for the end-to-end latency of a control packet from node 𝑖 to node 𝑗, stability of the loop requires 𝜏(𝑝𝑖,𝑗 ) ≤ 𝜏𝑐𝑡𝑟𝑙 ,

∀𝑝𝑖,𝑗 ∈ 𝑐𝑜𝑛𝑡𝑟𝑜𝑙 ,

(4)

where 𝜏𝑐𝑡𝑟𝑙 follows from the process dynamics. A control packet that arrives after the scan in which it was due is read in the next one, so the loop tolerates delay up to one scan cycle and 𝜏𝑐𝑡𝑟𝑙 = 𝑇𝑠𝑐𝑎𝑛 = 500 ms on SWaT. We apply a ten percent engineering margin and enforce 𝜏𝑐𝑡𝑟𝑙 = 50 ms on control traffic. A second and distinct bound governs the defense rather than the traffic: 𝜏𝑖𝑛𝑠𝑡 is the time the shield allows for a reconfiguration to be decided and installed, which we set by the same ten percent rule to 50 ms. The two coincide numerically on this testbed and are not interchangeable in meaning, since one bounds the delivery of a control packet and the other the installation of a flow rule; it is 𝜏𝑖𝑛𝑠𝑡 that the safety shield tests against. Blind shuffling changes 𝐶𝑡 → 𝐶𝑡+1 without regard to that requirement and opens a transient window of jitter and loss. The damage depends on when that window falls, not on its size alone: a transient during a steady-state hold is absorbed by the loop, whereas the same transient during an actuator transition leaves the valve in the wrong position for a full scan cycle. We therefore write the reconfiguration cost as a quantity to be minimised subject to timing, not as a predictor of physical error on its own, ) ( 𝐽𝑄𝑜𝑆 (𝐶𝑡 , 𝐶𝑡+1 ) = 𝛼 Loss(𝐶𝑡 , 𝐶𝑡+1 )+𝛽 max 0, 𝜏𝑎𝑐𝑡𝑢𝑎𝑙 − 𝜏𝑐𝑡𝑟𝑙 . (5) Once 𝐽𝑄𝑜𝑆 passes a critical threshold the defense becomes indistinguishable from an attack, since the PLCs either fall back to a safe state or miss commands outright.

3.7. Objective Existing work concentrates on reducing the attacker’s success probability 𝑃𝑟𝑒𝑐 without modelling the cyber-physical coupling, so process-aware mechanisms that can anticipate the physical effect of a reconfiguration remain scarce. We therefore seek a Digital Twin-guided policy that solves max 𝜋

𝑇 ( ∑

) 𝜆1 SecurityGain(𝐶𝑡 ) − 𝜆2 𝐽𝑄𝑜𝑆 (𝐶𝑡 , 𝐶𝑡+1 ) (6)

𝑡=0

subject to

( ) 𝑆̂𝑝ℎ𝑦 (𝑡 + 1) = 𝑓𝐷𝑇 𝑆̂𝑝ℎ𝑦 (𝑡), 𝑢(𝑡), 𝐶𝑡+1 ∈ Ω𝑠𝑎𝑓 𝑒 , (7) Page 5 of 23

Security entropy (bits)

5

160

log2 || = 5 bits

Random-MTD 4.2 bits, 18 violations

140

estimable ceiling 4.8

Ballast 3.5 bits, 0 violations

4

120 alarm limit

3

100 80

RL-MTD 3.9 bits, 5 violations

2

shield threshold 72%

60 40

1

20

0

0

Mutation aggressiveness (increasing) Entropy H(Mt )

Predicted excursion

Shield threshold

Ωsafe , shield admits

Predicted excursion (% of envelope)

Physics-Aware Moving Target Defense

masked by the shield

Figure 1: Ballast optimisation framework, drawn schematically. Security entropy maximisation is balanced against the physical excursion the twin forecasts, and an explicit shield cuts the feasible region at the point where the forecast would leave Ω𝑠𝑎𝑓 𝑒 . The horizontal axis orders schemes by how aggressively they mutate and carries no units, because the entropy gap between Ballast and Random-MTD comes from the shuffling strategy rather than from the mutation rate: the two schedule at almost the same rate, 22.5 and 21.8 mutations per hour. The shield clears an action only below 72 percent of the envelope half-width, which is the alarm limit less the guard band and the 99th percentile forecast error of the twin. The entropy and violation figures on the three marked points are the measured values of the baseline comparison.

where 𝜋 is the reconfiguration policy and 𝑓𝐷𝑇 is the twin trained on SWaT dynamics. The difficulty lies in aligning the shuffling schedule with the live physical state so that reconfiguration does not disturb the loop (Figure 1).

4. Methodology: The Ballast Framework Ballast joins a Digital Twin to an SDN-based MTD mechanism so that mutation proceeds only when the predicted physical trajectory stays inside Ω𝑠𝑎𝑓 𝑒 . Figure 2 shows the architecture, which comprises the Virtual Network Orchestrator (VNO), the Digital Twin Prognostics Module (DTPM) and the Adaptive Decision Engine (ADE).

4.1. Virtual Network Orchestrator To reproduce the network conditions of the SWaT testbed we use a containerised Mininet environment driven by a controller application written against the Ryu API. 1. Topology reconstruction. The six SWaT stages are mapped to distinct subnets. Each PLC from 𝑃1 to 𝑃6 , together with the HMI, is instantiated as a virtual host attached to Open vSwitch nodes. 2. Trace-driven background traffic and live control loops. The SWaT PCAP captures are replayed with tcpreplay at the virtual hosts to reproduce the volume and timing of the plant’s background Modbus/TCP exchanges. This replayed stream is open-loop and does not react to the physical state. Superimposed on it, the regulatory loops of the three stages carrying envelope variables, Stages 1, 2 and 3, run live: the controller reads the simulated sensors, computes an actuation, and writes it back through O Mogollon-Gutierrez et al.: Preprint submitted to Elsevier

the emulated network, so network transients reach the physics. Every physical metric we report is measured on those live loops; the replayed trace contributes load and realistic flow counts only. 3. OpenFlow-based IP mutation. The VNO implements Random Host Mutation. The controller intercepts ARP traffic and installs rules that translate real addresses 𝐼𝑃𝑟𝑒𝑎𝑙 into ephemeral virtual addresses 𝐼𝑃𝑣𝑖𝑟𝑡 . The mapping 𝑀𝑡 ∶ 𝐼𝑃𝑟𝑒𝑎𝑙 → 𝐼𝑃𝑣𝑖𝑟𝑡 is refreshed every Δ𝑡 over a pool of || = 32 virtual addresses, a ∕27 block carved from the ∕24 assigned to each stage. The remainder of the ∕24 is left unallocated so that the pool can be widened without renumbering; enlarging it raises the entropy ceiling at no cost to the shield, since the twin’s input does not depend on the address space. A pool of this size does not by itself delay an attacker: with seven live hosts, an unthrottled sweep covers every address in 16 s at 2 probes per second. Delay comes from pairing mutation with the reconnaissance throttling of Section 3.5, which rate-limits and then blacklists a source once its probes to unbound addresses accumulate, forcing the adversary to rotate source addresses and restart. The topology discovery time an adversary achieves is therefore a property of that pair, not of the address space alone.

4.2. Digital Twin Prognostics Module The DTPM is the safety oracle. It runs alongside the VNO and continuously forecasts the physical state from the control commands observed on the wire. We use a physics-informed LSTM trained on SWaT historian data. For a given stage, the state 𝑥𝑡 , for instance Page 6 of 23

Physics-Aware Moving Target Defense Defense plane

Adaptive Decision Engine PPO agent, picks a target mutation interval between 120 and 600 s candidate action

reject and penalise

Safety Shield Is the forecast inside the envelope, reachable, and within the install budget?

Digital Twin Prognostics Physics informed LSTM plus an independent mass balance monitor

observed commands

predicted state

accepted action Cyber plane, software defined network

Adversary Scanning, data injection, twin poisoning, controller flooding

Network Orchestrator Ryu controller, address mutation, make before break handover

probes

flow rules

OpenFlow data plane Open vSwitch over six subnets, header rewriting on the wire

control traffic

historian stream

Physical plane, SWaT testbed

Actuators and PLCs Inlet valve and raw water pump, scan cycle of 500 milliseconds

Sensors Tank level, acidity and flow, alarm limits set the envelope

actuation

Treatment process Six stages, from raw water through to reverse osmosis measured state

Figure 2: Architecture of the Ballast framework. The decision path runs left to right across the defense plane: the Adaptive Decision Engine proposes a mutation, the Digital Twin Prognostics Module forecasts its physical consequence, and the safety shield either accepts the action or masks it and penalises the agent. Only an accepted action descends into the cyber plane, so no flow rule reaches the switches until the predicted trajectory has been cleared. Two dotted paths close the loop upwards: the control commands recovered from Modbus traffic, which tell the twin what the controller is about to do, and the historian stream from the sensors, which keeps the twin aligned with the plant. The adversary enters at the data plane, and the twin poisoning it attempts reaches the historian rather than the switches.

a tank level, evolves as 𝑥̂ 𝑡+𝑘 = 𝑓𝐿𝑆𝑇 𝑀 (𝑥𝑡−𝑤 , … , 𝑥𝑡 , 𝑢𝑡 ),

(8)

where 𝑢𝑡 collects the control actions recovered from the Modbus payloads by the controller. Before a candidate configuration 𝐶𝑛𝑒𝑤 is committed, the DTPM estimates the induced latency 𝛿(𝐶𝑛𝑒𝑤 ), propagates it through the loop, and marks the configuration unsafe if the forecast leaves Ω𝑠𝑎𝑓 𝑒 once widened by the empirical error margin 𝑒99 , the 99th percentile of the twin’s forecast error on held-out data. In practice the shield also applies a guard band of 𝜖𝑠𝑎𝑓 𝑒 = 20 percent of each variable’s own envelope half-width, measured inwards from the alarm limit, which gives ±30 mm on LIT101, ±20 mm on LIT301 and ±0.05 on AIT202, or 0.100 on the common normalised scale. A forecast must further lie inside the physically reachable set 𝑘 (𝑥𝑡 ) implied by the tank’s maximum fill and drain rates over the horizon; one that does not is the signature of a poisoned or badly extrapolating model. Section A states the complete shield condition O Mogollon-Gutierrez et al.: Preprint submitted to Elsevier

formally. Defining the band relative to the envelope rather than to the setpoint keeps it conservative for every variable; a fixed percentage of setpoint would not, since 5 percent of pH 7 is ±0.35 and therefore wider than the ±0.25 alarm band on AIT202, and a percentage of a pH reading is in any case dimensionally meaningless on a logarithmic scale. The DTPM also hosts the physics-based residual monitor of Eq. (2), which validates the twin itself independently of any candidate action. The module exposes one scalar to the policy, the physical stability index. Writing 𝑐𝑖 for the centre of variable 𝑖’s interval in Definition 1 and ℎ𝑖 for its half-width, the index is the worst normalised distance from the centre over the forecast horizon of 𝐻 steps and over the three variables that carry the envelope, ) ( (𝑖) |𝑥̂ 𝑡+𝑘 − 𝑐𝑖 | , 1 . (9) 𝜙𝑝ℎ𝑦 (𝑡) = 1 − max max min 𝑖 1≤𝑘≤𝐻 ℎ𝑖 It takes the value 1 when every forecast variable sits exactly at the centre of its interval and 0 when one of them is predicted to touch or cross an alarm limit, so it falls as the plant approaches the boundary and tells the policy how much room a mutation has before the shield would mask it. Clipping the inner ratio at 1 keeps the index on [0, 1] when a forecast leaves the envelope outright, a case the shield rejects in any event, so that a deep excursion does not dominate the state representation. The index is advisory: it enters 𝑠𝑡 as a feature, whereas the gate that actually enforces safety is the shield, which tests the forecast against Ω𝑠𝑎𝑓 𝑒 directly rather than through 𝜙𝑝ℎ𝑦 .

