arXiv CSopen access

HySecTwin: A Knowledge-Driven Digital Twin Framework Augmented with Hybrid Reasoning for Cyber-Physical Systems

arXiv:2605.11682v1 [cs.CR] 12 May 2026

HySecTwin: A Knowledge-Driven Digital Twin Framework Augmented with Hybrid Reasoning for Cyber-Physical Systems David Holmes1,2*, Ahmad Moshin2,3† , Surya Nepal1,2† , Leslie Sikos1,2† , Helge Janicke1,2† 1*

Edith Cowan University, 270 Joondalup Drive, Joondalup, 6027, Western Australia, Australia. 2 CSIRO, Data61, Sydney, NSW, Australia.

*Corresponding author(s). E-mail(s): [email protected]; Contributing authors: [email protected]; [email protected]; [email protected]; [email protected]; † These authors contributed equally to this work. Abstract Existing Digital Twin (DT) approaches lack semantic reasoning capabilities for effective cybersecurity modelling in Cyber-Physical Systems (CPS). This paper presents HySecTwin, a knowledge-driven digital twin architecture that places automated reasoning at the core of real-time threat detection. HySecTwin incorporates semantic modelling to transform heterogeneous CPS telemetry, device attributes, and operational relationships into machine-interpretable representations, combined with an embedded reasoning engine operating over contextualized system states. Unlike opaque detection methods, the framework integrates deterministic rule-based inference with hybrid fuzzy reasoning to generate explicit, interpretable, and auditable security assessments from live device telemetry. This enables context-aware monitoring of complex CPS environments while preserving transparency and trust. Experimental evaluation using a representative CPS testbed and MITRE ATT&CK campaign-inspired attack scenarios demonstrates sub-millisecond twin synchronization latency and up to 21.5% faster threat detection compared with deterministic reasoning alone. The results show that semantic modelling, semantic enrichment, and hybrid reasoning improve, explainability, and resilience without extra system overhead. HySecTwin provides a lightweight, containerized, and extensible framework for secure-by-design digital twin deployments in mission-critical infrastructures.

1

Keywords: digital twins, semantic modeling, cybersecurity, machine reasoning

1 Introduction Securing cyber–physical systems (CPS) that underpin critical infrastructure is inherently complex. Unlike enterprise IT networks, industrial CPS environments comprise heterogeneous devices and protocols, embed implicit context in physical processes, and exhibit opaque causality between cyber- and physical events. These factors make it difficult to interpret raw signals and pinpoint attack root causes using traditional security tools. A malfunctioning sensor reading, for example, might only be meaningful when correlated with process state and control logic, and subtle attack-induced deviations may be obscured by noisy operational data. This complexity demands security approaches that can integrate diverse data sources and domain knowledge to infer threats in a contextualized, explainable manner. Digital twins (DTs), virtual counterparts of physical assets and processes (physical twins), have emerged in engineering as a means to mirror system state and behavior in real time. Originally used for system design, simulation, and predictive maintenance, DT technology is now increasingly being applied to cybersecurity analysis. By providing a high-fidelity digital mirror of the CPS, a DT can serve as a testbed for detection and response strategies without risking disruption to the live system. Early studies have leveraged DTs for anomaly detection and process fault identification in manufacturing settings (e.g., Gaikwad et al. integrate thermal simulations and sensor data via a DT to detect additive manufacturing faults [1]). In industrial control contexts, DTs have been proposed for monitoring system performance and flagging deviations: for instance, Masi et al. introduce a “cybersecurity digital twin” architecture to secure critical infrastructure [2], and Varghese et al. develop a DT-based intrusion detection system for industrial control systems (ICS) [3]. These works demonstrate that DTs can reduce deployment costs and improve system analysis by enabling detection of incipient failures or attacks before they escalate. Indeed, DTs have been used to support predictive maintenance and anomaly detection in smart factories, and even to emulate attacks in a controlled virtual environment as a means to test countermeasures safely [4]. However, the use of DTs as dedicated cybersecurity assets remains comparatively niche, and significant gaps must be addressed before their full potential in security operations can be realized [5]. Prior research surveys the landscape of DT applications in security (e.g., use cases and requirements for cyber-defense [6]) and identifies opportunities for DTs to augment defense-in-depth strategies [5]. A recurring theme is the need to bridge the vocabulary and context between operational technology (OT) engineers and cybersecurity analysts so that a DT can seamlessly support threat monitoring in terms both communities understand. Crucially, for a DT to act as an effective cybersecurity tool, it must go beyond a basic data-synchronization replica of the physical system. The twin needs to expose semantic context about assets, information flows, and security policies. Without machine-interpretable context, a DT risks becoming a complex but opaque copy of the

2

CPS, one that is no more transparent to security analysis than the original system. In other words, a conventional DT that only mirrors raw states provides an insufficient basis for automated threat analysis, since the burden of interpreting those states (e.g., which sensor readings indicate unsafe operating conditions, which network commands violate policy) falls entirely on human experts or ad hoc scripts. This limitation is evident in existing DT-based security prototypes that lack semantic enrichment: they can replay events and detect certain anomalies, but they struggle to explain why an anomaly is important or to correlate it with higher-level tactics or impacts. As Holmes et al. observed, the integration of DT technology has often insufficiently explored the risks and lacks systematic methods to represent security knowledge [5]. Semantic modeling has therefore been identified as a key enabler to unlock the cybersecurity value of DTs [6]. By annotating a DT with a formal, machine-interpretable ontology of the CPS (using standards such as the Resource Description Framework (RDF) and the Web Ontology Language (OWL) ), one can encode the relationships and properties that are implicitly understood by engineers, for example, which sensors influence which actuators, what physical process parameters are considered safe, or how network zones and access controls are structured. Such an ontology provides a shared vocabulary and formal conceptualization to integrate heterogeneous data and tools, ensuring that diverse components of a CPS share a common understanding of key concepts like alarms, flows, or authentication. Semantically enriched DTs (sometimes termed ’cognitive twins’ or semantic digital twins) have been proposed as a foundation for security monitoring in Industry 4.0 settings. Kharlamov et al. [4] argue that ontology-backed DTs can greatly simplify analytics and diagnostics by enabling interoperability and automated reasoning over the aggregated knowledge of the system. In the absence of semantic enrichment, any security assessment using a DT would require custom integration for each new data source or rule, and would lack the ability to generalize or reuse knowledge across systems—a clear barrier to scaling security solutions for the Internet of Things (IoT) and industrial CPS. In short, semantic modeling suffuses the DT with understanding of the CPS’s structure and context, which is a prerequisite for performing higher-level security analysis in an explainable and automated fashion. Even with a semantically enriched twin, effective cyber-defense requires reasoning mechanisms that can draw actionable insights from the twin’s knowledge in real time. Recent work on Security Orchestration, Automation and Response (SOAR) has started to incorporate DTs as central data hubs [7], but these have so far relied on conventional rule engines or simple analytics. We posit that a hybrid reasoning approach, combining deterministic logic with fuzzy inference, is needed to fully leverage the rich semantic data for cybersecurity [8]. Deterministic reasoning (e.g., a Rete-based rule engine or description-logic reasoner) excels at applying crisp rules and constraints: for instance, enforcing known safety limits, detecting explicit policy violations, or checking invariant conditions in the CPS (such as a valve position that contradicts a sensor reading). It provides explainable conclusions because each alert can be traced to a specific rule or ontological violation, aligning well with expert knowledge and regulatory requirements. Prior DT-based intrusion detection studies have indeed utilized rule-based engines or specification checking to flag unauthorized system states [3, 4]. However, purely deterministic logic may fail to catch incipient or ambiguous attacks

3

that do not cleanly violate any single rule, for example, a slow-drifting sensor spoofing or a combination of minor anomalies that collectively indicate malicious intent. Fuzzy reasoning addresses this gap by evaluating degrees of truth and combining multiple soft indicators. By using fuzzy logic, the system can reason about partial rule satisfaction or incorporate heuristic knowledge, thereby recognizing subtle patterns such as gradual performance degradation or intermittent fault symptoms that a crisp rule might overlook. Fuzzy inference has been applied in CPS security to assess noisy signals and produce confidence-weighted alerts (e.g., treating sensor deviations not as binary events but as members of fuzzy sets like “slightly abnormal” vs. “severely abnormal”). In the context of a DT, fuzzy rules can augment the detection of complex attack scenarios – for example, a combination of small pressure fluctuations and moderate network latency might together raise a high suspicion of a stealthy MITM attack, even if each metric alone stays within acceptable bounds. By building a hybrid reasoning architecture, this approach allows us to benefit from the strengths of each: the deterministic component ensures formal compliance and catches obvious violations with zero false positives, while the fuzzy component provides resilience to uncertainty and minor variations, thus reducing false negatives. Notably, our approach does not preclude the incorporation of data-driven machine learning (ML) methods on DT telemetry (as explored by Gaikwad et al. [1] and others), but we focus on approaches that retain transparency. Pure ML techniques can identify complex patterns in sensor data, yet they often behave as black boxes and lack the causal explanations necessary for operator trust and forensic analysis [6]. In contrast, a hybrid reasoning engine grounded in semantic knowledge can produce alerts that are accompanied by humanunderstandable justifications (e.g., referencing the violated policy or the combined weight of multiple anomalous factors), thereby supporting the explainability required for critical infrastructure defense. In summary, the problem addressed in this paper is how to secure industrial cyber–physical systems by leveraging DT technology augmented with semantic modeling and hybrid reasoning. We aim to enable a DT-based security framework that can automatically detect and interpret both straightforward and nuanced threats in CPS operations, and do so in a way that is interpretable to humans and aligned with existing cybersecurity frameworks. Our solution approach is grounded in established best practices. For example, it aligns with the NIST Cybersecurity Framework (CSF) core functions Detect, Respond, and Recover [9] by facilitating timely detection of incidents, automated response actions, and system recovery guidance. By tagging detected events with semantic metadata, the approach also makes it possible to map technical findings to high-level CSF categories (e.g., identifying which Detect subcategory a particular alert falls under), which can aid in compliance and reporting. This practical orientation ensures that our research outcomes can be readily interpreted in the context of standard security management processes, bridging the gap between theoretical advances and real-world adoption.

