[Paper Review] Security Attacks and Solutions for Digital Twins

Sabah Suhail, Raja Jurdak+1 more|arXiv (Cornell University)|Feb 25, 2022

Digital Transformation in Industry19 citations

TL;DR

This paper identifies novel cyberattacks targeting digital twins in industrial control systems, particularly through manipulation of virtual replicas and exploitation of the digital thread. It proposes a gamified, AI-driven security assessment framework using simulated attacks and defenses to evaluate digital twin resilience, enabling proactive threat detection and intelligent incident response through machine learning and blockchain-based provenance tracking.

ABSTRACT

Digital twins, being the virtual replicas of their physical counterparts, share valuable knowledge of the underlying system. Therefore, they might become a potential source of data breaches and a playground for attackers to launch covert attacks. It is imperative to investigate necessary countermeasures to mitigate such attacks.

Motivation & Objective

• To identify and analyze new cyberattack vectors targeting digital twins in Cyber-Physical Systems (CPS) and Industrial Control Systems (ICS).
• To investigate how attackers can exploit digital twins by manipulating their virtual states or compromising the digital thread across the product lifecycle.
• To design a gamified, simulation-based training environment that enables security analysts to evaluate digital twin security levels through controlled attack and defense scenarios.
• To develop an intelligent incident response system using AI agents (e.g., GANs) that learn from attack simulations and improve detection and mitigation strategies.
• To propose blockchain-integrated provenance tracking and fault-tolerant mechanisms to enhance auditability and system resilience in digital twin environments.

Proposed method

• The paper proposes a gamified learning environment where attacker and defender AI agents simulate real-world cyberattacks and defensive responses on digital twin systems.
• The system uses Generative Adversarial Networks (GANs) to train AI agents in dynamic attack and defense scenarios, improving their strategic decision-making.
• Security assessments are performed using log data from simulated incidents, which are analyzed via an incident response playbook to guide training and response development.
• A digital twin assessment module evaluates the security level of digital twins by analyzing anomaly patterns and system behavior deviations.
• Provenance-aware blockchain is integrated to track changes in simulation parameters and state data, enabling auditability and accountability of modifications.
• The framework enables replication of findings from the virtual environment to the actual digital twin and physical system, ensuring real-world applicability.

Experimental results

Research questions

• RQ1 How can digital twins be abused by attackers to covertly manipulate physical systems through virtual replica manipulation?
• RQ2 What are the key attack vectors targeting digital twins, particularly through the digital thread and cyclic state updates?
• RQ3 How can a gamified, AI-driven simulation environment effectively train security analysts to detect and respond to digital twin-based threats?
• RQ4 What role can blockchain-based provenance tracking play in securing digital twin data integrity and enabling forensic analysis?
• RQ5 How can intelligent incident response systems based on machine learning improve detection and mitigation of attacks on digital twins?

Key findings

• The study identifies two primary attack modes: manipulation of benign digital twin behavior and exploitation of cyclic state updates from physical systems to digital twins.
• The gamified AI environment enables effective training of security analysts by simulating realistic attack scenarios and measuring response accuracy through log-based analysis.
• AI agents trained using GANs demonstrate improved capability in selecting optimal attack and defense strategies based on historical and synthetic attack data.
• Blockchain-based provenance tracking enables reliable audit trails of changes to digital twin parameters and state data, supporting incident reconstruction and accountability.
• The proposed framework enables direct replication of security findings from simulation to physical systems, enhancing real-world threat mitigation.
• Fault-tolerant mechanisms with graceful degradation reduce system-wide disruption during cyber incidents, maintaining control even under abnormal conditions.