4.3. Adaptive Decision Engine The ADE follows a Safe Reinforcement Learning design. A strict Constrained Markov Decision Process enforces its constraint only in expectation, which is unsatisfactory when a single excursion can damage equipment, so we instead combine Proximal Policy Optimization with an explicit safety shield that masks actions using the twin’s predictions. • State space. 𝑠𝑡 = {𝐻(𝑀𝑡 ), 𝐿𝑛𝑒𝑡 , 𝜙𝑝ℎ𝑦 }, where 𝐻(𝑀𝑡 ) is the entropy of the current mapping, 𝐿𝑛𝑒𝑡 is link utilisation and 𝜙𝑝ℎ𝑦 is the physical stability index reported by the twin. • Action space. The agent chooses a target mutation in̄ ∈ [𝑇𝑚𝑖𝑛 , 𝑇𝑚𝑎𝑥 ] = [120, 600] s and a shuffling terval Δ𝑡 strategy, either fully random or subnet preserving. The ̄ jittered by the cryptographic interval actually used is Δ𝑡 draw of Section 3 and clipped back to [𝑇𝑚𝑖𝑛 , 𝑇𝑚𝑎𝑥 ], so the policy sets the rate and the generator supplies the unpredictability. • Reward. { 𝑅𝑡 =

−𝜆𝑚𝑎𝑠𝑘

if the shield rejects 𝑎𝑡

𝐻(𝑀𝑡 ) − 𝜆 𝕀(PacketLoss > 0)

otherwise, Page 7 of 23

Physics-Aware Moving Target Defense

(10) with 𝜆 = 5, and 𝜆𝑚𝑎𝑠𝑘 = 10 for an envelope breach and 5 for a latency breach, that is, an estimated installation time above 𝜏𝑖𝑛𝑠𝑡 = 50 ms. Equation (5) and the objective built on it state the idealised trade-off with weights 𝛼 = 𝛽 = 𝜆1 = 1 and 𝜆2 = 5; Eq. (10) is the surrogate actually optimised, in which the continuous QoS cost is replaced by a loss indicator because per-step loss is the only component observable within one decision interval. ∑ The security term 𝐻(𝑀𝑡 ) = − 𝑣∈ 𝑝(𝑣) log2 𝑝(𝑣) is the Shannon entropy in bits of the empirical distribution over  formed by pooling the virtual addresses assigned to all seven hosts across a sliding window of ten mutation epochs, giving up to 𝑁𝑜𝑏𝑠 = 70 observations over 𝐾 = 32 bins. We report the uncorrected plug-in estimate, because the reward loop needs a value at every epoch and a bias-corrected one would have to be recomputed against the occupancy of each window. The plug-in estimator is biased downwards by approximately the Miller-Madow term (𝐾 − 1)∕2𝑁𝑜𝑏𝑠 = 0.221 nat, which is 0.32 bits at this sample size, so under a uniform mapping it returns about 4.68 bits rather than the 5-bit ceiling of a uniform distribution over || = 32. Every entropy figure in this paper should be read against 4.68 and not against 5. The learned policy settles at a mean target interval of 160 s, which is the smallest target at which the ±25 percent jitter does not truncate: 160 × 0.75 = 120 s meets 𝑇𝑚𝑖𝑛 exactly, and since 𝑢 is drawn from a continuous distribution the clip is active with probability zero. A smaller target would cut the lower tail of the realised interval and so leak a lower bound on the schedule to an adaptive adversary. At 160 s a 30-minute run contains 11 epochs, so the tenepoch window is contained within a single run. Pooling across hosts is what allows the estimate to approach that ceiling; a per-host window of ten epochs would cap it at log2 10 = 3.32 bits. This is a marginal quantity and therefore an upper bound on what the attacker actually faces, which is the conditional uncertainty 𝐻(𝐴 ∣ host) about where one specific PLC now sits. The two coincide only if each host’s assignment is independently uniform. Estimating the conditional entropy at the resolution the reward loop requires is not possible within a ten-epoch window, and we report the marginal estimate throughout on that understanding.

4.4. Make-Before-Break Handover Endpoints are never reconfigured: the master keeps the slave’s real address hard-coded, as Modbus deployments require, and the controller rewrites headers symmetrically in the data plane, so 𝐼𝑃𝑣𝑖𝑟𝑡 is visible only on the wire. The cost of a naive rule swap is therefore not a broken endpoint configuration but a gap in which in-flight packets match neither the old rules nor the new ones, which destroys the request-response pairing of any Modbus transaction crossing the boundary. We close that gap by draining rather than cutting. Moving from 𝑀𝑡 to 𝑀𝑡+1 proceeds in three steps. O Mogollon-Gutierrez et al.: Preprint submitted to Elsevier

1. The controller installs the rules for 𝑀𝑡+1 at high priority, matching SYN packets only, so that new connections take the new mapping. 2. The rules for 𝑀𝑡 remain active at lower priority, which lets any transaction already in flight complete its requestresponse pair. Here RTT𝑚𝑎𝑥 is the 99th percentile hostto-host round trip of a Modbus request-response pair, measured on the emulated data plane at 8 ms, which is the quantity a stranded transaction actually waits on. The resulting guard time of 2 × RTT𝑚𝑎𝑥 ≈ 16 ms gives a transaction one full round trip plus the same again as margin. It is sized for a transaction and not for the lifetime of a TCP session, which in SWaT stays open for hours. Because the rewrite is symmetric and transparent, a longlived session is not torn down at the swap: it continues under the new mapping, and only packets already in flight at the instant of the swap are at risk, which is exactly what the guard time covers. 3. Once the new paths are verified, 𝑀𝑡 is flushed after the guard time 𝜏𝑔𝑢𝑎𝑟𝑑 = 2 × RTT𝑚𝑎𝑥 . Because the rewrite is transparent to the endpoints, flushing withdraws only the stale translation; no session is torn down and no endpoint is reconfigured. Figure 3 shows the complete cycle, including the path taken when the shield masks an action. This preserves protocol state across the transition, which is the property that distinguishes it from the abrupt swap used by most baselines.

4.5. Algorithm Algorithm 1 states the control loop. A standard PPO agent learns by trial and error, which is unacceptable in a plant, so every sampled action passes through the shield before it can reach the data plane. A rejected action is replaced by the fallback 𝑎𝑑𝑒𝑓 𝑎𝑢𝑙𝑡 , which holds the mapping 𝑀𝑡 unchanged for one more interval; the configuration is never left in an intermediate state, and the cost of a rejection is a lost opportunity to mutate rather than a disturbance. The buffer is flushed and the policy updated every 𝑁𝑏𝑎𝑡𝑐ℎ = 2048 stored transitions, which equals the PPO rollout length. The shielding block implements that gate, which is the shield node of Figure 3. It opens with an action-independent sanity check on the twin itself, applying both cross-validation rules of Section 3: the mass balance residual of Eq. (2) fires when the twin and the sensors agree while the physics does not, and the complementary rule fires on an abrupt divergence while the mass balance still closes. Neither filters actions; both detect poisoning. The two branches that follow apply the actual mask, rejecting an action when the forecast, widened by the guard band 𝜖𝑠𝑎𝑓 𝑒 and the margin 𝑒99 , leaves Ω𝑠𝑎𝑓 𝑒 or leaves the reachable set 𝑘 (𝑥𝑡 ), and rejecting it when the estimated installation latency exceeds 𝜏𝑖𝑛𝑠𝑡 . One detail matters for learning, and it follows from how the shield is placed. From the agent’s perspective the shield is part of the environment: the agent emits 𝑎𝑡 , and the shielded process returns the fallback transition together with Page 8 of 23

Physics-Aware Moving Target Defense

Agent samples a mutation at

Twin forecasts the trajectory

Measure the reward and observe st+1

Make-Before-Break handover all checks pass

Install the new mapping, SYN only, high priority

Keep the old mapping at low priority next cycle

Safety shield 1 mass-balance residual 2 envelope and reachability 3 install latency ≤ τinst

Wait the guard time τguard = 2 × RTTmax

Store the transition in the rollout buffer Remove the old mapping

residual fails

Twin suspect hold the static mapping, alert the operator, store nothing

envelope or latency fails

Masked hold the static mapping, apply the penalty, keep the sampled at with its log-probability

Update the policy once the buffer fills skips the buffer

Figure 3: One mutation cycle. The shield decides before anything is installed, so a masked action never reaches the data plane. An envelope or latency breach stores the transition with the action the policy sampled and its penalty, which is what lets the agent learn the shape of the mask rather than merely being prevented from acting. A failed residual check is different: it does not depend on the sampled action, so it raises an operator alert and skips the buffer entirely rather than contributing a gradient. An accepted action is applied by draining rather than by cutting: the new mapping takes new connections while the old one stays available at low priority until the guard time expires, and that is what keeps atomic Modbus transactions intact.

5. Implementation Details

Episode reward

500 400 300

plateau ≈ 420 at ≈ 300k steps (mask rate ≈ 10% under Eq. 9)

200 100 0

Ballast (shielded PPO)

−100

Violations per episode

the mask penalty. The transition is therefore on-policy, and storing the action the policy actually sampled, with its logprobability, keeps the importance ratio PPO requires well defined while teaching the agent the shape of the mask. Storing the fallback action instead, which is the natural but incorrect implementation, teaches the agent that the safe default is bad. The residual check is excluded from this scheme because it does not depend on 𝑎𝑡 ; attaching a penalty to it would inject action-independent noise into the policy gradient. Figure 4 shows the training dynamics. Two properties stand out. The episode reward rises steadily and settles near 420 after roughly 300k timesteps, which indicates that the policy converges. That plateau also tells us how often the shield intervenes: against the 700 that Eq. (10) would return if no action were ever masked, 420 corresponds to a mask rate of about 10 percent once the policy has settled. More importantly, the violation count stays at zero for the whole run, including early exploration. An unshielded PPO agent trained under identical settings behaves very differently, with up to 12 violations per episode at the start and two or three per episode later on. The shielding block is therefore doing the work we designed it to do.

PPO without safety shield Ballast (shielded)

10

zero violations throughout, including early exploration

5 0 0

250k

500k

750k

1M

Training timesteps

Figure 4: PPO training convergence. Episode reward and safety violations over 106 timesteps. The shield keeps violations at zero throughout, including the early exploration phase, whereas an unshielded agent trained under identical settings starts near twelve per episode. The plateau is annotated with the mask rate it implies: at 𝑇 = 200 steps, a reward of 420 is 2.10 per step against a ceiling of 3.5, which under Eq. (10) fixes the converged rejection rate at about 10 percent.

5.1. Hardware and Software We separate training from inference because the two have different cost profiles and, in any real deployment, would run on different machines. We also keep the twin and the environment independent: the twin is a learned LSTM fitted to historian records, while the environment is a first-principles hydraulic and chemical simulator built O Mogollon-Gutierrez et al.: Preprint submitted to Elsevier

from the plant’s documented equipment curves, with no shared parameters. On the held-out split the twin’s one-step RMSE against the simulator is 0.012, with a 99th percentile error 𝑒99 = 0.038, both on the common normalisation of Page 9 of 23

Physics-Aware Moving Target Defense

Algorithm 1 Ballast: physics-aware MTD with an explicit safety shield Require: Digital Twin 𝐷𝑇 ; safety bounds Ω𝑠𝑎𝑓 𝑒 ; guard band 𝜖𝑠𝑎𝑓 𝑒 and forecast margin 𝑒99 ; residual threshold 𝛿𝑝ℎ𝑦 and divergence threshold 𝜖𝑑𝑡 ; installation bound 𝜏𝑖𝑛𝑠𝑡 = 50 ms; fallback 𝑎𝑑𝑒𝑓 𝑎𝑢𝑙𝑡 , which holds the current mapping; batch size 𝑁𝑏𝑎𝑡𝑐ℎ = 2048; episodes 𝐸 = 5000, episode length 𝑇 = 200 (so 106 timesteps) Ensure: Safe policy 𝜋 ∗ 1: Initialise PPO policy 𝜋𝜃 and value function 𝑉𝜙 2: Initialise on-policy rollout buffer  3: for episode 𝑒 = 1 to 𝐸 do 4: Observe 𝑠0 ← {𝐻(𝑀0 ), 𝐿𝑛𝑒𝑡 , 𝜙𝑝ℎ𝑦 } 5: for step 𝑡 = 0 to 𝑇 do 6: Sample 𝑎𝑡 ∼ 𝜋𝜃 (⋅ ∣ 𝑠𝑡 ) ⊳ candidate MTD action Dual validation and shielding ̂ 7: 𝑆𝑝ℎ𝑦 ← 𝐷𝑇 .PREDICT(𝑠𝑡 , 𝑎𝑡 ) 8: 𝑟𝑝ℎ𝑦𝑠 ← R ESIDUAL(SENSORDATA, 𝑢𝑡 ) ⊳ Eq. (2); does not consult the twin 9: 𝑑𝑡 ← ‖𝑆𝑠𝑒𝑛𝑠𝑜𝑟 − 𝑆̂𝐿𝑆𝑇 𝑀 ‖∞ ⊳ twin-sensor divergence 10: 𝛿𝑒𝑠𝑡 ← E STIMATEL ATENCY(𝑎𝑡 ) ) ( 11: ok 𝑒𝑛𝑣 ← ∀𝑖 ∶ 𝑆̂𝑝ℎ𝑦 [𝑖]±(𝑒99 +𝜖𝑠𝑎𝑓 𝑒 [𝑖]) ⊂ Ω𝑠𝑎𝑓 𝑒 [𝑖] ∧ 𝑆̂𝑝ℎ𝑦 [𝑖] ∈ 𝑘 (𝑥𝑡 )[𝑖] ( ) ( ) 12: if 𝑑𝑡 < 𝜖𝑑𝑡 ∧ 𝑟𝑝ℎ𝑦𝑠 > 𝛿𝑝ℎ𝑦 ∨ 𝑑𝑡 > 𝜖𝑑𝑡 ∧ 𝑟𝑝ℎ𝑦𝑠 < 𝛿𝑝ℎ𝑦 ∧ A BRUPT(𝑑𝑡 ) then 13: A PPLY(𝑎𝑑𝑒𝑓 𝑎𝑢𝑙𝑡 ); raise operator alert ⊳ PoisoningFlag, both cross-validation rules 14: Observe 𝑠𝑡+1 ; store no transition ⊳ test is action independent 15: goto BATCHC HECK 16: else if ¬ ok 𝑒𝑛𝑣 then 17: 𝑅𝑡 ← −10 ⊳ envelope, margin or reachability breach 18: A PPLY(𝑎𝑑𝑒𝑓 𝑎𝑢𝑙𝑡 ); observe 𝑠𝑡+1 19: Store (𝑠𝑡 , 𝑎𝑡 , 𝑅𝑡 , 𝑠𝑡+1 ) in  ⊳ the sampled 𝑎𝑡 , with its log-prob 20: else if 𝛿𝑒𝑠𝑡 > 𝜏𝑖𝑛𝑠𝑡 then 21: 𝑅𝑡 ← −5 ⊳ latency breach 22: A PPLY(𝑎𝑑𝑒𝑓 𝑎𝑢𝑙𝑡 ); observe 𝑠𝑡+1 23: Store (𝑠𝑡 , 𝑎𝑡 , 𝑅𝑡 , 𝑠𝑡+1 ) in  ⊳ the sampled 𝑎𝑡 , with its log-prob 24: else Make-Before-Break execution 25: INSTALLFLOW RULES(𝑎𝑡 , match SYN, priority high) 26: K EEPO LDRULES(𝑎𝑝𝑟𝑒𝑣 , priority low) 27: WAIT(𝜏𝑔𝑢𝑎𝑟𝑑 = 2 × RTT𝑚𝑎𝑥 ) 28: R EMOVEO LDRULES(𝑎𝑝𝑟𝑒𝑣 ) 29: Measure 𝑅𝑡 and observe 𝑠𝑡+1 30: Store (𝑠𝑡 , 𝑎𝑡 , 𝑅𝑡 , 𝑠𝑡+1 ) in  31: end if BATCHC HECK: 32: if || ≥ 𝑁𝑏𝑎𝑡𝑐ℎ then 33: Update 𝜃, 𝜙 with the PPO objective; clear  34: end if 35: end for 36: end for