4

Contributions. Building on the above insights, this paper presents HySecTwin, a framework for semantic twin-driven security analysis in CPS. The key contributions of our work are as follows: • Semantic CPS Digital Twin: We design an ontology-based semantic model for the cyber-physical system and integrate it with the DT. This semantic annotation of the DT captures security-relevant knowledge about the system’s assets, network topology, physical processes, and policies in a machine-readable format (using RDF/OWL). It provides a unified, extensible representation that enables interoperability and context-sharing across CPS components and security tools. • Hybrid Reasoning Engine: We develop a hybrid reasoning mechanism that combines deterministic rules with fuzzy inference to automatically analyze the semantically enriched twin. The deterministic component (using a rule engine) checks for crisp violations of safety or security conditions (e.g., threshold exceedance, state inconsistencies, known attack signatures), while the fuzzy component evaluates partial evidence and aggregates multiple weak signals to detect complex or stealthy attack patterns. The reasoning engine produces explainable alerts with confidence scores, thus supporting both explainability and early detection of threats that purely rigid or purely data-driven approaches might miss. • Reference Implementation: We implement a reference prototype of the proposed framework, integrating off-the-shelf and custom components. In our implementation, an open-source DT platform is coupled with a semantic triple store and reasoning engines (a Drools-based expert system and a Fuzzy Logic module) to form a cohesive security twin environment. We outline the engineering decisions and architecture of this prototype, which can serve as a blueprint for deploying semantic security twins in practice. The implementation demonstrates feasibility on contemporary IoT/CPS infrastructure and is extensible to accommodate additional reasoning modules or data sources. • CPS Case Study and Evaluation: We validate the HySecTwin framework on a representative industrial control case study. Using a laboratory CPS testbed, we simulate attack scenarios inspired by the MITRE ATT&CK for ICS knowledge base (specifically the Dragonfly 2.0 APT campaign). We show that our hybrid reasoner can successfully identify and contextualize the attacks, achieving improved detection coverage compared to a purely deterministic approach. We evaluate system performance under realistic load conditions, measuring the end-to-end detection latency and throughput to ensure the approach meets real-time operational requirements. Furthermore, we demonstrate how each detected event is mapped to the NIST CSF functions and categories, illustrating the framework’s practical relevance for cybersecurity governance. To the best of our knowledge, this work is the first to integrate semantic modeling with a hybrid rule/fuzzy reasoning engine in a DT for ICS security, and to report an evaluation of such a system under CPS workload conditions. The remainder of this paper is organised as follows. Section 2 reviews related work on cybersecurity applications of DTs and highlights the unresolved challenges.

5

Section 3 formalises the problem and introduces key concepts, including the threat model and semantic modeling foundations. Section 4 details the architecture of the proposed HySecTwin framework, while Section 5 describes the implementation and a representative CPS setup used for experimentation. In Section 6, we present the results of our evaluation, including detection accuracy and performance metrics, followed by a discussion of findings and limitations in Section 7. Finally, Section 8 concludes the paper and outlines directions for future work.

2 Related Work DTs are a mature technology in engineering and manufacturing and are increasingly studied for cybersecurity. Foundational work defines DTs as automated, bi-directional systems operating at machine speed with continuous synchronization between physical assets and their digital counterparts [6, 10]. In cybersecurity, DTs are commonly used as safe proxies for attack emulation and countermeasure testing without disrupting operational systems [2, 11]. A closely related research stream originates from predictive maintenance, where anomaly detection identifies early deviations in system behavior preceding faults. Similar mechanisms are now applied to cybersecurity scenarios, where abnormal behavior results from adversarial activity rather than gradual component degradation. Several studies demonstrate anomaly and intrusion detection in cyber–physical systems using DT telemetry or specification-based models. Gaikwad et al. [1] show that DT integration in additive manufacturing environments enables anomaly detection through machine-learning analysis of IoT sensor metadata, while Balta et al. [12] employ Signal Temporal Logic (STL) specifications within DT models to detect violations in CPS behavior. Such approaches demonstrate that DTs can capture abnormal operational patterns, including attacks that intentionally induce physical faults through process manipulation or control tampering. Complementary work focuses on predictive modeling of CPS signals. Kummerow et al. [13] introduce dynamic digital models capable of identifying abnormal behavior by comparing simulated and historical signal trends. Datta et al. [14] extend this idea through large-scale “digital duplication,” where swarms of DT instances analyse patterns supporting fault and intrusion detection. While effective for behavioral monitoring, these approaches primarily rely on signal comparison or statistical analysis rather than structured semantic reasoning. Intrusion detection using DT specifications has also been explored by Eckhart and Ekelhart through CPS Physical Twinning, which treats system inputs and runtime behavior as security-relevant indicators and detects intrusions by comparing observed signals with specification-derived DT behavior [15]. Subsequent extensions enable DT generation from CPS specifications and introduce capabilities such as rule-based monitoring, visual alerts, and record-and-replay recovery mechanisms [4, 16]. Although these approaches provide explainable rule-based detection, they largely rely on specification matching and do not integrate semantic knowledge across heterogeneous CPS assets. A complementary research direction argues that effective security-oriented DTs require semantic, machine-readable vocabularies such as RDF and OWL to unify

6

Table 1: Comparative analysis of related works against HySecTwin. Related Works

Semantic Model

Rule Reasoning

Hybrid Reasoning

Explainable

Perf. Eval.

Balta et al. [12] Balta et al. [20] Eckhart [15, 16] Empl et al. [18] Varghese et al. [3] HySecTwin

N N N Y N Y

N P Y Y Y Y

N N N N N Y

P P Y Y P Y

P P N N P Y

Legends: Y = Yes, N = No, P = Partially done.

heterogeneous assets, data flows, and policies. Semantic modeling enables interoperability, explainability, and tool reuse by providing a shared representation layer across CPS components [6, 17]. Without such semantics, DTs struggle to support systematic policy reasoning or automated decision-making. Accordingly, ontologies and knowledge graphs are increasingly adopted to enhance DT interoperability and reasoning. Systematic studies highlight both the promise of semantic technologies and the lack of standardised modeling practices and operational reasoning integration in current DT implementations. Knowledge graph approaches unify heterogeneous DT data sources and enable inference and contextual enrichment, yet are often evaluated in manufacturing or infrastructure scenarios rather than cybersecurity applications. In security-focused contexts, semantic DT frameworks such as Digital Twin-based Security Analytics (DT2SA) integrate ontological structures, behavioral models, and security analytics to generate shareable cybersecurity knowledge for IoT ecosystems. These frameworks provide valuable architectural contributions but remain primarily architectural or microservice-oriented and do not evaluate reasoning performance under realistic CPS workloads [18]. Similarly, federated semantic DT approaches combining DTs, ontologies, and rule-based reasoning point toward integrated security automation pipelines but remain conceptual and lack empirical validation at operational scale [19]. Beyond direct security applications, the Semantic Sensor Web literature demonstrates how the semantic annotation of sensor and CPS data enables expressive representation and formal analysis of heterogeneous signals, offering potential synergies for DT telemetry enrichment and CPS semantic integration. However, practical integration of such semantic layers with DT reasoning engines for real-time security analysis remains underdeveloped. Reasoning over DT knowledge typically follows three approaches. Deterministic rule engines provide explainable analysis over structured facts [4, 15, 16], while fuzzy inference supports graded judgments under uncertainty or noisy signals [12]. Machine-learning methods analyse DT telemetry to detect behavioral patterns and anomalies, though they often lack causal explainability and operate on data without semantic categorization [1, 20]. Consequently, most existing studies employ these techniques independently rather than combining them within unified hybrid reasoning architectures.

7

Gap and Positioning. Despite advances in DT-based monitoring and semantic technologies, existing research lacks a comprehensive DT pipeline that simultaneously (i) semantically encodes the security-relevant CPS structure in a unified, machine-readable form and (ii) integrates hybrid reasoning, combining deterministic (Rete-based) rules with fuzzy inference evaluated under CPS-style workloads. As summarized in Table 1, prior studies address selected capabilities, whereas HySecTwin unifies semantic modeling and hybrid reasoning of CPS twins for security analysis. This work addresses this gap by presenting a semantically grounded DT substrate integrated with hybrid reasoning engines and evaluating their performance under reproducible security-focused scenarios. This enables the system to execute automated reasoning over CPS operational behavior rather than relying solely upon rule-based anomaly detection.

3 Background Building on the problem formulation and research gaps identified in Sections 1 and 2, this section consolidates the conceptual foundations required for the proposed framework.

