A Digital Twin and Lightweight Blockchain Logging Framework for Real-Time CPS Threat Detection

Abstract

: Cyber-Physical Systems (CPS), including Industrial Internet of Things (IIoT) environments and smart infrastructures, are increasingly vulnerable to sophisticated cyberattacks due to their heterogeneous architectures, large-scale deployments, and strict real-time operational constraints. Conventional security mechanisms often struggle to provide low-latency threat detection, continuous monitoring, and reliable forensic traceability under resource-constrained conditions. This paper presents a lightweight Digital Twin (DT)-driven cybersecurity framework that integrates synchronized DT state modeling, hybrid anomaly detection, and tamper-evident audit logging for real-time CPS threat detection. Within this framework, the DT is realized as an operational, data-driven twin whose role is continuous bidirectional state synchronization, integrity-aware feature abstraction, and context-aware representation of CPS assets for detection, rather than a physics-based simulation, “what-if” scenario, or predictive-maintenance twin; these richer capabilities are enabled by the modular DT design and are identified as future extensions. The proposed framework employs a decoupled training-deployment strategy in which Isolation Forest (IF), Gradient Boosting Machine (GBM), and Multi-Layer Perceptron (MLP) models are combined during an offline ensemble calibration stage to optimize detection thresholds, while only a lightweight MLP model is executed during runtime inference to minimize computational overhead. To enhance detection reliability and interpretability, the learning-based detection pipeline is further augmented with domain-aware rule-based verification. In addition, validated security events are recorded via a lightweight, hash-chained, append-only logging mechanism that provides tamper-evident forensic traceability without the latency overhead of consensus-driven distributed ledger systems. Experimental evaluation on controlled synthetic CPS telemetry achieved 99.6% detection accuracy, 99.5% precision, 99.8% recall, and an F1-score of 99.6%. The framework was further validated on three real-world industrial CPS benchmarks (SWaT, WADI, and BATADAL), where F1-scores ranged from 0.976 to 0.986, demonstrating consistent generalization across heterogeneous operational environments. In addition, the proposed architecture sustained telemetry processing rates exceeding 5000 events per minute with an average logging latency of 0.84 s and CPU utilization below 65%. These results demonstrate that the proposed framework provides an efficient and practically deployable CPS security architecture that balances lightweight runtime inference, detection reliability, and forensic auditability in resource-constrained environments