Section 3, so the oracle is not a copy of the process it certifies. On that same scale both lie below the divergence threshold 𝜖𝑑𝑡 = 0.05, so ordinary forecast error does not trip the second cross-validation rule, and both lie below the 0.100 guard band 𝜖𝑠𝑎𝑓 𝑒 , so the band is wider than the error it is there to absorb. That ordering is what keeps the shield’s margin meaningful rather than vacuous. Training. PPO and the physics-informed LSTM are trained on a workstation with an Intel Core i9-14900KF (24 cores, 32 threads), 64 GB of DDR5-5600 memory and an NVIDIA RTX 4070 with 12 GB, under Ubuntu 24.04 LTS. Inference. The decision latency of the shield is what determines whether the framework is deployable, so we measure it on three platforms spanning the range a water utility might plausibly field: the training workstation, an NVIDIA Jetson Orin Nano 8 GB Developer Kit as an edge node with an accelerator, and a Raspberry Pi 5 Model B with 8 GB as a constrained gateway with none. Table 3 lists them. On every platform the twin runs with one intraop and one inter-op thread and is pinned to a single core, O Mogollon-Gutierrez et al.: Preprint submitted to Elsevier

a performance core on the hybrid workstation, so that the reported figure reflects the budget an industrial controller imposes rather than the parallelism a desktop happens to offer. On the workstation the twin is pinned to CPU 2, a performance core that is not one of the favoured cores granted the highest turbo frequencies, and that core’s second hardware thread is taken offline during measurement; every core runs the performance governor with turbo enabled, the graphical session is stopped, and the pinned core sustained 5.70 GHz. Its thermal-throttle counters did not change during measurement. The Jetson runs JetPack 7.2.1 (L4T R39.2.1) in the 15 W power mode of its Super configuration (nvpmodel ID 0), which caps the CPU at 1.50 GHz and the GPU at 612 MHz. Clocks are locked at those caps with jetson_clocks, the fan runs at full speed, and the graphical session is stopped for the duration of the measurement. On the GPU the twin computes in IEEE FP32 rather than in the TF32 mode that PyTorch enables for cuDNN by default, so that the CPU and GPU paths evaluate the same function; their outputs agree to within 5×10−7 . The reported GPU latency includes the host-to-device and device-to-host copies, because the shield receives its input window on the host and needs the forecast back there. Since the latency of a dense FP32 LSTM does not depend on the values of its weights, the benchmark uses randomly initialised weights of the deployed architecture. The Raspberry Pi runs Raspberry Pi OS (Debian 13, kernel 6.18 with 16 KiB pages) headless, with the performance governor on every core, which holds its Cortex-A76 cores at 2.4 GHz. The Raspberry Pi was verified not to throttle, thermally or through under-voltage, during measurement. Software. On the workstation, Python 3.12, PyTorch 2.14.0 with the CUDA 13.0 build and NVIDIA driver 580.178.04. Training and network emulation use StableBaselines3 for PPO, Gymnasium for the environment interface, and Mininet with Open vSwitch. The controller application targets the Ryu API but runs on os-ken, the maintained fork of that framework, because upstream Ryu does not support Python 3.12; the application code is unchanged between the two. The Jetson runs the same PyTorch release, 2.14.0, built for CUDA 13.2, under Python 3.12.3 with cuDNN 9.24.0 from JetPack 7.2.1. The Raspberry Pi runs the same release as a CPU-only build under Python 3.13.5, the version Raspberry Pi OS ships; both ARM builds come from the same PyTorch commit and bundle the same oneDNN release, 3.12. Exact pinned versions for every platform, and for the training and emulation stack, are in the replication repository.

5.2. Digital Twin Configuration The LSTM has 3 layers with 𝑑ℎ = 128 hidden units each and dropout 0.2. Each stage twin takes as input the sensor and actuator channels of its own stage, which number between 4 and 13 in SWaT; latency is measured for the widest stage, P5 with 13 channels, so that it bounds every other stage. Training uses a look-back window 𝑤 = 50 steps, a prediction horizon 𝐻 = 10 steps, batch size 32 and Page 10 of 23

Physics-Aware Moving Target Defense Table 4 Simulation parameters and hyperparameters

Table 3 Inference platforms Role

Platform

Compute

Memory

Workstation

Core i9-14900KF

64 GB

Edge, accelerated

Jetson Orin Nano 8 GB (15 W) Raspberry Pi 5

24 cores, 32 threads 6×Cortex-A78AE + Ampere GPU 4×Cortex-A76

Edge, constrained

Component

Parameter

Testbed

Duration per run Monte Carlo runs Bandwidth cap

Digital Twin

Look-back window 𝑤 Prediction horizon 𝐻 Shield guard band 𝜖𝑠𝑎𝑓 𝑒

RL agent (PPO)

Learning rate 𝜂𝑙𝑟 Discount 𝛾 Clip parameter

8 GB 8 GB

Inference is single-threaded and pinned to one core on every platform. On the workstation that core is a performance core, which keeps the hybrid scheduler from moving the thread between core types. That core’s second hardware thread is taken offline for the measurement, and every core runs the performance governor. The Jetson’s 15 W mode caps its CPU at 1.50 GHz and its GPU at 612 MHz. The Raspberry Pi runs the performance governor, which holds its cores at 2.4 GHz.

Value 30 min 50 100 Mbps 50 steps 10 steps 20% of envelope half-width 3 × 10−4 0.99 0.2

engine through a Python middleware that keeps the two clocks aligned.

6.2. Scenario I: Physical Process Stability Adam with learning rate 3 × 10−4 , for 100 epochs with early stopping at patience 10. The loss adds a mass conservation term: 𝑁𝑡𝑎𝑛𝑘

𝑡𝑜𝑡𝑎𝑙 = 𝑀𝑆𝐸 (𝑦, 𝑦) ̂ + 𝜆𝑝ℎ𝑦

(𝑖) | ∑ | (𝑖) |𝑄 − 𝑄(𝑖) − Δ𝑉 | , | 𝑖𝑛 𝑜𝑢𝑡 𝑇𝑠 || 𝑖=1 | (11)

with 𝜆𝑝ℎ𝑦 = 0.5, where 𝑁𝑡𝑎𝑛𝑘 is the number of tanks in the stage and 𝑇𝑠 = 1 s is the historian sampling period.

5.3. RL Agent PPO with learning rate 3 × 10−4 , discount 𝛾 = 0.99, GAE 𝜆𝐺𝐴𝐸 = 0.95, clip range 0.2, 2048 steps per update, minibatch 64 and 10 epochs per update, for 106 timesteps in total.

5.4. Dataset We use SWaT A1/A2 (2015) and split it chronologically with no temporal overlap. The normal-operation record runs from the afternoon of 22 December to the start of the attack campaign on the morning of 28 December, about 4.95 × 105 samples at 1 Hz. Training takes the first five days of that record, 432,000 samples. Validation takes the remaining 18 hours immediately preceding the campaign, 64,800 samples, and supplies the empirical error margin 𝑒99 . Test covers the attack campaign from 28 December to 2 January and is used to calibrate the simulator’s attack scenarios and to verify that the twin’s forecast error on anomalous traces stays within that margin; the runtime evaluation is executed against the simulator, not replayed from this split. The twin sees only normal operation during training, so no attack trace enters the model. Each of the 50 Monte Carlo runs uses its own seed, from 42 to 91, applied to Python, NumPy and PyTorch; all other settings are held fixed.

6. Experimental Evaluation 6.1. Setup Table 4 lists the testbed and framework settings. The simulation couples the Mininet emulator to the SWaT physics O Mogollon-Gutierrez et al.: Preprint submitted to Elsevier

Table 5 measures the effect of reconfiguration on the chemical dosing loop of Stage 2, where pH is regulated through AIT202 and the dosing pump P203. We report the tracking error against the pH setpoint and the number of excursions outside the envelope of Definition 1. Blind-MTD here denotes a fixed 60 s shuffle with no feedback of any kind, which isolates the cost of mutation itself. We re-implemented the cost-aware RL-MTD of Javadpour et al. [39] on our testbed using the hyperparameters published by the authors, who originally reported 88 ms of defense latency in an edge IoT setting. Under an ICS workload the picture changes. The method averages 31.2 ms of jitter and 5.90 percent packet loss. What reaches the physical layer is not that loss as such but its timing: because RL-MTD mutates without consulting the process, a share of its transients coincides with actuator transitions, and each coincidence leaves an actuator held through a scan cycle. The resulting tracking error is 0.920. Ballast clears each mutation through the twin and drains connections rather than cutting them, which holds packet loss at 0.08 percent and keeps the tracking error at 0.048, close to the 0.042 of the static baseline that performs no defense at all. Figure 5 shows the same comparison as a time series. Ballast holds the level within 2 percent of the setpoint for the full 30 minutes, while RL-MTD produces deviation spikes of up to 15 percent that align with its reconfiguration instants. The spikes are the visible signature of the missing safety gate, since each one coincides with a mutation that the twin would have rejected.

6.3. Scenario II: Defense Effectiveness In this scenario the attacker runs a low-and-slow Nmap sweep at 2 probes per second for 30 minutes, issuing 𝑁𝑠𝑐𝑎𝑛 = 3600 probes in total. Each probe either reaches an address currently bound in 𝑀𝑡 , which counts towards the scan success rate, or targets a stale or never-allocated address, which is a candidate for detection under the throttling rule of Section 3.5. The two rates have different denominators: the scan success rate is the fraction of all 3600 probes that reach a bound address, while the detection rate is the fraction of the remaining probes, those aimed at unbound addresses, Page 11 of 23

Physics-Aware Moving Target Defense Table 5 Scenario I: control loop stability in Stage 2, the chemical dosing loop regulated through AIT202. A focused comparison against the primary RL baseline. Method Static baseline Blind-MTD (60 s, no feedback) RL-MTD [39] Ballast (ours)

Mean jitter (ms)

P99 jitter (ms)

Packet loss (%)

Physical MSE

pH violations

0.9 ± 0.2 45.3 ± 13.1 31.2 ± 9.1 4.5 ± 1.3

1.4 55.4 40.6 8.9

0.00 12.30 5.90 0.08

0.042 ± 0.001 1.920 ± 0.480 0.920 ± 0.220 0.048 ± 0.004

0 16 5 0

60

alarm limit 800 mm

800

700

600

500

alarm limit 500 mm

400

Blind-MTD RL-MTD

0

5

10

Static Ballast

15

Data-plane jitter (ms)

LIT101 water level (mm)

Jitter is measured on the data plane. The ± figure is the standard deviation of the per-run mean across 50 runs; the P99 column is a packet-level quantile pooled over all runs, so the two are not comparable as mean and spread of one distribution. Violations are totals over 50 runs, as defined in Definition 1, counting AIT202 excursions only; neither RL-MTD nor Ballast recorded a LIT101 or LIT301 excursion in any run.