• Physical twin (PT): within CPS environments, the PT represents the operational CPS composed of interconnected IoT-enabled devices, including sensors, actuators, controllers, and communication interfaces deployed in critical infrastructures. These IoT components continuously sense environmental and operational conditions (e.g., illumination, temperature, humidity) and exchange telemetry through lightweight communication protocols, enabling real-time monitoring and control. The PT , therefore, captures the actual runtime state of the CPS and constitutes both the primary source of operational telemetry and the principal target of adversarial manipulation, including remote-access abuse, command execution, configuration tampering, and logical–physical inconsistencies. Effective cybersecurity monitoring must, therefore, interpret behavioral deviations jointly across cyber interactions and physical process contexts. • Digital twin: a digital twin is a dynamic virtual representation of the PT of a CPS that remains synchronized with its operational counterpart through continuous bidirectional data exchange, enabling monitoring, simulation, state analysis, and decision support without directly affecting physical operations [19, 21]. • Cybersecurity risks: complex CPS environments comprise heterogeneous devices, distributed control components, and tightly coupled cyber–physical processes, making them attractive targets for adversarial manipulation. Attackers may exploit remote access paths, alter device configurations, disrupt control logic, or induce logical–physical inconsistencies, complicating root-cause attribution due to operational complexity and noisy system behavior. DTs support cybersecurity monitoring by enabling unified observation and analysis of distributed behavior without affecting operations [17, 22]. However, DT -enabled monitoring also introduces twin-specific risks: adversaries may manipulate telemetry to induce incorrect twin states, exploit mismatches between physical and digital behavior, or misuse DT interfaces to expand attack reach across interconnected components. These challenges motivate 8

Security Digital Twin perspectives that embed explainability and trustworthy interpretation mechanisms as essential for reliable operational decision-making [19, 23, 24]. • Semantic representation of CPS state: within DT-enabled CPS pipelines, operational device data are transformed into structured, machine-interpretable representations. Semantic modeling encodes device attributes, relationships, and runtime conditions as assertions [25–27], enabling reasoning engines to work over fact bases rather than raw sensor values. These representations promote interoperability across heterogeneous CPS components and ensure consistent interpretation of operational behavior within the DT [17]. The resulting semantically enriched system state forms a fact base F that captures device conditions and relevant process context for cybersecurity interpretation. On this foundation, DT -enabled security analytics support intelligent reasoning to monitor behavior and detect anomalies under evolving conditions. Deterministic rules and fuzzy inference systems offer explainable interpretations of deviations, while newer decision-support approaches combine data-driven reasoning to improve situational awareness. Recent work underscores the role of semantically enriched Security Digital Twins in design-time and run-time security analytics [19] and highlights explainable AI for trustworthy, interpretable DT -driven cybersecurity decisions [24]. Integrating deterministic and data-driven reasoning in DT operations enables coordinated anomaly detection, threat diagnosis, and mitigation across complex CPS environments. • Digital twin and security reasoning: maintaining CPS security in dynamic environments requires reasoning beyond rigid rule-based criteria. DTS enable unified observation of CPS behavior and support anomaly detection by analysing operational states with deterministic rules and hybrid inference. To formally relate DT observations to cybersecurity outcomes, the DT is treated as a structured evidence substrate capturing time-indexed system observations. Let ot denote PT and DT observations at time t (e.g., sensor readings, device states, network reachability, control actions). A semantic lifting function ϕ(·) maps these observations to a machine-interpretable fact base Ft = ϕ(ot ), which is evaluated against a rule base R via deterministic inference ID (Ft , R), yielding explainable detections of explicit violations or logical inconsistencies, consistent with DT-based rule-driven monitoring [4, 19, 22, 28]. When uncertainty or gradual deviations occur, ot is also encoded as a behavioral feature vector ⃗xt , enabling graded inference via hybrid reasoning IH (⃗xt ) to support detection under noisy or ambiguous conditions [12, 20]. Recent work shows that semantically enriched Security Digital Twins support both design-time and runtime security analytics [19, 28], while explainable AI techniques increase trust and interpretability in DT-driven cybersecurity decisions [24]. Aligning deterministic and data-driven reasoning within DT operations thus enables coordinated anomaly detection, threat diagnosis, and mitigation in complex CPS environments. Semantic DT behavioral models, combined with CPS telemetry and hybrid reasoning, provide the analytical foundation for DT-based cybersecurity monitoring. Section 4 builds on these foundations to present an architecture that integrates these components into a deployable CPS security monitoring framework.

9

These foundational concepts inform the design of the HySecTwin framework, as described in the following section.

4 HySecTwin: Hybrid Reasoning Security Framework This section presents the HySecTwin framework as the practical realization of concepts introduced in Section 3, describing how the Physical Twin (PT ), Digital Twin (DT ), semantic modeling, and reasoning components are integrated into a deployable system. The prototype implementation was deployed using containerized services to ensure reproducibility of the experimental environment. The system components, including the DT platform, hybrid reasoning engine, and supporting middleware, were deployed within a controlled test-bed environment designed to emulate a cyber–physical IoT network. This evaluation focuses on demonstrating the feasibility of integrating DT technologies with hybrid reasoning technology for cybersecurity monitoring. While this experimental build does not intend to provide exhaustive benchmarking, it does establish the functional viability of the architecture within a representative CPS environment. Three development tracks were evaluated for constructing HySecTwin:

• Option 1 : Physical Twin → Digital Twin → Semantic Model → Reasoning Engine, where semantic representations are derived from CPS-synchronized DT data. Twin → Semantic Model → Reasoning Engine. Semantic models were derived directly from CPS data. • Option 2 : DT framework → Semantic Model → Physical Twin → Reasoning Engine. This approach supported rapid prototyping but introduced inconsistencies between virtual and physical assets requiring later correction. • Option 3 : Semantic Model → DT → Physical Twin → Reasoning Engine. This ontology-first strategy proved inefficient due to the absence of operational device data needed to ground semantic and functional modeling. Option 1 was adopted, as constructing the DT directly from real CPS telemetry provides an accurate foundation from which semantic models and reasoning rules are derived. Using machine-readable CPS data improves DT fidelity and enables effective integration with the hybrid reasoning engine. The HySecTwin (Hybrid Inference, Security Monitoring, CPS Twin Integration) framework introduces an integrated security intelligence layer that combines semantic modeling, deterministic reasoning, and fuzzy inference to enable real-time monitoring and anomaly detection through bidirectional PT–DT interaction. Specifically, HySecTwin integrates (i) OWL2RL-compliant RDF semantic models for structured CPS monitoring from digital twin, (ii) deterministic reasoning implemented via the durable rules engine, and (iii) uncertainty-aware fuzzy reasoning using the FuzzyLite library.

10

Fig. 1: HySecTwin framework architecture illustrating physical twin (PT) integration with the digital twin (DT) , semantic modeling, and hybrid reasoning engines enabling intelligent cybersecurity decision making for CPS physical twin.

4.1 Framework Components Following the preferred development sequence illustrated in Fig. 1, we describe the framework components, progressing from physical twin construction to digital twin integration, semantic modeling, and hybrid reasoning.

4.1.1 CPS Physical Twin A CPS PT in this work represents a smart lighting CPS composed of multiple interconnected IoT devices forming the real-world operational infrastructure depicted in Fig. 1. These include sensors, actuators, controllers, and communication interfaces that collectively support the digital twin by providing real-time data for control, monitoring, and decision-making, thereby accurately reflecting the system’s physical state and behavior. This research simulates a smart building CPS physical twin featuring IoTbased control of lighting, temperature, and humidity IoT devices communicate through a Zigbee mesh connected via IEEE 802.15.4 gateways for real-time data collection [29], in which device telemetry is streamed through an MQTT-based publish-subscribe architecture to enable continuous synchronization with the digital twin. Through this publish-subscribe (PUB/SUB) pipeline, devices continuously stream status updates for real-time monitoring and control. A web-based GUI lets operators adjust thresholds and device states. Sensor nodes start from initial configurations (e.g., lights on) and adapt to local conditions (e.g., activating under low illumination). System behavior arises from both individual device responses and coordinated node interactions. Table 2 summarises CPS Physical Twin component behaviors under varying operating conditions.

11

Table 2: CPS Physical Twin behaviors CPS Physical Twin (IoT Sensor Nodes and States) Initial states

Sensor Nodes

IoT Sensor Nodes

Behavior Description When the CPS PT is powered up or turned on the state of all sensor nodes initialise to the default state. IoT sensor nodes begin collecting data from its sensors. The illumination node starts the initial intensity levels If the IoT sensor node detects low occupancy and low ambient light: The sensor nodes turn on to provide sufficient illumination. If occupancy remains low, but ambient light increases: The sensor nodes gradually dim to save energy. If the IoT sensor node detects high occupancy: The sensor nodes turn on to full brightness IoT Sensor nodes (e.g., illumination, temperature, and humidity sensors) continuously collect data (e.g., illumination, temperature, and humidity metadata). These IoT node sensors then send sensor data to the CPS physical twin for analysis and decision-making.

4.1.2 CPS Digital Twin Our framework uses a CPS DT as a dynamic virtual representation of the PT, which includes IoT devices such as Zigbee lights, sensors and switches within a smart lighting system. The DT mirrors these devices for real-time monitoring, control, and security analysis. PT data is streamed via MQTT 3.1 in a publish–subscribe model, mapping each device to a digital counterpart. The Eclipse Ditto [30] DT platform was chosen for its extensibility, lightweight integration, and strong messaging features, key to our research needs, over Amazon TwinMaker [31] and Azure DT [32]. Ditto uses Live and Twin Channels: Live Channel streams real-time data for the reasoning engine, while Twin Channel enables passive synchronization for analysis and threat simulation. Together, these channels create a feedback system integrating operational data with semantic inference, enhancing cyber–physical security. The DT is generated from a JSON structure that specifies the behavior of each IoT device within the CPS of the corresponding physical twin. These devices have static attributes such as the model, manufacturer, and ID, together with dynamic features such as ON/OFF status, brightness, and temperature. These objects emulate physical sensors, enabling semantic inquiries and coordinated behavior. Listing 1 presents a node labeled “Color temperature light 2” featuring real-time data. The DT is composed of: a Concierge for data cohesion; a Connectivity module facilitating PT and DT integration through MQTT and gateways; a Gateway ensuring secure REST and WebSocket API communications; and a Thing-Search for efficient indexing and querying. These modules support proactive, context-aware control and monitoring in real-time. The JSON format is used to convey changes in device status, enhancing oversight, management, and prompt anomaly detection while supporting pre-rollout testing of updates and security shifts.