50

20

20

Figure 5: Physical state evolution. Water level LIT101 under four strategies over one 30-minute run, sampled at 1 Hz. Ballast stays within 2 percent of the setpoint. RL-MTD shows deviation spikes of up to 15 percent at its reconfiguration instants, which reach 748 mm and so remain inside the 800 mm alarm limit, consistent with Table 5, where all five violations RL-MTD records are AIT202 excursions. Crosses mark where the Blind-MTD trace leaves the envelope. This is a single run rather than an average, so the breach count here is not the per-run mean.

that are flagged. Under uniform sampling of a static pool, seven live hosts in 32 addresses would yield a 21.9 percent hit rate, and that figure is the right reference only while the adversary is still searching. Against the static baseline the search ends: the mapping never changes, so after the 12.4 s in which its sequential sweep has located all seven hosts, short of the 16 s a full pass over the 32 addresses would take, the adversary directs every remaining probe at an address it already knows to be live. Of the 3600 probes, the 25 issued during enumeration contain 7 hits and the 3575 issued afterwards all hit, giving the 99.5 percent of Table 6. Mutation is what prevents that transition from search to exploitation, which is why every dynamic scheme sits far below 99.5 percent whatever its scheduling policy. Within that group the 21.9 percent uniform figure separates the schemes that flag from the one that does not. Throttling pushes the rate below 21.9 percent for the two schemes that pair mutation with flagging, since a source accumulating flags is rate-limited O Mogollon-Gutierrez et al.: Preprint submitted to Elsevier

31.2

30

0

30

P99 40.6

40

10

25

10% of Tscan 45.3

Ballast ±2% band

Time (min)

mean P99

P99 55.4

P99 8.9 4.5

P99 1.4 0.9

Static

Blind-MTD

RL-MTD

Ballast

Figure 6: Distribution of data plane jitter. The Make-BeforeBreak handover lowers the P99 from 55.4 ms under BlindMTD to 8.9 ms. Boxes and whiskers describe the per-packet distribution within a run; the P99 marker is that same quantity pooled over all 50 runs, and neither should be read against the ± figures of Table 5, which are the spread of the runlevel means. The dashed line is one tenth of the 500 ms PLC scan cycle, a bound on control traffic, and is distinct from the installation bound 𝜏𝑖𝑛𝑠𝑡 that the shield tests against.

and then blacklisted before it has swept the space and its suppressed probes count as unsuccessful. Blind-MTD sits above the uniform figure instead, at 35.2 percent, because Nmap sweeps sequentially and revisits addresses that have already answered; with a fixed 60 s period and no flagging, a responding address stays valid long enough to be probed several times within one epoch. The false positive rate is the fraction of the roughly 1.1 × 105 legitimate Modbus flows per run that are flagged in error. A legitimate endpoint never addresses an unbound virtual address of its own accord, so the only way one can be flagged is through the mapping change itself: a packet already in flight when the old rules are withdrawn arrives at an address that is no longer bound, and at the controller it is indistinguishable from a probe. The false positive rate is therefore not a property of the detector but a measure of how abruptly a scheme swaps its mapping. Table 6 reports the results. Observation. We state the trade-off plainly, because it is real. RL-MTD achieves marginally stronger raw deterrence, Page 12 of 23

Physics-Aware Moving Target Defense Table 6 Scenario II: security metrics against reconnaissance Method Static Blind-MTD RL-MTD [39] Ballast

Topology discovery time (s)

Scan success rate (%)

Detection rate (%)

False positive rate (%)

12.4 ± 0.5 145.2 ± 15.0 310.8 ± 42.1 295.5 ± 38.4

99.5 35.2 12.4 14.8

N/A 45.6 98.1 94.2

N/A 2.10 4.50 0.03

with a scan success rate of 12.4 percent against our 14.8 percent and a discovery time of 310.8 s against our 295.5 s. The reason is straightforward: the shield suppresses a fraction of mutations that the twin judges unsafe, and every suppressed mutation is one the attacker does not have to contend with. That concession of 2.4 percentage points buys a reduction in false positives by a factor of 150, from 4.50 percent to 0.03 percent, and the elimination of physical violations. The false positive gap follows directly from the handover, as the mechanism of the previous paragraph implies: RL-MTD withdraws the old mapping at the instant of the swap, so every packet in flight at that moment lands on an unbound address and is flagged, whereas Make-Before-Break keeps the old mapping available at low priority for the guard time and exposes only the packets still in flight at the final flush. The residual 0.03 percent is that remainder. In an OT context the exchange is not close. A false positive drops legitimate control traffic, and a violation risks equipment. Figure 6 shows the corresponding data plane behaviour, where the P99 jitter falls from 55.4 ms under Blind-MTD to 8.9 ms. This quantity is the packet-level jitter experienced by control traffic. What this scenario does and does not establish. The metrics above concern the reconnaissance phase, which is where an address-mutation defense acts by construction. Ballast interposes on the mapping, not on the payload, so it raises the cost of locating a target and does not inspect a Modbus write once a session is established: an adversary who already holds the real address of PLC1, whether through insider access or a compromised engineering workstation, can drive MV101 exactly as it could against a static network. That is the correct division of labour. Mutation is a reconnaissance-phase control and belongs beside command authentication and process-aware intrusion detection, not in place of them, and the twin that Ballast adds is available to those layers as well: the residual monitor of Eq. (2) is precisely the invariant check a command-level detector would use, and it runs continuously here whether or not a mutation is proposed. The contribution this paper claims is that the mutation layer can be added to such a stack without the physical cost it has carried in previous designs, which is the comparison Table 5 makes.

6.4. Scenario III: Overhead Table 7 reports the cost of running the twin next to the controller on the training workstation. Its last two rows need defining, since they measure the reconnaissance campaign of Scenario II rather than the overhead of the framework. Time to detect is the interval from the adversary’s first probe to the O Mogollon-Gutierrez et al.: Preprint submitted to Elsevier

moment the controller raises its first flag against that source, under the throttling rule of Section 3.5; it is the detector’s reaction time and is not the topology discovery time of Table 6, which measures the adversary’s progress rather than the defense’s. Time to respond is the interval from that first flag to the moment the countermeasure is in force in the data plane, meaning the source is rate-limited and, where the scheme reacts by mutating, the new mapping is installed. Both are means over the 50 runs and both are properties of the complete defense loop, so neither is comparable with the per-component latencies of Table 8. Ballast costs 16.7 percentage points more CPU than RLMTD and 39.8 points more than the undefended baseline. Only part of that is the forward pass itself; the remainder is the machinery around it, the residual monitor, the feature extraction from Modbus payloads and the entropy estimator, all of which run whether or not a mutation is proposed. In exchange it detects 14 percent faster and responds 34 percent faster than RL-MTD, and it uses 6.3 points less bandwidth because its mutation schedule is sparser and better timed. The summed per-stage P99 of 37.1 ms sits inside the 50 ms budget implied by SWaT’s 500 ms scan cycle. We report it as a reference value rather than as a measurement, because adding per-stage quantiles describes the comonotonic case, in which every stage reaches its own tail at the same instant, and so overstates the true end-to-end tail under any weaker dependence. The mean is exact by contrast, since the mean of a sum is the sum of means whatever the dependence between stages. This is a control-plane latency and is distinct from the packet-level jitter of Figure 6, which measures a different path. Mininet’s software switching is nonetheless optimistic relative to industrial ASICs.

6.5. Comprehensive Baseline Comparison To place Ballast against a wider field we implemented six further baselines beyond the RL-MTD used above, spanning classical and learning-based designs. The Blind-MTD of Tables 5 and 6 is subsumed by the time-based scheme below and is therefore not listed separately. Random-MTD [40] shuffles addresses at intervals drawn uniformly from 𝑈 (30, 300) s, with no state feedback of any kind. It represents unpredictability pursued for its own sake. Time-based MTD [41] reconfigures every 120 s, following practice common in SCADA deployments. The fixed period is predictable for operators while still limiting what an attacker can learn in a short window. Threshold-based MTD, which we implement ourselves as a representative of the common IDS-triggered pattern since no single reference defines it, triggers a shuffle when Page 13 of 23

Physics-Aware Moving Target Defense Table 7 Scenario III: system overhead measured on the training workstation Metric

Static baseline

RL-MTD

Ballast

Δ vs. RL-MTD

Computational resources CPU load, mean (% of one core) CPU load, peak (% of one core) RAM (MB)

12.3% 18.5% 180

35.4% 58.3% 450

52.1% 78.4% 610

+16.7 pp +20.1 pp +160

Network performance Controller processing time per mutation (ms) Peak achievable throughput (Mbps) Mean link occupancy during a run Packet loss

2.1 98.5 8.2% 0.00%

8.5 83.5 18.7% 5.90%

12.1 95.3 12.4% 0.08%

+3.6 +11.8 −6.3 pp −5.82 pp

N/A N/A

45.2 12.8

38.7 8.4

−6.5 (14% faster) −4.4 (34% faster)

Security response Time to detect (s) Time to respond (s)

All three methods run on the same machine under identical conditions; pp denotes percentage points. Time to detect and time to respond are defined in the text and measure the reconnaissance campaign of Scenario II, not the overhead of the framework; the static baseline never flags, hence N/A. Relative to the static baseline, Ballast adds 39.8 pp of mean CPU load. Controller processing time excludes the switch-side flow installation, which Table 8 breaks out. CPU load is the occupancy of the single core hosting the defense process, which runs the controller, the policy and the twin. Twin inference alone accounts for 5.2 pp of it, six stage twins each re-evaluating a 32-window batch at 1 Hz as the historian refreshes; the decision-triggered evaluation of three windows costs under 1 pp on top. The remainder is the residual monitor, flow-rule handling and packet-in processing.

Table 8 End-to-end defense latency in Mininet emulation Component

Mean (ms)

P95 (ms)

P99 (ms)

Std. dev.

Decision layer, workstation, single core LSTM inference 8.67 PPO policy selection 0.011

8.69 0.011

8.70 0.013

0.010 0.003

SDN control plane FlowMod generation Controller to switch RTT OVS flow table update ARP cache invalidation

1.2 3.5 6.4 2.1

2.1 5.8 9.2 3.5

2.8 8.2 12.5 4.9

0.5 1.4 2.1 0.8

Sum of per-stage means Sum of per-stage percentiles

21.9 —

— 29.3

— 37.1

— N/A

SWaT scan cycle 𝑇𝑠𝑐𝑎𝑛 Margin against the budget

500 ms, giving a 10% safety budget of 50 ms 28.1 ms in the mean; at least 12.9 ms at P99 under the summed bound

The mean of a sum is the sum of means exactly, so 21.9 ms holds whatever the dependence between stages; the summed percentiles are the comonotonic reference and bound the tail from above. PPO policy selection is timed as a forward pass through the actor network, the same way on every platform. The controller-to-switch RTT is a control-plane quantity and is not the RTT𝑚𝑎𝑥 that sizes the handover guard time 𝜏𝑔𝑢𝑎𝑟𝑑 , which is a host-to-host data-plane measurement. Software OVS is used here, not an industrial ASIC. The OVS row is the latency of a single installation measured in isolation, not pipelined throughput under a saturating batch.

an Isolation Forest anomaly score over network flow features exceeds 𝜃 = 0.7. Q-Learning MTD [42] is a tabular multi-agent formulation with a discretised state space of five bins per feature. We include it to isolate the benefit of function approximation over exact value tabulation. Deep-Shield [38] is the hierarchical deep RL state of the art. It uses deep networks over high-dimensional network state but remains physics-agnostic, optimising mitigation probability with no process constraint in the loop. Adaptive Path MTD [43] migrates forwarding paths reactively when anomalies appear on the current route, sitting between network-layer MTD and intelligent routing. Table 9 supports four observations. Entropy alone is not a security result. Random-MTD reaches the highest entropy in the table, 4.2 bits, purely by

O Mogollon-Gutierrez et al.: Preprint submitted to Elsevier

being random, and pays for it with 18 violations and a tracking error of 1.850. That tracking error is 44 times the 0.042 of the undefended static baseline, so on the physical metrics the defense is worse than performing none at all. This is the clearest evidence for the central claim of the paper, which is that unconstrained unpredictability and physical integrity are incompatible in an ICS. The entropy it buys is not even the maximum available: it falls short of the 4.68 ceiling of Section 4 despite shuffling uniformly, because at 15.30 percent packet loss and the shortest intervals its 𝑈 (30, 300) draw permits, a share of its scheduled mutations has not finished installing when the next epoch begins, so the previous mapping is carried over and the pooled window holds fewer distinct addresses than the schedule nominally provides. A scheme aggressive enough to damage the network also loses some of the unpredictability it was being aggressive for.