12

Listing 1: An extract of “Color temperature light 2” node status (CPS Digital Twin) 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

" attributes " : { " project " : " Lightswitch " }, " features " : { " lights " : { "2": { " colorcapabilities " : 1 6 , " ctmax " : 4 5 4 , " ctmin " : 2 5 0 , " etag " : " 0 f 1 f 5 1 1 fe 2 9 5 8 5 2 1 4 3 7 c 2 6 2 9 4 0 7 3 4 eb 0 " , " hascolor " : true , " lastannounced " : " 2 0 2 3 -0 3 -2 6 T 0 4 : 3 8 : 2 4 Z " , " lastseen " : " 2 0 2 3 -0 3 -2 6 T 0 8 : 2 6 Z " , " manufacturername " : " IKEA of Sweden " , " modelid " : " TRADFRIbulbE 2 7 WSglobeopal 1 0 5 5 lm " , " name " : " Color temperature light 3 " , " state " : { " alert " : " none " , " bri " : 3 6 , " colormode " : " ct " , " ct " : 2 5 0 , " on " : true , " reachable " : true }, " swversion " : " 1 . 0 . 0 1 2 " , " type " : " Color temperature light " , " uniqueid " : " 0 4 : cd : 1 5 : ff : fe : c 8 : aa : 6e - 0 1 " } } }

4.1.3 The Semantic Model Within the HySecTwin framework, the semantic model serves as the formal integration layer linking the physical twin (PT ), the digital twin (DT ), and the hybrid reasoning engine. It provides machine-interpretable representations of IoT device attributes and behaviors by transforming CPS telemetry into structured, semantically enriched data suitable for automated reasoning. Device metadata and runtime states are extracted from the CPS network via the ConBee III gateway and deCONZ, and encoded in JSON format to enable real-time mapping between physical sensor data and corresponding DT entities. The modeling process follows a data-grounded approach in which operational attributes and state transitions are captured as structured JSON objects. This approach is widely adopted in digital twin ecosystems to support interoperable data integration across domains such as manufacturing, autonomous systems, and cybersecurity [28, 33, 34]. Within HySecTwin, these representations are semantically formalized using the Smart Applications REFerence Ontology (SAREF), which defines a shared vocabulary for CPS entities, including Device, Function, State, Property, and UnitOfMeasure. Where required, lightweight Description Logic extensions are introduced to preserve reasoning tractability within the hybrid inference pipeline [35]. The semantic layer is implemented as an RDF knowledge graph aligned with SAREF. Static attributes (e.g., manufacturerName, modelId, uniqueId) and dynamic

13

Fig. 2: SAREF-based abstract semantic model representing CPS device relationships enriching Digital Twin.

properties (e.g., state.on, brightness, temperature, reachable) jointly constitute the operational fact base underpinning the DT representation in Eclipse Ditto. Figure 2 illustrates a representative ontology segment in which CPS entities such as Device, Sensor, and Actuator are interconnected through functional, state, and measurement relationships derived from SAREF semantics. This structure enables coherent modeling of both static device characteristics and evolving runtime conditions, supporting multi-hop reasoning across device behavior, control actions, and environmental observations. The semantic model maintains synchronized primary (active) and secondary (passive) DT views, aligned with the PT and mapped to live and twin

Fig. 3: Semantic Model and HySecTwin Reasoner

14

Fig. 4: Cybersecurity reasoning in HySecTwin: deterministic rule evaluation (left) and hybrid fuzzy-enhanced risk assessment (right).

channels for real-time and historical analysis. By deriving semantics directly from CPS telemetry, the model remains tightly coupled to the physical system while ensuring consistency and interoperability across heterogeneous components. This unified representation provides a coherent knowledge base that enables the hybrid reasoning engine to process streaming data, enforce deterministic rules, and perform fuzzy inference for cybersecurity analytics.

4.1.4 The Reasoning Engine The reasoning engine constitutes the analytical core of HySecTwin, transforming the semantically structured CPS twin (PT) representation (Section 4.1.3) into actionable cybersecurity intelligence. The reasoning engine employs Forward and Fuzzy reasoners, refer to Fig. 3, integrated with the semantic model. Instead of operating on raw telemetry, the engine consumes a normalized fact base F , derived from SAREF-aligned semantic assertions exported by the DT , consistent with the semantic lifting of CPS observations into machine-interpretable facts. Device states, operational context, and security-relevant attributes are encoded as typed assertions (e.g., Unauthorized Command = true, Firmware Integrity = degraded, Network Traffic Rate = 850 pps), enabling consistent reasoning across heterogeneous CPS components. Fig. 4 presents the two complementary inference mechanisms implemented in HySecTwin: deterministic rule-based reasoning and hybrid fuzzyenhanced reasoning.

15

Deterministic Reasoning. Deterministic inference is designed to identify explicit security violations through rulebased evaluation of the fact base. HySecTwin employs the durable rules framework, implementing a Rete-based forward-chaining mechanism for efficient evaluation over streaming CPS data [36, 37]. Rules are defined as follows: ri : IF (C1 ∧ · · · ∧ Ck ) THEN A where Ci ∈ F , aligning with rule-driven DT monitoring of CPS behavior, and the inference process is formalized as ID : F × R → {0, 1}, producing binary outcomes that indicate policy violations. This enables low-latency and explainable detection of unauthorized state transitions, firmware integrity breaches, and abnormal traffic thresholds. Hybrid Fuzzy-Enhanced Reasoning. To capture uncertainty and gradual deviations inherent in CPS environments, HySecTwin extends deterministic inference with fuzzy reasoning [38–40]. The semantic attributes in F are mapped to a feature vector ⃗x ∈ Rk , enabling a graded behavioral representation of CPS conditions. Membership functions transform these values into degrees of truth, µ(⃗x) ∈ [0, 1] , which are aggregated to compute an overall compromise score consistent with hybrid reasoning for uncertain CPS behavior. The resulting inference is defined as follows: ( 1, µ(⃗x) ≥ θ, IH (⃗x) = 0, otherwise. This enables detection of ambiguous or evolving threats, such as progressive firmware degradation or coordinated traffic anomalies, using confidence-weighted assessments. Sharing a common semantic foundation, the two inference modes form a unified reasoning pipeline: deterministic reasoning provides precise, auditable detection of explicit violations, while fuzzy inference increases sensitivity to uncertain, context-dependent behaviors. Together, they create a closed-loop cyber–physical analysis process in which semantically enriched digital twin observations are continuously evaluated to produce interpretable alerts and risk-aware insights, delivering a scalable, explainable, and robust cybersecurity capability aligned with CPS (PT ) operational constraints.

5 Case Study: Framework Experimentation Building on the proposed frmaework defined in Section 4, this section evaluates how the integrated Physical Twin, Semantic Model, Digital Twin (DT), and Reasoning Engine operate as an intelligent cybersecurity system. While prior sections describe data capture and representation, here we assess how reasoning transforms CPS telemetry into actionable security insights. HySecTwin is evaluated using campaign-inspired

16

scenarios based on MITRE ATT&CK C0012 (Dragonfly 2.0)1 , a representative CPSfocused threat campaign. The experiments demonstrate detection performance under deterministic and hybrid reasoning modes within a fully containerised testbed.

5.1 Methods and Measurement Protocol Objectives. The evaluation is designed to measure: (i) end-to-end latency from message publication to persistence, (ii) internal pipeline latencies, (iii) throughput under controlled load, and (iv) the effect of fuzzy scoring on alert confidence and computational cost. Experimental Setup. The evaluation is conducted in a containerized environment on Ubuntu 22.04, integrating Eclipse Ditto, (MQTT broker), the Durable Rules worker, an optional FuzzyLite scorer, MongoDB, InfluxDB 1.8, and Grafana. MQTT communication [41, 42]. Synthetic workloads are generated using scripted MQTT publishers and k6 (xk6-mqtt), enabling controlled and repeatable traffic patterns.