Page 14 of 23

Physics-Aware Moving Target Defense Table 9 Comprehensive comparison of MTD strategies over 50 Monte Carlo runs on the SWaT testbed Method

Entropy (bits)

Physical MSE

Violations

Packet loss (%)

FPR (%)

TTD (s)

Non-adaptive baselines Static, no defense Random-MTD [40] Time-based, 120 s [41] Threshold-based

0.0 4.2 2.8 2.1

0.042 1.850 0.580 0.120

0 18 4 1

0.00 15.30 3.20 1.50

N/A 8.20 1.80 0.80

N/A 52.3 45.8 38.2

Learning-based baselines Q-Learning MTD [42] Deep-Shield, HDRL [38] Adaptive Path [43] RL-MTD [39]

3.2 4.0 2.7 3.9

1.150 1.020 0.280 0.920

9 6 1 5

7.80 6.40 1.10 5.90

5.30 4.80 1.50 4.50

41.5 40.1 52.1 45.2

Physics-aware (ours) Ballast

3.5

0.048

0

0.08

0.03

38.7

Reactive designs cannot close the gap. ThresholdMTD and Adaptive Path each incur a single violation, far fewer than random shuffling, but both are slow to react, at 38.2 s and 52.1 s respectively. Threshold-MTD detects 0.5 s sooner than Ballast, 38.2 s against 38.7 s, through a different mechanism, an Isolation Forest over flow features rather than the unbound-address counter of Section 3.5, and still records a violation. The ordering is not meaningful at this resolution: the two differ by about one percent of the detection time, while differing by a factor of 2.5 in tracking error. Reaction speed, in other words, does not substitute for validating an action before taking it. Function approximation matters, but it is not sufficient. Tabular Q-Learning reaches only 3.2 bits and incurs 9 violations, which confirms that a discretised value table cannot cover the state space of an industrial network. DeepShield resolves that limitation and attains the second highest entropy at 4.0 bits, yet it still records 6 violations and a tracking error of 1.020. Better representation without a physical constraint simply produces a more capable agent making the same category of mistake. Industrial practice sits in the middle. Time-based mutation at 120 s avoids the instability of random shuffling, with 4 violations rather than 18, but still produces a tracking error 12 times larger than Ballast, at 0.580 against 0.048, because it reconfigures without reference to the current physical state. The baselines lie on a single trade-off line. Figure 7 plots the two columns against each other. The seven baselines follow one log-linear trend with 𝑅2 = 0.81, and none of them departs from it by more than a factor of two, so every increment of unpredictability is bought at a roughly fixed exchange rate in tracking error, spanning a factor of 15.4 from Threshold-based at 2.1 bits and 0.120 to Random-MTD at 4.2 bits and 1.850. The static baseline is excluded from the fit, since a scheme that never mutates has no exchange rate to measure. Ballast is the only point off that trend, a factor of 17 below it at 3.5 bits and 0.048. The claim of this paper is not that it reaches the top of the entropy axis but that it leaves the O Mogollon-Gutierrez et al.: Preprint submitted to Elsevier

Tracking error (physical MSE)

MSE is the tracking error from setpoint, FPR the false positive rate, and TTD the time to detect, the interval from the adversary’s first probe to the controller’s first flag. Entropy is bounded above by 5 bits for || = 32; the uncorrected plug-in estimator returns about 4.68 at the 70-sample window. Violations are totals over 50 runs and count excursions of all three envelope variables; for RL-MTD and Ballast they coincide with the AIT202-only counts of Table 5, because neither recorded a LIT101 or LIT301 excursion in any run. Blind-MTD of Scenarios I and II is a 60 s instance of the time-based scheme and is not repeated here.

log-linear trend, R 2 = 0.81 within a factor of two Ballast Q-Learning

10

Random-MTD

Deep-Shield

0

Time-based RL-MTD

Adaptive Path Threshold-based

×17

10−1 Ballast 3.5 bits, 0.048 static baseline, no defense

2.0

2.5

3.0

3.5

4.0

4.5

Security entropy (bits)

Figure 7: Security entropy against tracking error for every method of Table 9. Each point is a measured pair; nothing is interpolated. The trend is fitted in log space because the error spans a factor of 44 across the table, from the 0.042 of the undefended baseline to the 1.850 of Random-MTD, and a factor of 15.4 across the seven mutating baselines the fit is taken over, and because a straight line in linear space extrapolates to a negative error at zero entropy. The shaded band is a factor of two either side of the fit and contains all seven baselines. Ballast is the only point outside it, a factor of 17 below, and the dotted line marks the 0.042 of the undefended static baseline, which is the floor any defense is working against.

curve the others are confined to; a method that also topped the entropy column would be evidence that the shield was suppressing nothing. Which baseline is strongest depends on the metric, and we state the choice rather than leave it implicit. RandomMTD attains the highest entropy at 4.2 bits and Deep-Shield the second highest at 4.0, but both do so at tracking errors Page 15 of 23

Physics-Aware Moving Target Defense Table 10 Statistical tests, Ballast against RL-MTD, 𝑛 = 50 paired runs Metric

Test

Statistic

𝑝 value

Physical MSE Mean network jitter Packet delivery rate False positive rate

Wilcoxon t-test t-test t-test

𝑍 = −5.42 𝑡 = −6.31 𝑡 = 4.12 𝑡 = −8.91

5.8 × 10−8 6.9 × 10−8 1.5 × 10−4 6.2 × 10−12

Paired by seed, 𝑑𝑓 = 49; the seed fixes the replayed trace, the initial physical state and the probe sequence, which are shared between the two arms. HolmBonferroni correction over the four tests leaves all 𝑝𝑎𝑑𝑗 < 0.002. Effect sizes: rank-biserial 𝑟𝑟𝑏 = 0.98 for MSE, Cohen’s 𝑑 = 1.79 for jitter and 1.42 for FPR. Violations are tested separately: 0 of 50 Ballast runs and 5 of 50 RL-MTD runs were affected, giving a two-sided Fisher exact 𝑝 = 0.056. That is the smallest value the test can return with the baseline arm fixed at five, so the comparison cannot cross 0.05 however few runs Ballast affects; the limit is one of design rather than of effect. We therefore treat the Clopper-Pearson upper bound of 5.8 percent on the per-run violation probability as the primary evidence on safety.

above 1.0. Among the learning-based methods, Adaptive Path is the strongest on the physical metrics, at a tracking error of 0.280 and one violation; RL-MTD is third, at 0.920 and five. We nonetheless pair Ballast against RLMTD throughout, not because it is the strongest opponent but because it is the closest published analogue to our design: a single-agent deep reinforcement learning policy over the same action space of mutation interval and shuffling strategy, differing from Ballast only in the absence of the twin. That pairing isolates the contribution of the safety oracle. Where the widest margin is not the point, we state the margin against the strongest baseline on each metric instead. Taking the table as a whole, the strongest baseline on tracking error is Threshold-based at 0.120 and on packet loss is Adaptive Path at 1.10 percent, each with one violation. Against those stronger references Ballast improves the tracking error by a factor of 2.5 rather than 19, and the packet loss by 92.7 percent rather than 98.6, while removing the remaining violation. Across the table, the absence of a physical model pushes every method towards one of two failure modes: violations when security is prioritised, as with Random and QLearning, or weak security when stability is prioritised, as with Time-based and Threshold. Ballast reaches 3.5 bits with no violations by making the twin a mandatory gate rather than an advisory signal.

6.6. Statistical Significance To confirm that the physical improvements are not sampling noise, we compare Ballast against RL-MTD, the closest published analogue, over the same 50 seeds. Continuous metrics are paired by seed and tested with the Wilcoxon signed-rank test or Student’s t-test as appropriate, and the violation counts, which are not continuous, are tested separately with Fisher’s exact test. Table 10 reports the outcome.

6.7. Ablation Study Table 11 removes one component at a time. We report inference cost alongside accuracy, since the two together determine whether a configuration is deployable.

O Mogollon-Gutierrez et al.: Preprint submitted to Elsevier

Four conclusions follow. Removing the safety shield raises violations from 0 to 8 while adding only 0.6 bits of entropy, which is the trade this paper argues against. The unshielded variant is worse than RL-MTD, which records 5, because removing the mask removes the only term in the reward that references the physical state: what survives is a packet-loss indicator, and the no-MBB row shows that loss is a poor proxy for physical risk, since it loses 11.3 percent of packets at a tracking error of 0.055. The unshielded agent therefore pursues entropy almost unopposed, reaching 4.1 bits against RL-MTD’s 3.9, and mutates correspondingly harder; the twin contributes little to safety as a state feature, and contributes as a gate. Removing Make-Before-Break leaves the physics intact but drives packet loss from 0.08 percent to 11.30 percent, since transactions are severed rather than drained. This isolates the handover as the source of the false positive gap of Scenario II. Because the tracking error holds at 0.055 despite losing twice as many packets as RLMTD, it also confirms the argument of Scenario I that loss reaches the physical layer through its timing rather than its volume: these losses fall in windows the shield has already cleared. Dropping the physics term from the loss raises the tracking error from 0.048 to 0.180, nearly a fourfold increase and 94 percent in RMSE, and reintroduces two violations. Depth is the one place where the choice is genuinely close. The 5-layer model records a slightly lower tracking error, 0.044 against 0.048, but raises inference time by a factor of 1.75, from 8.67 ms to 15.2 ms, consuming 30.4 percent of the 50 ms safety budget in the mean instead of 17.3 percent. We therefore keep three layers, and we note that on hardware with a tighter scan cycle the 1-layer variant may be the only viable option despite its single violation.

7. Decision Latency and Deployment Scale 7.1. Computational Complexity A single twin instance costs (𝐿 ⋅ 𝑑ℎ2 ) per prediction step, where 𝐿 is the number of layers and 𝑑ℎ the hidden width. Unlike an iterative physics solver, the cost does not grow with simulated horizon length. A batch of 32 windows takes 8.67 ms on one core of the workstation, 165.4 ms on one CPU core of the Jetson and 6.06 ms on its GPU, and 105.2 ms on one core of the Raspberry Pi 5. Each additional layer adds about 57 ms on the Jetson CPU (50.3, 165.4 and 279.2 ms for one, three and five layers) and about 37 ms on the Raspberry Pi (30.9, 105.2 and 179.1 ms), consistent with a cost linear in 𝐿; the two increments on each ARM core differ by about one percent because their caches are not loaded identically. Policy selection is a forward pass through a small multilayer perceptron and costs 0.011 ms on the workstation, 0.51 ms on the Jetson CPU and 0.26 ms on the Raspberry Pi, measured in each case as a bare forward pass. Two batch sizes matter, and they answer different questions. A single shield decision evaluates one window for each stage whose variables appear in Ω𝑠𝑎𝑓 𝑒 , which is three in SWaT. Those three windows are stacked into one forward Page 16 of 23

Physics-Aware Moving Target Defense Table 11 Ablation study, isolating the contribution of each component Configuration

Entropy (bits)

Physical MSE

Violations

Packet loss

Inference (ms)

Static baseline, no defense RL-MTD, no Digital Twin

0.0 3.9

0.042 0.920

0 5

0.00% 5.90%

N/A 0.6

Ballast variants without the safety shield without Make-Before-Break without the physics loss 1-layer LSTM 5-layer LSTM Ballast, full

4.1 3.7 3.6 3.5 3.5 3.5

1.250 0.055 0.180 0.085 0.044 0.048

8 0 2 1 0 0

7.20% 11.30% 0.12% 0.10% 0.08% 0.08%

8.67 8.67 8.67 2.14 15.2 8.67

Inference is the latency of one batch of 32 windows on a single workstation core. The per-layer increment on the workstation is 6.53 ms in both steps because each step adds exactly two 128 × 128 layers, raising the arithmetic cost by 8.39 × 108 FLOP each time, so equal increments are expected rather than coincidental.