5.2 Performance Evaluation Strategy To assess the practical viability of HySecTwin, we evaluate both its baseline efficiency and its behavior under increasing operational stress. The objective is to determine not only how the system performs under nominal conditions but also how it responds when exposed to sustained and intensified telemetry streams. Benchmarking establishes reference performance under controlled and repeatable workloads. It characterizes normal system behavior, including latency and throughput under steady-state conditions, and provides a stable baseline against which subsequent experiments can be compared. Load testing progressively increases traffic intensity to examine scalability and robustness. This evaluation mode is particularly important in cyber-physical systems, where reliability under concurrent data streams is critical for maintaining operational stability and security monitoring continuity [43]. By observing performance degradation trends and saturation points, load testing validates whether the Digital Twin and reasoning pipeline remain dependable under realistic operational pressure. Workloads (including smoke load). Telemetry replay follows Eclipse Ditto topic conventions: cps/<thingId> (active twin channel) and twin/<thingId> (persisted twin channel). Each message carries a source timestamp (ts ms) to enable precise latency measurement across the CPS–DT –reasoning pipeline. Before formal benchmarking, a short smoke load is executed at low intensity. This preliminary step verifies end-to-end connectivity, database persistence, and instrumentation accuracy, thereby preventing experimental bias caused by configuration or deployment errors. Once system correctness is confirmed, controlled workload sweeps are performed to measure steady-state latency and throughput under both baseline and stress conditions. 1

https://attack.mitre.org/groups/G0035/

17

Table 3: Technical Workload Parameters Workload Type

Traffic Characteristics

Technical Parameters

Smoke Load

Very low intensity validation

1–5 VUs, 60–180 s duration, 1– 5% peak publish rate, Mongo insert success ≥99.9%

Benchmark Baseline

Fixed, controlled traffic

Constant VUs, steady-state execution window, stable publish rate

Load Sweep

Increasing stress profile

Progressive VU scaling, extended duration, increased publish rate

Metrics. System performance is characterized through stage-wise and end-to-end latency measurements across the CPS–Digital Twin–reasoning pipeline. These measurements allow us to isolate where delays occur and to quantify how long telemetry takes to propagate through the full monitoring loop. Let tsrc , trules , and tdb denote the source timestamp embedded in the payload, the time of rule ingestion, and the time of successful database persistence, respectively. We compute three latency components as follows:

∆emqx→rules ,

∆rules→db ,

∆end .

These correspond to message ingestion delay, processing-to-persistence delay, and total end-to-end latency. For each configuration, we report p50 and p95 latency (capturing typical and near-worst-case behavior), mean latency, throughput (messages/s), MQTT round-trip time, and MongoDB CRUD performance in a YCSB-style format [44]. Collectively, these indicators reveal both efficiency and operational stability of the reasoning pipeline under benchmark and stress conditions.

Hybrid scoring. In Hybrid mode, FuzzyLite returns a confidence value in [0, 1], representing the inferred degree of compromise or anomaly. Scores are grouped into {low, med, high} bands to support interpretable analysis. This enables evaluation not only of processing speed but also of detection certainty, providing insight into the trade-off between responsiveness, robustness, and explainability in cybersecurity monitoring. Standards alignment and reproducibility. The evaluation methodology aligns with NIST SP 800-82 guidance for industrial control systems [43] and the measurement principles of SP 800-55 [45]. Each configuration is executed three times under steady-state conditions, with consistent parameters, to ensure statistical reliability and reduce variability. This approach strengthens the validity and reproducibility of the reported results.

18

5.3 Use Case 1: Deterministic Baseline (C0012) The first use case establishes a cybersecurity performance baseline by deploying the durable rules engine in isolation under the MITRE ATT&CK Dragonfly 2.0 campaign (C0012). Dragonfly represents a real-world advanced persistent threat targeting critical infrastructure, including credential harvesting, remote access, and command execution techniques. As such, it provides a realistic benchmark for evaluating rulebased CPS threat detection. Telemetry tagged with campaign=C0012 was processed over a 48-hour observation window to simulate sustained operational exposure. The deterministic engine applied crisp, pre-defined rules mapped to campaign behaviors, producing binary detections aligned with known attack signatures. Evaluation focuses on latency statistics (mean, p50, p95, p99), alert volume, and risk-band distribution. From a cybersecurity perspective, this use case measures the system’s ability to rapidly and reliably detect well-defined attack patterns while maintaining low processing overhead. The results establish a reference for response time, detection consistency, and computational efficiency in a rule-governed CPS security context.

5.4 Use Case 2: Hybrid Engine Across Campaigns The second use case evaluates a hybrid reasoning setup combining deterministic durable rules with FuzzyLite-based fuzzy inference. Unlike the single-campaign baseline, it introduces diverse adversarial behaviors across four MITRE ATT&CK campaigns: C0012 (credential-based intrusion), C0020 (multi-stage spearphishing), C0025 (cloud-based data exfiltration), and C0028 (custom malware and C2). Telemetry from these campaigns was ingested concurrently over 72 hours to simulate complex, overlapping cyber threats in CPS (PT ) environments, including stealthy, staged, and partially observable attacks. The evaluation compares latency, confidence distributions, detection stability, and inference consistency across campaigns and engines. Deterministic rules enable fast, explainable detection of explicit policy violations, while fuzzy inference provides graded confidence for ambiguous, gradual, or multi-signal anomalies. This use case therefore examines detection speed, adaptive threat interpretation, and resilience under heterogeneous attack patterns. The results show that hybrid reasoning improves situational awareness, mitigates blind spots in rigid rule systems, and increases robustness in CPS DT deployments.

6 Evaluation This section evaluates the HySecTwin framework using the cyber-physical use cases defined in Section 5. The evaluation focuses on three dimensions: (i) CPS-DT performance and latency behavior, (ii) the consistency of digital twin synchronization, and (iii) the effectiveness of the reasoning engine in detecting cyber-physical anomalies mapped to MITRE ATT&CK campaigns. Quantitative results are reported using latency, throughput, and detection-time metrics. Tables provide the primary record for reproducibility and statistical validity, while figures illustrate distributional trends and comparative behavior across reasoning modes.

19

Fig. 5: TTP to Threat Mapping

6.1 Benchmark Scope and Use-Case Mapping The experimental use cases are grounded in benchmark adversarial campaigns and ATT&CK techniques mapped to observable threats in the lightswitch CPS domain. These scenarios provide a consistent basis for evaluating nominal and malicious behavior introduced in Section 5. As shown in Fig. 5, campaign C0012 (Dragonfly 2.0) includes techniques such as T1059, T1112, and T1021.002, corresponding to malicious command execution, configuration tampering, and unauthorized remote access. Campaign C0025 is linked with T0850, representing digital twin state spoofing and logical–physical inconsistencies. Accordingly, UC1 captures direct control-oriented attacks with explicit state mismatch effects, whereas UC2 captures more complex behaviors including spoofed telemetry, command-and-control-like toggles, logical–physical inconsistencies, and suspicious data transmission. Table 4 and Fig. 5 summarize these mappings, linking system metrics (latency, throughput) with cybersecurity outcomes (detection time, accuracy, and confidence).

6.2 Performance and Load Evaluation The framework was evaluated to determine whether continuous CPS (PT ) monitoring and twin-state updates can be achieved without degrading operational timing behavior. Tables 5 and 6 report end-to-end latency for the Live (physical CPS) and Twin (digital twin) channels. Across all devices, median latency remains approximately 0 ms, while P95/P99 values stay within 1 ms with low jitter, indicating deterministic and stable execution under both nominal and adversarial conditions. Figure 6 shows that latency distributions are closely aligned across both channels, confirming that the twin channel preserves the temporal characteristics of the physical process with negligible overhead.

20

Table 4: Use-case to lightswitch-domain mapping used to operationalise campaigninspired behaviors. Note: C00xx are ATT&CK Campaign IDs; techniques are referenced separately in the evaluation. Use case

ATT&CK object

Lightswitch-domain symptom (observable)

UC1

C0012 (Dragonfly 2.0)

UC2

C0020, C0025, C0028

Unauthorised remote control of a light; unexpected command execution; configuration tampering causing state mismatch (reported state versus physical context). Mixed behaviors across campaigns: periodic command/controllike toggles (C2 behavior), logical–physical mismatch (e.g., “reported OFF with low lux” or spoofed twin state), and suspicious data transmission patterns indicative of exfiltration-like behavior (e.g., excessive telemetry bursts or feature writes).

Table 5: Live channel latency (ms). thingId live/00-15-8d-00-05-48-e4-7c-01-0006/state live/00-21-2e-ff-ff-0e-19-2c-01/state live/04-cd-15-ff-fe-c8-aa-6e-01/state live/04-cd-15-ff-fe-c8-c0-12-01/state live/b4-e3-f9-ff-fe-a0-c1-b7-01/state live/b4-e3-f9-ff-fe-a6-65-90-01/state

N 1 1 17 17 22 30

Mean 0.00 0.00 0.24 0.41 0.27 0.40

Median 0.00 0.00 0.00 0.00 0.00 0.00

P95 0.00 0.00 1.00 1.00 1.00 1.00

P99 0.00 0.00 1.00 1.00 1.00 1.00

Min 0.00 0.00 0.00 0.00 0.00 0.00

Max 0.00 0.00 1.00 1.00 1.00 1.00

Table 6: Twin channel latency (ms). thingId

N

Mean

Median

P95

P99

Min

Max

Jitter

twin/...19-2c-01/state twin/...aa-6e-01/state twin/...c0-12-01/state twin/...c1-b7-01/state twin/...65-90-01/state

1 17 17 22 30

0.00 0.24 0.35 0.27 0.27

0.00 0.00 0.00 0.00 0.00

0.00 1.00 1.00 1.00 1.00

0.00 1.00 1.00 1.00 1.00

0.00 0.00 0.00 0.00 0.00

0.00 1.00 1.00 1.00 1.00

– 0.44 0.49 0.46 0.45

The results collectively show that the Digital Twin synchronization, semantic processing, and reasoning pipeline preserve low-latency operation across both channels. This satisfies industrial control timing expectations, such as those outlined in NIST SP 800–82, where bounded latency and stable temporal behavior are essential for safe and secure operation. For HySecTwin, these findings establish a reliable performance foundation for subsequent analysis of detection accuracy and cybersecurity effectiveness.

6.3 Cyber Threats Detection Analysis This subsection evaluates the effectiveness of the reasoning engine in detecting benchmark cyber threats represented through campaign-driven CPS attack scenarios. The analysis compares deterministic (durable rules) and hybrid reasoning configurations

21

Jitter – – 0.44 0.51 0.46 0.50

Fig. 6: Latency and jitter comparison across Live and Twin channels.

Table 7: Latency summary (Mongo/Influx). Metric

UC

Channel

Count

Mean

Median

P95

P99

Min

Max

lat end ms lat rules db ms mongo insert ms lat end ms lat rules db ms mongo insert ms

UC1+UC2 UC1+UC2 UC1+UC2 UC1+UC2 UC1+UC2 UC1+UC2

live live live twin twin twin

56940 56940 56940 56940 56940 56940

5.00 3.25 2.00 5.10 3.30 2.05

5.00 3.25 2.00 5.10 3.30 2.00

5.90 3.93 2.80 5.98 3.95 2.85

5.98 3.99 2.98 6.05 4.00 2.99

4.0 2.5 1.5 4.0 2.5 1.5

6.0 4.0 3.0 6.0 4.0 3.0

using detection latency as the primary performance indicator across UC1 and UC2 conditions. Table 8 presents the mapping between ATT&CK campaigns, TTPs, and CPS-observable behaviors used as the evaluation ground truth. These mappings operationalize cyber-physical attack semantics and provide a consistent basis for interpreting detection outcomes. Comparative results in Table 9, annotated with NIST CSF categories, show that the hybrid configuration consistently achieves lower detection latency than the deterministic baseline while preserving stable execution behavior. Table 10 further provides a focused comparison for campaign C0012 (TTP: T0801), where the reduction in detection time is clearly evident. Figure 7(a) compares detection times across campaigns and reasoning modes, while Fig. 7(b) quantifies the percentage reduction achieved by the hybrid engine. Figure 7(d) provides the detailed comparison for campaign C0012. Latency distributions in Fig. 7(c) show that the hybrid reasoning engine achieves lower mean detection latency with reduced variance, indicating improved responsiveness in CPS threat detection. The relative improvement is quantified as: Improvement (%) =

TDurable − THybrid × 100 TDurable

22

Fig. 7: HySec-DT threats detection analysis.

Figure 7(b) reports detection-time reductions of 16.52% for campaign C0012 and 21.56% for campaign C0025. These gains are achieved without introducing measurable system overhead. Figure 8(a)–(c) shows that end-to-end latency, rules-to-database processing, and MongoDB insert latency remain closely aligned between Live and Twin channels. Under sustained load, Fig. 8(d) further demonstrates stable throughput and consistent average versus median latency behavior across both scenarios. These results demonstrate that combining deterministic rules with fuzzy inference improves detection capability, particularly for ambiguous and multi-signal cyber–physical behaviors. The outputs align with NIST CSF categories (DE.DP-5 and RS.RP-1 ), supporting both enhanced detection and effective response execution in operational CPS environments.

7 Discussion 7.1 Interpretation of Results The experimental evaluation shows that HySecTwin can support cybersecurity monitoring in CPS environments while preserving the timing constraints required for stable operation. Across the assessed scenarios, both PT and DT channels maintained 23

Table 8: TTP-to-threat mapping for benchmark campaigns Campaign

TTP

C0012 C0012 C0012 C0025 C0025

T1021.002 T1059 T1112 T0850 T0850

Threat Type Unauthorized remote access to light device via SMB Malicious command execution affecting device state Registry/configuration tampering to misreport state Logical–physical state mismatch: light reported off with low lux Digital twin state spoofing: light reported on while off

Table 9: NIST-tagged benchmark results for Durable Rules and Hybrid reasoning engines Engine

Campaign

TTP

Detection Time (ms)

CSF Tag

Timestamp

Durable Hybrid Durable Hybrid

C0012 C0012 C0025 C0025

T0801 T0801 T0850 T0850

45.67 38.12 52.34 41.08

DE.DP-5 RS.RP-1 DE.DP-5 RS.RP-1

2025-06-18 14:05:12 2025-06-18 14:05:12 2025-06-18 14:08:27 2025-06-18 14:08:27

Table 10: Comparative detection times and NIST CSF alignment for campaign C0012 (TTP: T0801) Engine

Campaign

TTP

Detection Time (ms)

CSF Tag

CSF Description

Durable

C0012

T0801

45.67

DE.DP-5

Hybrid

C0012

T0801

38.12

RS.RP-1

Detection processes are continuously improved Response plan is executed during or after an incident

tightly bounded latency, minimal processing divergence, and stable throughput under sustained load. This indicates that semantic reasoning can be integrated into the monitoring pipeline with negligible overhead, while most delay arises from communication and data persistence rather than inference. These findings provide the performance foundation for the broader results discussed below. Performance robustness. From a systems perspective, the results confirm that the proposed framework maintains predictable and stable performance across both nominal and adversarial conditions. The close alignment between physical and Digital Twin channels indicates that analytics executed within the twin environment can proceed concurrently with CPS operation while preserving temporal consistency. This demonstrates that the framework can provide continuous security visibility without disrupting core control processes. Hybrid reasoning effectiveness. The evaluation also highlights the benefits of combining deterministic and fuzzy inference mechanisms. Compared with deterministic rules alone, the hybrid reasoning engine achieves faster threat recognition and more stable detection behavior across benchmark campaigns. This suggests that integrating crisp rule logic with graded reasoning improves sensitivity to weak, partial, or evolving indicators of compromise. Such behavior is particularly valuable in CPS environments,

24

Fig. 8: Digital twin performance analysis.

where malicious activity may emerge gradually through subtle state deviations rather than explicit rule violations. Behavioral fidelity of the Digital Twin. The results further indicate that the Digital Twin provides a sufficiently faithful representation of CPS operational behavior to support cybersecurity analytics. Multiple IIoT devices, sensing states, actuation events, and environmental variables were represented through the semantic model, enabling reasoning over interactions rather than isolated signals. The close correspondence between physical and twin performance characteristics suggests that state transitions are mirrored consistently, allowing the twin to function as a trustworthy analytical substrate for monitoring and threat interpretation. Cybersecurity analysis of complex CPS. The experiments demonstrate that the framework can support higher-level cybersecurity analysis in multi-component CPS environments. By linking semantic system states with ATT&CK aligned tactics and techniques, the framework enables device observations to be interpreted as structured threat behaviors. This transforms the Digital Twin from a passive replica into an active security analysis platform supporting secure-by-design principles through explainable detection, contextual situational awareness, and informed defensive decision-making.

25

7.2 Key Contributions of the HySecTwin Framework The evaluation results highlight three primary contributions of the HySecTwin framework: (i) a cybersecurity-oriented Digital Twin development that embeds reasoning directly within CPS pipelines, (ii) a knowledge-driven semantic modeling layer enabling contextual interpretation of device behavior, and (iii) a hybrid reasoning mechanism combining deterministic and fuzzy inference for explainable threat detection. 1. Digital Twin Development. A central contribution of this work is the development of a cybersecurity-oriented DT architecture that functions as an analytical monitoring layer rather than a passive system replica. The synchronized interaction between the PT and DT enables continuous monitoring of CPS telemetry while preserving operational timing constraints. As demonstrated by the latency measurements in Tables 5 and 6, the mirrored analytics pipeline introduces negligible overhead, confirming that security reasoning can be embedded directly within DT infrastructures without affecting system responsiveness. This architecture enables real-time anomaly detection and contextual threat analysis while maintaining the operational stability required in industrial CPS environments. 2. Semantic Modeling. Another key contribution is the development of a knowledgedriven semantic representation that transforms raw CPS telemetry into machineinterpretable knowledge. The semantic model enables a structured representation of device attributes, operational states, and system relationships using the SAREF ontology. This semantic abstraction provides a consistent vocabulary for modeling CPS components, including sensors, actuators, operational states, and environmental conditions. Constructing semantic models for CPS environments remains a complex task that often requires extensive domain expertise and manual metadata population [46]. In addition to annotating CPS attributes, semantic modeling must also capture the relationships between system entities to enable meaningful reasoning over operational states. Prior research has explored ontology-driven approaches to address these challenges. For example, Fang et al. [47] propose a cloud service ontology model incorporating fuzzy extensions within OWL2 to support structured knowledge representation across distributed systems. In the HySecTwin framework, the semantic model was constructed by extending two core components: SAREF Core v3.1.1 based ontology and a domain-specific semantic model described in Section 3. These components form the foundation of the semantic model used by the machine reasoning component, enabling structured CPS monitoring and contextual interpretation of device behavior. 3.Hybrid Reasoning Mechanism. The third major contribution is the integration of a hybrid reasoning mechanism that combines deterministic rule-based inference with fuzzy reasoning. Deterministic rules provide precise detection of explicit policy violations, such as unauthorized command execution, configuration tampering, or breaches of predefined thresholds. However, purely rule-based reasoning systems are inherently restrictive because they rely on strictly defined logical conditions and may fail to detect ambiguous or gradually emerging anomalies. Hybrid reasoning extends this capability by enabling the aggregation of weak signals across multiple indicators of system behavior. As demonstrated in Tables 9 and 10 and illustrated in Fig. 7, the

26

hybrid reasoning engine improves detection responsiveness compared with deterministic reasoning while maintaining interpretability. The HySecTwin framework uses a Rete-based reasoning engine, well-suited for constrained IoT and IIoT environments due to its efficient incremental reasoning [48]. Unlike traditional engines with high computational and memory overhead, Rete supports efficient fact management through incremental insertion and deletion. Insertion separates newly observed facts from previously processed ones in alpha memory nodes, while deletion preserves consistency by linking implicit and explicit facts via additional data structures between alpha and beta nodes [49]. These features enable scalable reasoning across edge-to-enterprise architectures while maintaining responsiveness in dynamic CPS environments.