pass rather than issued as three calls, which matters because the cost of an LSTM is not proportional to batch size: a 50-step window traverses 150 sequential cell evaluations whatever the batch, so the marginal cost of a second and third window is far below the first. On the measured endpoints the marginal cost per additional window is 3.0 ms on the Raspberry Pi and 4.8 ms on the Jetson CPU, against firstwindow costs of 11.7 and 17.8 ms. Our profiling targets the two ends of the range, the single-window baseline and the full-plant 32-window stress condition, and we treat the intermediate batch-3 cost differently depending on how many of those endpoints a platform has. On the two CPU paths where both were measured, we project the batch-3 cost from the single-window baseline and the marginal cost per additional window, giving 27.4 ms on the Jetson CPU and 17.7 ms on the Raspberry Pi. On the workstation and on the Jetson GPU we measured only the 32-window batch, so we report the batch-3 cost as bounded above by that measurement, 8.67 ms and 6.06 ms respectively, which is 17.3 and 12.1 percent of the budget in the mean, and 17.4 and 12.4 percent at P99. On the GPU in particular the bound is close to tight, because a 50-step LSTM there is launch-bound rather than compute-bound and the batch size barely moves the cost. We additionally report a batch of 32 windows as a stress figure, representing a historian refresh in which every stage is reevaluated together. The decision path has two components and they scale differently. The twin’s cost is set by the number of process stages carrying envelope variables, not by the number of network nodes: one instance is maintained per stage, so a sixstage plant such as SWaT runs six instances and the shield consults the three that carry envelope variables, stacked into the single batched call profiled above. A plant with twice the hosts on the same six stages issues exactly the same forward pass. Doubling the number of stages would double the batch, and the marginal cost per additional window measured above, 3.0 ms on the Raspberry Pi and 4.8 ms on the Jetson CPU, is what bounds that growth; a plant with six envelope stages rather than three would reach 26.7 and 41.8 ms on the two CPU paths, still inside the budget. The control plane scales with the network instead, and we bound it analytically rather than by measurement, since O Mogollon-Gutierrez et al.: Preprint submitted to Elsevier

Table 12 Twin inference latency across deployment platforms Platform

Path

Mean (ms)

P99 (ms)

P99 (% of 50 ms)

Core i9-14900KF Jetson Orin Nano (15 W) Jetson Orin Nano (15 W) Raspberry Pi 5

CPU CPU GPU CPU

8.67 165.4 6.06 105.2

8.70 166.7 6.19 105.6

17.4 333.3 12.4 211.2

Three-layer twin with 13 input channels, batch of 32 windows of 50 steps, 5000 timed calls in five trials of 1000 after 200 warm-up calls, one thread pinned to one core. GPU rows include the host-to-device and device-to-host copies and compute in IEEE FP32. The last column expresses the P99 against the 50 ms budget implied by SWaT’s 500 ms scan cycle; the corresponding figures for the mean are given in the text.

our topology is fixed at the seven hosts of SWaT. A mutation rewrites two rules per host, so the FlowMod work grows linearly in | |, and at the 22.5 mutations per hour the policy settles on, seven hosts generate 0.09 rule installations per second against the 4.2 × 104 per second software OVS sustains and the 300 to 7000 per second measured on six commercial switches [44]. Even three orders of magnitude more hosts would leave the installation rate below the slowest device in that study, and the same study points to flowtable priority behaviour, not installation volume, as the hardware constraint that actually binds. Packet-in load is bounded by the reconnaissance throttling of Section 3.5 rather than by topology, since a legitimate endpoint never generates a packet-in after its flow is installed. We have not measured either quantity at scale, and a topology sweep is the natural complement to the platform sweep reported here.

7.2. Platform Comparison On the Jetson the two execution paths fall on opposite sides of the budget. The GPU runs the three-layer twin in 6.06 ms on average and 6.19 ms at P99, including transfers, which is 12.1 percent of the budget in the mean and 12.4 percent at P99; even the five-layer variant stays at 10.3 ms at P99, or 20.6 percent. A single Cortex-A78AE core needs 165.4 ms on average and 166.7 ms at P99 for the same batch, 3.3 times the budget, and even the one-layer variant, at 51.0 ms at P99, does not fit. The CPU figure is not a measurement artefact: one batch costs 1.07 GFLOP, the core Page 17 of 23

Physics-Aware Moving Target Defense

sustains 6.5 GFLOP/s, about 27 percent of its theoretical 24 GFLOP/s at 1.50 GHz, and even at full efficiency it would need 45 ms, 89 percent of the budget. On an edge node of this class it is therefore the accelerator, not the CPU, that makes the twin deployable at a batch of 32 windows. The CPU does fit at the batch of three the shield actually issues. A single window takes 17.8 ms on average and 18.0 ms at P99, and the second and third add about 4.8 ms each rather than repeating the first, which projects to 27.4 ms, 54.8 percent of the budget in the mean. Issuing the three windows as separate calls would cost 53.4 ms and miss the budget, which is why the batched form is the one we specify. The Raspberry Pi 5 has no accelerator, and one CortexA76 core needs 105.2 ms on average and 105.6 ms at P99 for the same batch, 2.1 times the budget. That is 1.57 times faster than one Jetson CPU core, close to the ratio of their clocks, 2.4 GHz against 1.50 GHz, so per cycle the two cores perform almost identically on this workload. The core sustains 10.2 GFLOP/s, about 26 percent of its theoretical 38.4 GFLOP/s at 2.4 GHz, and even at full efficiency it would need 28 ms, 56 percent of the budget. On this gateway the three-layer twin fits at the batch of three: a single window costs 11.7 ms on average and 11.9 ms at P99, each additional window about 3.0 ms, which projects to 17.7 ms, 35.4 percent of the budget in the mean. At a batch of 32 windows only the one-layer variant fits, at 31.1 ms at P99, 62.1 percent of the budget, at the price of the single violation it records in Table 11. On the workstation a single performance core runs the three-layer twin in 8.67 ms on average and 8.70 ms at P99 for the same batch of 32 windows, 17.4 percent of the budget. The core sustains 123.4 GFLOP/s on the 1.07 GFLOP batch, about 68 percent of its theoretical 182.4 GFLOP/s at 5.70 GHz with two 256-bit FMA units, against 26 and 27 percent on the two ARM cores. The gap is larger than clock and vector width alone explain and reflects the maturity of the x86 kernels relative to the AArch64 path. The Jetson GPU, at 6.06 ms, nonetheless completes the batch 1.43 times faster than the workstation core, so an accelerated edge node is not merely adequate for this workload but preferable to a single server-class core.

8. Discussion 8.1. Why Physics-Awareness Changes the Outcome The results indicate that applying an IT-centric defense unchanged to an OT environment is counterproductive. The contribution of Ballast is to separate security entropy from operational risk rather than to trade one against the other. RL-MTD reaches higher nominal entropy, 3.9 bits against our 3.5, but it does not see the inertia of the plant, so its mutations produce actuation jitter that the loop cannot absorb. The twin supplies the missing context. Across 50 nominal runs we observed no violation, and one violation across 50 runs under a 10 percent equipment drift, so the margin survives a stale model rather than depending on a O Mogollon-Gutierrez et al.: Preprint submitted to Elsevier

perfectly calibrated one. The 0.4 bits that separate Ballast from RL-MTD are the price of that margin, and they are paid in a specific and bounded way: the shield masks about 10 percent of proposed mutations, as the converged reward of Figure 4 implies, so the realised mutation rate is roughly a tenth below what the policy requests. Four tenths of a bit against five violations is the trade this paper argues is worth making in an OT setting. Ballast does not eliminate risk. It changes the shape of the risk, moving from frequent small excursions, as in the five violations RL-MTD accumulates in 30 minutes, to rare events whose probability is bounded only empirically, through the 99th percentile forecast margin 𝑒99 , and not by any distribution-free guarantee. Two baselines deserve a specific comment. Heydari’s time-based scheme [41] is presented as lossless, yet in our SWaT reproduction it loses 3.2 percent of packets, about 40 times more than Ballast. The gap between a protocol as designed and a protocol under a realistic industrial workload is easy to underestimate. Hu’s adaptive path migration [43] is reactive and intelligent, and still records one violation, because detection latency lets an attack begin before mitigation arrives. Reaction, however fast, starts after the fact.

8.2. Latency and Real-Time Feasibility The twin’s inference costs 8.67 ms on average on one workstation core, 165.4 ms on the Jetson CPU, 6.06 ms on the Jetson GPU including transfers, and 105.2 ms on the Raspberry Pi. On the workstation the complete decision-toenforcement path costs 21.9 ms in the mean, and its P99 is bounded above by the summed per-stage value of 37.1 ms. On a 500 ms SCADA polling period that is 4.4 percent of the cycle in the mean case and at most 7.4 percent in the tail, so the path stays inside the 10 percent budget even under the pessimistic reference, leaving at least 25.8 percent of that budget unused. The margin holds on the workstation CPU and, for the twin itself, on the Jetson GPU. At a batch of 32 windows neither CPU-only edge path meets the 50 ms budget: the Jetson CPU needs 3.3 times it and the Raspberry Pi 2.1 times. Both are projected to meet it at the batch of three a decision actually requires, at 54.8 and 35.4 percent of the budget respectively in the mean, because the sequential component of the forward pass is paid once per call rather than once per window. At the fast end of the SCADA range, a 100 ms cycle, the 10 percent budget falls to 10 ms. The complete path was measured only on the workstation, where it costs 21.9 ms in the mean, so that budget is not met there, and we do not have the control-plane measurements to say whether an accelerated edge node would meet it. The Make-Before-Break handover proved essential to that result. Blind-MTD shows a P99 data plane jitter of 55.4 ms, which drops to 8.9 ms under our protocol. The bottleneck in MTD is therefore not rule installation but the absence of synchronisation with live TCP sessions, which is precisely the gap the handover fills.

Page 18 of 23

Physics-Aware Moving Target Defense Table 13 Twin performance under simulated process drift Drift scenario Baseline, no drift P101 efficiency −5% P101 efficiency −10% MV101 friction +15% Combined degradation

Test MSE

Violations

Detection rate

0.048 0.062 0.089 0.134 0.178

0 0 1 3 5

94.2% 91.8% 87.5% 82.1% 78.3%

P101 is the primary raw water pump, MV101 the motorised inlet valve. Violations are totals over 50 runs. The detection rate falls under drift because the shield masks more mutations, so a drifting plant loses security silently while appearing safe. Operators should treat a falling detection rate as a maintenance signal, not as evidence of a quiet network.

8.3. Resilience Against Advanced Threats Table 2 covers threats aimed at the defense itself rather than at the plant. Cryptographic jitter on the mutation epoch, combined with the alternate-epoch restriction on subnetpreserving shuffling, cuts ML-based pattern learning from 45.2 percent to 8.3 percent success. The residual figure is still 2.7 times the 3.1 percent chance rate, so the schedule retains some learnable structure. Dual validation cuts poisoning from 78.5 percent to 12.1 percent, a relative reduction of 84.6 percent, which shows the value of an independent physics check beside the learned model. Rate limiting holds controller DoS to 18.7 percent residual success, though a well-resourced adversary sustaining high volume would likely require a distributed controller rather than a single instance. The broader lesson is that a physics-aware defense must reckon with adversarial machine learning against its own components, not only with attacks on the process.

8.4. Generalisation and Process Drift 8.4.1. Sensitivity to equipment degradation Equipment wears. To test the consequence we open the gap between plant and model, perturbing the actuator parameters inside the twin while the simulator stays nominal, which isolates forecast mismatch without changing the environment the metrics are measured against. The experiment is therefore a test of the shield under a stale model, not of the residual monitor: the residual of Eq. (2) compares a sensorderived 𝑑𝑉 ∕𝑑𝑡 against nominal actuator rates and never consults the twin, so it is unaffected by this perturbation and 𝛿𝑝ℎ𝑦 is left at its nominal value. Exercising the residual requires perturbing the simulator instead, so that plant and monitor disagree; we have not run that complement, and the behaviour of the poisoning flag under genuine equipment degradation is accordingly untested. Table 13 reports the effect. Pumping systems lose efficiency progressively through wear, and maintenance guidance for industrial facilities treats such degradation as an expected operating condition rather than a fault [45]. We therefore sweep the efficiency loss rather than assuming a single service interval. A 10 percent loss raises the tracking error by 85 percent, from 0.048 to 0.089, which is a 36 percent increase in RMSE, and still yields only one violation across 50 runs. Beyond about 15 percent drift the model needs retraining. This slow divergence is also why the second poisoning rule fires O Mogollon-Gutierrez et al.: Preprint submitted to Elsevier

only on an abrupt onset: drift of this kind is a maintenance condition, not an attack. The degradation is gradual rather than abrupt, which gives operators a usable maintenance window and allows the twin to be refreshed by transfer learning, an operation we estimate at 2 to 4 days of finetuning on recent logs, though we have not measured it.

8.4.2. Cross-domain deployment protocol Moving to a facility with a different topology, for instance from potable water distribution to wastewater treatment, calls for a staged commissioning rather than a direct cutover. We propose three phases. Phase 1, shadow mode, 14 days. Ballast observes without mutating. The twin learns the new dynamics from live sensor streams, and operators track prediction accuracy through a dashboard showing tracking error and residual histograms. Entry to Phase 2 requires an error below 0.1 for seven consecutive days. Phase 2, conservative mode, 14 days. Mutation begins with a doubled guard band, 𝜖𝑠𝑎𝑓 𝑒 = 40 percent of the envelope half-width, and halved frequency, 𝑇𝑚𝑖𝑛 = 240 s. Any violation rolls the system back to a static configuration and raises an operator alert. The phase passes on zero violations across 5000 mutation cycles. Phase 3, full operation. After a 28-day burn-in with no Phase 2 violations, the standard parameters apply, with ̄ ∈ 𝜖𝑠𝑎𝑓 𝑒 = 20 percent of the envelope half-width and Δ𝑡 [120, 600] s. This procedure lets the framework reach facilities that have no historical dataset of their own, which is the common situation in brownfield installations. 8.4.3. Remark on dataset validity Recent work has questioned the use of SWaT for timeseries anomaly detection benchmarks, particularly because pipeline dropout artefacts can inflate reported detection accuracy [46]. That concern does not transfer directly to our setting. Ballast is not evaluated on anomaly labels or classification accuracy. Our metrics are tracking error, packet loss, violation counts and entropy, none of which depends on the labelling. We use SWaT as a realistic physical process and network topology, and for that purpose its sensor dynamics remain sound.