7.3 Comparison with Machine Learning Approaches Many contemporary CPS security solutions rely heavily on machine learning and deep learning techniques for anomaly and threat detection. Such approaches can identify complex behavioral patterns and nonlinear dependencies, but they often require large volumes of labeled data, periodic retraining, and careful handling of concept drift as system behavior evolves [50, 51]. In safety-critical environments, these models may also operate as opaque decision systems, limiting operator trust, auditability, and forensic interpretation. In contrast, the HySecTwin framework adopts a reasoningdriven approach grounded in semantic knowledge representation, deterministic rules, and fuzzy inference. This approach offers several advantages for critical infrastructure environments. First, reasoning outputs remain interpretable and traceable, allowing operators to understand why anomalies are detected and which system states triggered a response. Second, the framework does not depend on extensive training datasets that are often unavailable or costly to curate in operational CPS deployments. Third, explicit rules enable direct encoding of engineering constraints, safety policies, and security logic, while fuzzy reasoning provides robustness to uncertainty, noisy telemetry, and partial evidence. Recent studies have also recognized the need to move beyond purely black-box detection models. Digital twin-assisted anomaly detection methods improve contextual awareness through system replicas, while newer hybrid architectures combine learned models with structured reasoning to improve explainability and operational trustworthiness [51, 52]. HySecTwin aligns with this direction but emphasizes lightweight semantic reasoning and policy-driven detection suitable for deterministic CPS environments. Rather than replacing machine learning methods, the proposed architecture should be viewed as complementary. Data-driven models may remain effective for discovering previously unseen patterns, whereas the HySecTwin reasoning layer can provide transparent decision support, policy compliance checking, and contextual interpretation of CPS telemetry within a structured knowledge framework.

7.4 Limitations While the proposed Digital Twin-based cybersecurity framework can monitor cyberphysical system behavior and reason about anomalies and hidden threats, it has some limitations. Its effectiveness depends on the fidelity of the virtual representation

27

and the availability of accurate telemetry from the physical system, which this work achieves. However, minor discrepancies between the physical and digital systems may affect anomaly interpretation, particularly in heterogeneous industrial environments with diverse devices and protocols [3]. Moreover, the reasoning layer relies on semantic rules and behavioral relationships derived from the system model. Although this supports interpretable and explainable decisions, detecting entirely novel attack strategies may require complementary data-driven approaches. Machine learning and deep learning methods can detect complex or unseen anomalies, but they often lack explainability and require large datasets and significant computational resources [19, 53]. In contrast, rule-based semantic approaches are more transparent, yet they depend on complete and accurate system knowledge [19, 54].

8 Conclusion and Future Work This paper presents HySecTwin, a knowledge-driven DT framework designed to strengthen cybersecurity monitoring and operational resilience in a CPS. The proposed architecture integrates real-time DT synchronization with structured system knowledge and a hybrid reasoning engine, combining deterministic rule-based inference and fuzzy reasoning. This combination enables the framework to analyse CPS behavior beyond rigid rule violations by capturing subtle anomalies and contextual relationships within system operations. As a result, HySecTwin supports explainable and context-aware threat detection, addressing a key limitation of black-box cybersecurity solutions. Evaluation using a representative CPS testbed and MITRE ATT&CK for ICS–inspired attack scenarios confirms the feasibility of integrating knowledgedriven Digital Twins with hybrid reasoning for real-time security monitoring. Future research will extend this framework by incorporating Agentic AI capabilities, enabling advanced knowledge interpretation, automated reasoning support, and adaptive cybersecurity analytics. Integrating Human-in-the-Loop collaboration with these intelligent agents will further support supervised decision-making, explainable threat analysis, and coordinated defense strategies across large-scale cyber–physical infrastructures.

Declarations Data Availability. The data and materials supporting the findings of this research, including datasets, source code, experimental scripts, and Ontology Models, are publicly available at the Hybrid-Security Twin Project.

Funding. This work was supported by funding from the Cyber Security Cooperative Research Center (CSCRC) Australia through its PhD Scholarship program..

28

Acknowledgments. This project was primarily supported by the Cyber Security Cooperative Research Center (CSCRC), Australia, and the School of Science, Edith Cowan University, Australia. The authors gratefully acknowledge the resources provided for testbed establishment, experimentation, and Digital Twin development.

CRediT authorship contribution statement Writing – original draft: D.H, A.M; Writing – review & editing: A.M, S.N, I.H.S, L.S, H.J; Corresponding Author: A.M

References [1] Gaikwad, A., Yavari, R., Montazeri, M., Cole, K., Bian, L., Rao, P.: Toward the digital twin of additive manufacturing: Integrating thermal simulations, sensing, and analytics to detect process faults. IISE Transactions 52(11), 1204–1217 (2020) https://doi.org/10.1080/24725854.2019.1701753 [2] Masi, M., Sellitto, G.P., Aranha, H., Pavleska, T.: Securing critical infrastructures with a cybersecurity digital twin. Software and Systems Modeling 22(2), 689–707 (2023) https://doi.org/10.1007/s10270-022-01075-0 [3] Varghese, S.A., Dehlaghi Ghadim, A., Balador, A., Alimadadi, Z., Papadimitratos, P.: Digital twin-based intrusion detection for industrial control systems, 611–617 (2022) https://doi.org/10.1109/PerComWorkshops53856.2022.9767492 [4] Eckhart, M., Ekelhart, A.: A specification-based state replication approach for digital twins. Proceedings of the ACM Conference on Computer and Communications Security, 36–47 (2018) https://doi.org/10.1145/3264888.3264892 [5] Holmes, D., Papathanasaki, M., Maglaras, L., Ferrag, M.A., Nepal, S., Janicke, H.: Digital Twins and Cyber Security - solution or challenge? 6th South-East Europe Design Automation, Computer Engineering, Computer Networks and Social Media Conference, SEEDA-CECNSM 2021 (2021) https://doi.org/10. 1109/SEEDA-CECNSM53056.2021.9566277 [6] Eckhart, M., Ekelhart, A., Allison, D., Almgren, M., Ceesay-Seitz, K., Janicke, H., Nadjm-Tehrani, S., Rashid, A., Yampolskiy, M.: Security-Enhancing Digital Twins: Characteristics, Indicators, and Future Perspectives. IEEE Security and Privacy, 1–12 (2023) https://doi.org/10.1109/MSEC.2023.3271225 [7] Empl, P., Schlette, D., Zupfer, D., Pernul, G.: SOAR4IoT: Securing IoT Assets with Digital Twins. ACM International Conference Proceeding Series, 1–10 (2022) https://doi.org/10.1145/3538969.3538975

29

[8] Sikos, L.F.: Handling uncertainty and vagueness in network knowledge representation for cyberthreat intelligence. In: 2018 IEEE International Conference on Fuzzy Systems. IEEE, New York (2018). https://doi.org/10.1109/FUZZ-IEEE. 2018.8491686 [9] National Institute of Standards and Technology (NIST): The NIST cybersecurity framework (CSF) 2.0. NIST Cybersecurity White Paper 29, National Institute of Standards and Technology, Gaithersburg, MD, USA (2024). https://nvlpubs. nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf [10] Kritzinger, W., Karner, M., Traar, G., Henjes, J., Sihn, W.: Digital Twin in manufacturing: A categorical literature review and classification. IFAC-PapersOnLine 51(11), 1016–1022 (2018) https://doi.org/10.1016/j.ifacol.2018.08.474 [11] Talkhestani, B.A., Jazdi, N., Schloegl, W., Weyrich, M.: Consistency check to synchronize the Digital Twin of manufacturing automation based on anchor points. Procedia CIRP 72(March), 159–164 (2018) https://doi.org/10.1016/j. procir.2018.03.166 [12] Balta, E.C., Tilbury, D.M., Barton, K.: A digital twin framework for performance monitoring and anomaly detection in fused deposition modeling. In: 2019 IEEE 15th International Conference on Automation Science and Engineering (CASE), pp. 823–829 (2019). https://doi.org/10.1109/COASE.2019.8843166 [13] Kummerow, A., Rösch, D., Monsalve, C., Nicolai, S., Bretschneider, P., Brosinsky, C., Westermann, D.: Challenges and opportunities for phasor data based event detection in transmission control centers under cyber security constraints, pp. 1–6 (2019). https://doi.org/10.1109/PTC.2019.8810711 [14] Datta, S.P.A.: Emergence of Digital Twins - Is this the March of reason? Journal of Innovation Management 5(3), 14–33 (2017) https://doi.org/10.24840/ 2183-0606 005.003 0003 [15] Eckhart, M., Ekelhart, A.: Towards security-aware virtual environments for digital twins. In: Proceedings of the 4th ACM Workshop on Cyber-Physical System Security. CPSS ’18, pp. 61–72. Association for Computing Machinery, New York, NY, USA (2018). https://doi.org/10.1145/3198458.3198464 [16] Eckhart, M., Ekelhart, A., Weippl, E.: Enhancing Cyber Situational Awareness for Cyber-Physical Systems through Digital Twins. IEEE International Conference on Emerging Technologies and Factory Automation, ETFA 2019September, 1222–1225 (2019) https://doi.org/10.1109/ETFA.2019.8869197 [17] Kharlamov, E., Martin-Recuerda, F., Perry, B., Cameron, D., Fjellheim, R., Waaler, A.: Towards semantically enhanced digital twins. In: 2018 IEEE International Conference on Big Data (Big Data), pp. 4189–4193 (2018). https: //doi.org/10.1109/BigData.2018.8622503