8.5. Hardware Deployment Feasibility Mininet switches in software on an x86 CPU, which does not represent industrial ASIC behaviour. Table 14 sets our emulated figures against an independent measurement study of six commercial OpenFlow switches [44]. Critical disclosure. Our evaluation runs entirely inside Mininet. We have not validated Ballast on industrial Ethernet switches or on physical PLCs. The comparison does not support a simple multiplicative correction. Software switching is between one and two orders of magnitude faster than the fastest ASIC in that study, and the gap widens further under conditions that our own design happens to create. The priority problem. Make-Before-Break installs the new mapping at high priority while the old mapping persists Page 19 of 23

Physics-Aware Moving Target Defense Table 14 Emulated behaviour against published measurements of commercial OpenFlow switches Quantity

This work (Mininet, software OVS)

Six hardware switches [44]

Flow-rule update rate Update rate with a low-priority catchall rule present Control-plane to data-plane divergence Gap during a rule modification

about 4.2 × 104 updates/s unchanged

Barrier cost

negligible

300 to 7000 updates/s, depending on switch and flow-table occupancy falls to 12 updates/s on one switch at 2000 rules, and to 30 updates/s on another at 750 rules up to 400 ms on one switch; up to 250 ms typically and 22 s in corner cases on another; unbounded (minutes) on a third mean 2.2 to 10 ms and maximum 7.7 to 190 ms on three of the six switches, with packet loss during the transition 0.04 to 3.4 ms per barrier

none; one software datapath not observable

Figures are read from the cited study, which benchmarks HP, Pica8, Dell and NoviSwitch devices alongside two anonymised ASICs. We report them as ranges because the study shows that switch behaviour depends on firmware, occupancy and update pattern in ways that no single scaling factor captures. The software update rate in the first row is pipelined throughput under a saturating batch, a different quantity from the single-installation latency of Table 8.

at low priority, so two priority levels are live in the flow table for the whole guard time. That is precisely the pattern the cited study identifies as pathological: introducing a single low-priority rule collapses the update rate of two of the six tested switches by roughly two orders of magnitude, to 12 and 30 updates per second respectively. On such hardware a single rule installation would cost tens of milliseconds rather than the 2.8 ms we measure, and the guard time would have to grow accordingly. Three of the six switches do not exhibit this behaviour, so the effect is a property of particular ASIC and firmware combinations rather than of OpenFlow itself. We regard identifying which devices tolerate a persistent low-priority rule as a procurement requirement for any real deployment of this protocol. A second problem: barriers do not mean installed. Our latency budget assumes that a confirmed FlowMod is a live forwarding rule. The cited study shows that this assumption fails on three of six switches, where the data plane lags the control-plane acknowledgment by up to 400 ms, by up to 22 s in corner cases, and without bound on one device. A shield that clears an action on the basis of an estimated installation latency would, on such hardware, be reasoning about a rule that is not yet in effect. Any deployment therefore needs data-plane confirmation rather than barrier replies, which is itself an additional latency source we have not modelled. Implications. Taken together, these two findings mean the deployment envelope on real hardware is narrower than emulation suggests, and narrower than a fixed scaling factor would imply. On the switches that handle priorities well, our summed per-stage P99 of 37.1 ms plausibly grows to a few tens of milliseconds and stays inside a 500 ms scan cycle. On the switches that do not, Make-Before-Break in its present form is not deployable without redesign, for instance by replacing the priority-based overlap with an explicit twotable pipeline. Systems with scan cycles below 100 ms, such as high-speed manufacturing or servo control, would in any case need LSTM inference offloaded to a fixed-function accelerator, policy enforcement pushed into the data path on programmable switches, or a hybrid arrangement in which time-critical loops keep a static configuration while only non-critical monitoring traffic is mutated. Firmware defects

O Mogollon-Gutierrez et al.: Preprint submitted to Elsevier

in OpenFlow implementations, non-deterministic ASIC behaviour under a full flow table, and electromagnetic interference on a plant floor are all outside what Mininet can reproduce. We are working with municipal water utility partners on hardware-in-the-loop validation using Siemens S71500 PLCs and managed switches, with preliminary results expected in Q1 2027. Until then Table 14 should be read as a feasibility boundary, not as proof of deployability.

8.6. Limitations and Future Directions Seven limitations bound the claims of this paper. Fidelity of the twin. The defense is no better than its model. The drift experiment shows that a 10 percent pump efficiency loss raises the tracking error by 85 percent while still avoiding violations, but beyond roughly 15 percent drift the shield begins to produce both false rejections and false approvals, and retraining becomes mandatory. The contribution of each component is only partly isolated. Three ablations that would settle it are absent. First, a shield driven by a current-state threshold rather than by a forecast: the reconfiguration transient lasts tens of milliseconds while the tank time constant is minutes, so a 10second forecast horizon may add little over simply checking whether the process is currently near its setpoint, and until that baseline is run the LSTM’s contribution over a threshold is not established. Second, the shield paired with a random or greedy scheduler instead of PPO: since the unshielded agent records 8 violations, the shield is doing the safety work, and the policy’s contribution is confined to the entropy and timing of mutation. Third, a PPO-Lagrangian agent: we argue that a constraint satisfied in expectation is inadequate here, but we did not run that comparison and the argument remains analytical. Computational cost. On the Jetson, evaluating the full 32-window batch uses 12.4 percent of the budget on the GPU at P99 but 3.3 times the budget on one CPU core. Table 12 shows that on a constrained gateway without an accelerator the three-layer twin is similarly not viable at a batch of 32 windows, since one core of the Raspberry Pi 5 needs 2.1 times the budget. Both CPU paths become viable at the operational batch of three a decision requires, projected at 54.8 and 35.4 percent of the budget respectively in the mean. At a batch of 32, only the one-layer variant Page 20 of 23

Physics-Aware Moving Target Defense

fits on the Raspberry Pi at 62.1 percent, at the price of the single violation it records in Table 11. An 8-bit quantised LSTM would lower the cost further, at the price of some accuracy, and would be the first thing to try on hardware tighter than the platforms tested here; we did not evaluate it. An analytical residual monitor is the other route: Kreso et al. [47] report a closed-form KL divergence detector roughly 600 times faster than a transformer baseline on CPU, which would fit where the LSTM does not, at the cost of the learned nonlinear dynamics. Attacks on the defense itself. An adversary who successfully poisons the training corpus raises the residual attack success rate from 12.1 percent, with dual validation active, to 78.5 percent when it is bypassed. Federated learning with Byzantine-robust aggregation is the most promising countermeasure we are aware of. Single-site evaluation. All results come from SWaT. Power grids and chemical plants need their own physics models, and although cross-domain transfer learning should cut the retraining effort substantially, we have not measured that reduction and do not claim a figure for it. Instrumentation in the field. Many legacy SCADA installations lack the sensing needed for real-time state estimation. Retrofitted or soft sensors close the gap, at a capital overhead we have not quantified for this framework. Emulation rather than hardware, and a prioritydependent protocol. No result in this paper was obtained on industrial hardware. Beyond the general emulation gap, the hardware comparison above identifies a specific dependency: Make-Before-Break relies on two concurrent priority levels, and published measurements show that some commercial switches lose two orders of magnitude of update throughput under exactly that condition. Validating which hardware families tolerate the protocol is a prerequisite for deployment, not a refinement of it.

9. Conclusion This paper addresses the conflict between dynamic cyber-defense and physical stability in industrial control. We showed that physics-agnostic Moving Target Defense degrades operational safety, producing actuator jitter and, in the worst configurations, more disruption than the attacks it prevents. Ballast resolves the conflict by placing a Digital Twin inside the SDN decision loop as a safety oracle, so that no reconfiguration reaches the plant until its predicted physical trajectory has been cleared. On the SWaT testbed the framework sustains useful security entropy while preserving real-time control integrity, with no violation observed across 50 nominal runs and a residual risk bounded empirically rather than analytically. The broader conclusion is that the next generation of ICS security mechanisms has to be physics-aware to be deployable at all. Our remaining work concerns hardening the twin against attacks on the model itself and validating the framework on physical hardware across multiple sites.

O Mogollon-Gutierrez et al.: Preprint submitted to Elsevier

Data Availability The source code and all replication files, including the seed list and the exact dataset split, are available at https: //github.com/Anonymized/Ballast (anonymised for peer review).

References [1] M. Homaei, O. Mogollón-Gutiérrez, J. C. Sancho, M. Ávila, A. Caro, A review of digital twins and their application in cybersecurity based on artificial intelligence, Artificial Intelligence Review 57 (8) (Jul. 2024). doi:10.1007/s10462-024-10805-3. [2] F. Qiu, A. Kumar, J. Hu, P. Sharma, Y. B. Tang, Y. Xu Xiang, J. Hong, A review on integrating iot, iiot, and industry 4.0: A pathway to smart manufacturing and digital transformation, IET Information Security 2025 (1) (Jan. 2025). doi:10.1049/ise2/9275962. [3] T. Ji, X. Xu, Exploring the integration of cloud manufacturing and cyber-physical systems in the era of industry 4.0 – an opc ua approach, Robotics and Computer-Integrated Manufacturing 93 (2025) 102927. doi:10.1016/j.rcim.2024.102927. [4] R. Venanzi, G. Di Modica, L. Foschini, P. Bellavista, Towards it/ot integration in industry digitalization: A comprehensive survey, Journal of Network and Computer Applications 245 (2026) 104373. doi: 10.1016/j.jnca.2025.104373. [5] W. Nsengiyumva, S. Zhong, S.-T. Tu, Nde 4.0: The confluence of cutting-edge nondestructive inspection practices, data fusion techniques, artificial intelligence, and cyber-physical systems for effective evaluation of materials and structures, Mechanical Systems and Signal Processing 242 (2026) 113626. doi:10.1016/j.ymssp.2025.113626. [6] N. Kalpani, N. Rodrigo, Securing industry 4.0: a systematic review of ai-driven intrusion detection approaches and emerging trends, Journal of Reliable Intelligent Environments 12 (1) (Dec. 2025). doi:10.1007/ s40860-025-00264-0. [7] T. Zhukabayeva, L. Zholshiyeva, N. Karabayev, S. Khan, N. Alnazzawi, Cybersecurity solutions for industrial internet of things–edge computing integration: Challenges, threats, and future directions, Sensors 25 (1) (2025) 213. doi:10.3390/s25010213. [8] S. Rani, A. Kataria, S. Kumar, V. Karar, A new generation cyberphysical system: A comprehensive review from security perspective, Computers & Security 148 (2025) 104095. doi:10.1016/j.cose.2024. 104095. [9] A. Mwangi, L. Navarro-Hilfiker, L. Brewka, M. Gryning, E. Fumagalli, M. Gibescu, A threshold-triggered deep q-network-based framework for self-healing in autonomic software-defined iiot-edge networks, IEEE Transactions on Network and Service Management 23 (2026) 1297–1311. doi:10.1109/tnsm.2025.3647853. [10] A. Banitalebi Dehkordi, Edblsd-iiot: a comprehensive hybrid architecture for enhanced data security, reduced latency, and optimized energy in industrial iot networks, The Journal of Supercomputing 81 (2) (Jan 2025). doi:10.1007/s11227-024-06872-6. [11] J. Chen, A. Kemmeugne, J. Yan, M. Ghafouri, M. Kassouf, M. Debbabi, An sdn-based framework for cyber-physically coordinated voltage support of virtual power plants against dos attacks, IEEE Transactions on Smart Grid 17 (1) (2026) 617–633. doi:10.1109/tsg.2025. 3614650. [12] T. Kotsiopoulos, P. Radoglou-Grammatikis, Z. Lekka, V. Mladenov, P. Sarigiannidis, Defending industrial internet of things against modbus/tcp threats: A combined ai-based detection and sdn-based mitigation solution, International Journal of Information Security 24 (4) (June 2025). doi:10.1007/s10207-025-01076-2. [13] Y. Niu, X. Han, C. He, Y. Wang, Z. Cao, D. Zhou, A privacypreserving polymorphic heterogeneous security architecture for cloud–edge collaboration industrial control systems, Applied Sciences 15 (14) (2025) 8032. doi:10.3390/app15148032.