30

[18] Empl, P., Pernul, G.: Digital-twin-based security analytics for the internet of things. Information 14(2), 95 (2023) https://doi.org/10.3390/info14020095 [19] Mohsin, A., Janicke, H., Nepal, S., Holmes, D.: Digital Twins and the Future of Their Use Enabling Shift Left and Shift Right Cybersecurity Operations . In: 2023 5th IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA), pp. 277–286. IEEE Computer Society, Los Alamitos, CA, USA (2023). https://doi.org/10.1109/TPS-ISA58951.2023.00042 [20] Balta, E.C., Pease, M., Moyne, J., Barton, K., Tilbury, D.M.: Digital Twin-Based Cyber-Attack Detection Framework for Cyber-Physical Manufacturing Systems. IEEE Transactions on Automation Science and Engineering PP, 1–18 (2023) https://doi.org/10.1109/TASE.2023.3243147 [21] Grieves, M., Vickers, J.: Digital twin: Mitigating unpredictable, undesirable emergent behavior in complex systems. Transdiscipl. Perspect. Complex Syst. New Find. Approaches (August), 85–113 (2016) https://doi.org/10.1007/ 978-3-319-38756-7 4 [22] Eckhart, M., Ekelhart, A.: Digital Twins for Cyber-Physical Systems Security: State of the Art and Outlook, pp. 383–412. Springer, Cham (2019). https://doi. org/10.1007/978-3-030-25312-7 14 [23] Moser, B.R., Grossmann, W.: Digital Twins of Complex Projects. The Digital Twin, 677–702 (2023) https://doi.org/10.1007/978-3-031-21343-4 24 [24] Sarker, I.H., Janicke, H., Mohsin, A., Gill, A., Maglaras, L.: Explainable ai for cybersecurity automation, intelligence and trustworthiness in digital twin: Methods, taxonomy, challenges and prospects. ICT Express 10(4), 935–958 (2024) https://doi.org/10.1016/j.icte.2024.05.007 [25] Bromander, S., Jøsang, A., Eian, M.: Semantic cyberthreat modelling. In: Oltramari A. Emmons I., C.P.C.G.L.K.B. (ed.) CEUR Workshop Proceedings, vol. 1788, pp. 74–78. Aachen University, Aachen (2016) [26] Sikos, L.F.: OWL ontologies in cybersecurity: Conceptual modeling of cyberknowledge. In: Sikos, L.F. (ed.) AI in Cybersecurity, pp. 1–17. Springer, Cham (2019). https://doi.org/10.1007/978-3-319-98842-9 1 [27] Sikos, L.F.: Mastering Structured Data on the Semantic Web, pp. 37–38. Apress, Berkeley (2015). https://doi.org/10.1007/978-1-4842-1049-9 [28] Sikos, L.F.: The formal representation of cyberthreats for automated reasoning. In: Sikos, L.F., Choo, K.-K.R. (eds.) Data Science in Cybersecurity and Cyberthreat Intelligence, pp. 1–12. Springer, Cham (2020). https://doi.org/10. 1007/978-3-030-38788-4 1

31

[29] Gerodimos, A., Maglaras, L., Ferrag, M.A., Ayres, N., Kantzavelou, I.: IoT: Communication protocols and security threats. Internet of Things and Cyber-Physical Systems 3(December 2022), 1–13 (2023) https://doi.org/10.1016/j.iotcps.2022. 12.003 [30] Eclipse. 2024. Eclipse Ditto. http://https://github.com/eclipse/ditto. Accessed: 10-06-2024 [31] Amazon. 2024. AWS IoT TwinMaker. https://aws.amazon.com/iot-twinmaker/. Accessed: 05-02-2024 [32] Microsoft. 2024. Azure Digital Twin. https://docs.microsoft.com/en-gb/azure/ digital-twins. Accessed: 02-10-2024 [33] Alnowaiser, K.K., Ahmed, M.A.: Digital Twin: Current Research Trends and Future Directions. Arabian Journal for Science and Engineering 48(2), 1075–1095 (2023) https://doi.org/10.1007/s13369-022-07459-0 [34] Muralidharan, S., Yoo, B., Ko, H.: Designing a semantic digital twin model for iot. In: 2020 IEEE International Conference on Consumer Electronics (ICCE), pp. 1–2 (2020). https://doi.org/10.1109/ICCE46568.2020.9043088 [35] Horrocks, I., Kutz, O., Sattler, U.: The even more irresistible sroiq., vol. 6, pp. 57–67 (2006) [36] Liu, H., Gegov, A.: Rule based systems and networks: Deterministic and fuzzy approaches. In: 2016 IEEE 8th International Conference on Intelligent Systems (IS), pp. 316–321 (2016). https://doi.org/10.1109/IS.2016.7737440 [37] Anicic, D., Fodor, P., Rudolph, S., Stühmer, R., Stojanovic, N., Studer, R.: A rule-based language for complex event processing and reasoning. In: International Conference on Web Reasoning and Rule Systems, pp. 42–57 (2010). Springer [38] Rashid, M.M., Alazab, M., Anwar, A., Khan, S.: A hybrid machine learning and fuzzy logic-based intrusion detection system for industrial control systems. Computers & Security 114, 102578 (2022) https://doi.org/10.1016/j.cose.2022. 102578 [39] Klir, G.J., Yuan, B.: Fuzzy Sets and Fuzzy Logic: Theory and Applications. Prentice Hall, Upper Saddle River, NJ, USA (1995) [40] Wang, J., Zhou, H., Li, P.: Rule-based and fuzzy logic hybrid reasoning for intelligent fault diagnosis in complex systems. Expert Systems with Applications 182, 115220 (2021) https://doi.org/10.1016/j.eswa.2021.115220 [41] OASIS: MQTT Version 3.1.1. OASIS Standard. Accessed 2025-08-24 (2014). https://docs.oasis-open.org/mqtt/mqtt/v3.1.1/os/mqtt-v3.1.1-os.html

32

[42] OASIS: MQTT Version 5.0. OASIS Standard. Accessed 2025-08-24 (2019). https: //docs.oasis-open.org/mqtt/mqtt/v5.0/os/mqtt-v5.0-os.html [43] Stouffer, K., Falco, J., Scarfone, K.: Guide to industrial control systems (ics) security. Special Publication 800-82, Revision 2, National Institute of Standards and Technology (NIST) (2015). https://doi.org/10.6028/NIST.SP.800-82r2 . Accessed 2025-08-24. https://doi.org/10.6028/NIST.SP.800-82r2 [44] Cooper, B.F., Silberstein, A., Tam, E., Ramakrishnan, R., Sears, R.: Benchmarking cloud serving systems with ycsb. In: Proceedings of the 1st ACM Symposium on Cloud Computing. SoCC ’10, pp. 143–154. Association for Computing Machinery, New York, NY, USA (2010). https://doi.org/10.1145/1807128. 1807152 [45] National Institute of Standards and Technology (NIST): Performance measurement guide for information security. Special Publication 800-55, Revision 2, NIST (2023). Accessed 2025-08-24. https://csrc.nist.gov/publications/detail/sp/ 800-55/rev-2/final [46] Feng, Z.W., Xu, J.K., Mayer, W., Huang, W.Y., He, K.Q., Stumptner, M., Grossmann, G., Zhang, H.Y., Ling, L.: Automatic Semantic Modeling for Structural Data Source with the Prior Knowledge From Knowledge Graph. 2021 IEEE 23rd International Conference on High Performance Computing and Communications, 7th International Conference on Data Science and Systems, 19th International Conference on Smart City and 7th International Conference on Dependability in Sensor, Cl, 2034–2041 (2022) https://doi.org/10.1109/ HPCC-DSS-SmartCity-DependSys53884.2021.00304 [47] Fang, D., Liu, X., Romdhani, I., Jamshidi, P., Pahl, C.: An agility-oriented and fuzziness-embedded semantic model for collaborative cloud service search, retrieval and recommendation. Future Generation Computer Systems 56, 11–26 (2016) https://doi.org/10.1016/j.future.2015.09.025 [48] Iorga, M., Feldman, L., Barton, R., Martin, M.J.: NIST Special Publication 500325 Recommendations of the National Institute of Standards and Technology (March) (2018) [49] Bento, A., Médini, L., Singh, K., Laforest, F.: Do arduinos dream of efficient reasoners? In: The Semantic Web, pp. 289–304. Springer, Cham (2022) [50] Jadidi, Z., Pal, S., K, N.N., Selvakkumar, A., Chang, C.-C., Beheshti, M., Jolfaei, A.: Security of machine learning-based anomaly detection in cyber physical systems. In: 2022 International Conference on Computer Communications and Networks (ICCCN), pp. 1–7 (2022). https://doi.org/10.1109/ICCCN54977.2022. 9868845 [51] Xu, Q., Ali, S., Yue, T.: Digital twin-based anomaly detection with curriculum

33

learning in cyber-physical systems. ACM Transactions on Software Engineering and Methodology 32(5), 122–112231 (2023) https://doi.org/10.1145/3597507 [52] Kampourakis, K.E., Gkioulos, V., Katsikas, S.: Systematic integration of digital twins and constrained llms for interpretable cyber-physical anomaly detection. arXiv preprint arXiv:2604.03790 (2026) arXiv:2604.03790 [cs.CR] [53] Sayghe, A.: Digital twin-driven intrusion detection for industrial scada: A cyberphysical case study. Sensors 25(16) (2025) https://doi.org/10.3390/s25164963 [54] Nandiya, P., Mohsin, A., Ibrahim, A., Sarker, I.H., Janicke, H.: BRIDG-ICS: AIGrounded Knowledge Graphs for Intelligent Threat Analytics in Industry 5.0 Cyber-Physical Systems (2026). https://arxiv.org/abs/2512.12112

34