Page 21 of 23

Physics-Aware Moving Target Defense [14] S. Krishnaveni, S. Sivamohan, B. Jothi, T. M. Chen, M. Sathiyanarayanan, <scp>twinsec</scp>-<scp>ids</scp>: An enhanced intrusion detection system in <scp>sdn</scp>-digital-twin-based industrial cyber-physical systems, Concurrency and Computation: Practice and Experience 37 (3) (Dec 2024). doi:10.1002/cpe.8334. [15] X. Etxezarreta, F. Turrin, I. Garitano, M. Iturbe, U. Zurutuza, M. Conti, Replica-based moving target defense against injection attacks in software-defined industrial control systems, IEEE Transactions on Dependable and Secure Computing 23 (3) (2026) 5163–5180. doi:10.1109/tdsc.2026.3652652. [16] A. Kpoze, J. Degila, A. Ahouandjinou, Leveraging network reconfiguration to mitigate stealthy fdi attacks in smart grid scada systems by exploiting attacker uncertainty, in: Towards New e-Infrastructure and e-Services for Developing Countries, Springer Nature Switzerland, 2025, pp. 293–314. doi:10.1007/978-3-032-01904-2_19. [17] S. Bose, S. Bhattacharya, N. Saqib, M. Govindarasu, Zt-mtd: Zero trust-enabled dynamic moving target defense for der networks, in: 2025 IEEE Power & Energy Society General Meeting (PESGM), IEEE, 2025, p. 1–5. doi:10.1109/pesgm52009.2025.11224995. [18] X. Qin, F. Jiang, C. Dong, R. Doss, A hybrid cyber defense framework for reconnaissance attack in industrial control systems, Computers & Security 136 (2024) 103506. doi:10.1016/j.cose.2023.103506. [19] X. Etxezarreta, I. Garitano, M. Iturbe, U. Zurutuza, Low delay network attributes randomization to proactively mitigate reconnaissance attacks in industrial control systems, Wireless Networks 30 (6) (2023) 5077–5091. doi:10.1007/s11276-022-03212-5. [20] S. H. Mohammed, M. S. Jit Singh, A. Al-Jumaily, M. Tariqul Islam, M. S. Islam, A. M. Alenezi, M. A. Alawad, M. A. Alsoufi, Ig-apsodnn: Deep learning intrusion detection model to detect false data injection attacks in smart grids, Ad Hoc Networks 180 (2026) 104053. doi:10.1016/j.adhoc.2025.104053. [21] D. Arulkumar, K. K, Metastack-aptnet: An ensemble deep learning framework for advanced persistent threat detection and mitigation in cyber-physical systems using blockchain technology, Computers and Electrical Engineering 130 (2026) 110838. doi:10.1016/j. compeleceng.2025.110838. [22] R. Ma, Z. Ying, W. Li, D. Zhu, W. Zhou, Y.-A. Tan, H. Liu, Explainable ai-guided test-time adversarial defense for resilient yolo detectors in industrial internet of things, Future Generation Computer Systems 179 (2026) 108356. doi:10.1016/j.future.2025.108356. [23] R. Yin, L. Varga, Machine learning for resilience analysis: a review of systems under cyberattacks, Engineering Applications of Artificial Intelligence 166 (2026) 113542. doi:10.1016/j.engappai.2025.113542. [24] A. Pasikhani, P. Gope, Y. Yang, S. Mehnaz, B. Sikdar, Baiting ai: Deceptive adversary against ai-protected industrial infrastructures, IEEE Transactions on Dependable and Secure Computing 23 (3) (2026) 5320–5338. doi:10.1109/tdsc.2026.3651404. [25] M. Alshiekh, R. Bloem, R. Ehlers, B. Könighofer, S. Niekum, U. Topcu, Safe reinforcement learning via shielding, Proceedings of the AAAI Conference on Artificial Intelligence 32 (1) (Apr. 2018). doi:10.1609/aaai.v32i1.11797. [26] J. Achiam, D. Held, A. Tamar, P. Abbeel, Constrained policy optimization, in: Proceedings of the 34th International Conference on Machine Learning, Vol. 70 of PMLR, 2017, pp. 22–31. [27] O. Bastani, Safe reinforcement learning with nonlinear dynamics via model predictive shielding, in: 2021 American Control Conference (ACC), 2021, pp. 3488–3494. doi:10.23919/ACC50511.2021.9483182. [28] S. and Otoom, Risk auditing for digital twins in cyber physical systems: A systematic review, Journal of Cyber Security and Risk Auditing 2025 (1) (2025) 22–35. doi:10.63180/jcsra.thestap.2025. 1.3. [29] A. Aghazadeh Ardebili, C. Martella, A. Longo, C. Rucco, F. Izzi, A. Ficarella, Iot-driven resilience monitoring: Case study of a cyberphysical system, Applied Sciences 15 (4) (2025) 2092. doi:10.3390/ app15042092. [30] M. S. Bajestani, C. Kim, K.-C. Lee, D. B. Kim, Self-x-based secure human-cyber-physical system (sshcps) for autonomous manufacturing in the era of industry 5.0, Advanced Engineering Informatics 69

O Mogollon-Gutierrez et al.: Preprint submitted to Elsevier

(2026) 104054. doi:10.1016/j.aei.2025.104054. [31] M. Homaei, I. Khazrak, R. Molano, A. Caro, M. Ávila, Cyber-resilient digital twins: Discriminating attacks for safe critical infrastructure control (2026). doi:10.48550/ARXIV.2603.18613. [32] M. Homaei, M. Tarif, P. García Rodríguez, A. Caro, M. Ávila, Causal digital twins for cyber–physical security in water systems: A framework for robust anomaly detection, Machine Learning with Applications 23 (2026) 100824. doi:10.1016/j.mlwa.2025.100824. [33] D. F. Valderrama, G. B. Gaggero, G. Ferro, A. Mokarim, M. Robba, P. Girdinio, M. Marchese, An online intrusion detection system for photovoltaic generators through physics-based neural networks, Electric Power Systems Research 253 (2026) 112528. doi:10.1016/ j.epsr.2025.112528. [34] R. Hemmati, H. Saboori, A hybrid data-driven and physics-informed energy management model for electrical grids with spatio-temporal cyberattack detection-reconstruction using digital twin, Energy Conversion and Management 348 (2026) 120728. doi:10.1016/j. enconman.2025.120728. [35] Y. Yang, Y. Geng, Q. Wei, M. Zhou, X. Che, Physical semantic inference method for industrial control proprietary protocol data fields, Computers & Security 159 (2025) 104654. doi:10.1016/j.cose.2025. 104654. [36] V. Menzel, J. Hurink, A. Remke, Real-world case studies for a process-aware ids, Energy Informatics 8 (1) (June 2025). doi:10.1186/ s42162-025-00545-1. [37] M. Homaei, I. Khazrak, R. Molano, A. Caro, M. Ávila, Graph attention networks with physical constraints for anomaly detection, ICT Express (May 2026). doi:10.1016/j.icte.2026.05.004. [38] Y. Cao, Y. Lin, D. Han, Y. Xia, Deep-shield: Multiphase mitigation of apt via hierarchical deep reinforcement learning, IEEE Internet of Things Journal 12 (15) (2025) 30970–30982. doi:10.1109/jiot.2025. 3573367. [39] A. Javadpour, F. Ja’fari, C. Benzaïd, T. Taleb, An optimized reinforcement learning based mtd mutation strategy for securing edge iot against ddos attack, Journal of Information Security and Applications 93 (2025) 104138. doi:10.1016/j.jisa.2025.104138. [40] E. Al-Shaer, Q. Duan, J. H. Jafarian, Random host mutation for moving target defense, in: A. D. Keromytis, R. Di Pietro (Eds.), Security and Privacy in Communication Networks, Vol. 106 of Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, Springer, Berlin, Heidelberg, 2013, pp. 310–327. doi:10.1007/978-3-642-36883-7_19. [41] V. Heydari, Moving target defense for securing scada communications, IEEE Access 6 (2018) 33329–33343. doi:10.1109/access.2018. 2844542. [42] Z. Li, Z. Zhou, T. Zhang, X. Xing, Marl-motag: Multi-agent reinforcement learning based moving target defense to thwart ddos attacks, in: 2022 International Conference on Networking and Network Applications (NaNA), IEEE, 2022, p. 316–321. doi:10.1109/nana56854.2022. 00061. [43] Y. Hu, P. Xun, P. Zhu, W. Kang, Y. Xiong, Y. Zhu, W. Shi, C. Hu, Moving target defense based on adaptive forwarding path migration for securing the scada network, Security and Communication Networks 2021 (2021) 1 – 15. doi:10.1155/2021/1704125. [44] M. Kuzniar, P. Perešíni, D. Kostić, M. Canini, Methodology, measurement and analysis of flow table update characteristics in hardware OpenFlow switches, Computer Networks 136 (2018) 22–36. doi: 10.1016/j.comnet.2018.02.014. [45] U.S. Department of Energy, Improving pumping system performance: A sourcebook for industry, Tech. Rep. DOE/GO-102006-2079, U.S. Department of Energy, Industrial Technologies Program (May 2006). doi:10.2172/882946. [46] R. Wu, E. Keogh, Current time series anomaly detection benchmarks are flawed and are creating the illusion of progress, IEEE Transactions on Knowledge and Data Engineering (2023) 2421 – 2429doi:10.1109/ tkde.2021.3112126. [47] I. Kreso, M. Tarif, F. Moradi, I. Khazrak, M. M. Rezaee, M. Homaei, Information-theoretic digital twins for stealthy attack detection in

Page 22 of 23

Physics-Aware Moving Target Defense industrial control systems: A closed-form KL divergence approach (2026). doi:10.48550/arXiv.2603.01621.

A. Safety Verification Logic The error distribution of an LSTM is unknown and unlikely to be Gaussian under adversarial conditions, so a strict deterministic bound is not available. Ballast therefore uses a high-confidence empirical boundary, and we state that openly rather than presenting the shield as a formal guarantee. Definition 2 (Valid prediction region). A forecast 𝑥̂ 𝑡+𝑘 at horizon 𝑘 is valid only if it lies inside the physically reachable set 𝑘 (𝑥𝑡 ) implied by the actuator capacities over that horizon: 𝑘 (𝑥𝑡 ) = { 𝑥 ∣ 𝑥𝑡 +𝑘 𝑇𝑠 𝑓𝑚𝑖𝑛 ≤ 𝑥 ≤ 𝑥𝑡 +𝑘 𝑇𝑠 𝑓𝑚𝑎𝑥 }, (12) where 𝑓𝑚𝑖𝑛 < 0 and 𝑓𝑚𝑎𝑥 > 0 are the maximum drainage and fill rates of the tank, 𝑇𝑠 = 1 s is the sampling period and 𝑘 = 𝐻 = 10 is the prediction horizon of Section 5. The shield rejects an action 𝑎𝑡 unless the forecast, widened by two margins, remains inside Ω𝑠𝑎𝑓 𝑒 and inside the reachable set: Safe(𝑎𝑡 ) ⟺

( ) 𝑥̂ 𝑡+𝑘 ±(𝑒99 +𝜖𝑠𝑎𝑓 𝑒 ) ⊂ Ω𝑠𝑎𝑓 𝑒 ∧ 𝑥̂ 𝑡+𝑘 ∈ 𝑘 (𝑥𝑡 ). (13)

The first margin is the 99th percentile prediction error 𝑒99 = 0.038 measured on the held-out validation split of Section 5, which covers the twin’s own forecast error. The second is the guard band 𝜖𝑠𝑎𝑓 𝑒 of Section 4, fixed at 20 percent of each variable’s envelope half-width, which covers the excursion the reconfiguration itself may induce before the forecast is refreshed. The two add rather than overlap, because they bound different quantities. Since 𝑒99 is normalised over the envelope range, it is 7.6 percent of the half-width, so an action is cleared only while the forecast stays within 72 percent of the half-width of the setpoint, the figure quoted in the caption of Figure 1. The reachability term is what catches a forecast that is numerically inside the envelope but physically impossible, which is the characteristic signature of a poisoned or badly extrapolating model. Neural networks cannot supply deterministic bounds for out-of-distribution events, so this margin does not constitute a proof of safety. What it provides is a shift in the risk profile, from frequent operational disruption to infrequent events whose likelihood is calibrated on heldout data.

O Mogollon-Gutierrez et al.: Preprint submitted to Elsevier

Page 23 of 23

Related documents

• BALLAST: Physics-Aware Moving Target Defense for Industrial Control Systems Using a Digital Twin Safety Oracle#1343825
• Safety Under State Uncertainty: Robustifying Control Barrier Functions#1013435
• Enhanced Control Barrier Functions for Safety-Critical Control of Nonlinear Affine Systems / Yu Zhang ; Gutachter: Chunlin Chen, Alois C. Knoll ; Betreuer: Alois C. Knoll#1145486
• HOW THESE CONTROLS ARE APPLIED TO SPECIFIC SYSTEMS#2314
• Learning and control in trustworthy and responsible artificial intelligence for cyber-physical systems#206978