A unified unsupervised deep learning and stride threat modeling framework for multi-domain cyber-physical security in nuclear digital twins

Abstract

The increasing adoption of Digital Twin (DT) architectures in nuclear power systems has accelerated the convergence of Operational Technology (OT) and Information Technology (IT), exposing critical cyber-physical infrastructure to sophisticated signature-independent attacks that cannot be reliably detected using conventional signature-based Intrusion Detection Systems. Addressing the heterogeneous characteristics of physical process telemetry and industrial network traffic remains a major challenge for developing practical anomaly detection frameworks. This research proposes a unified unsupervised deep learning and threat modeling framework that integrates domain-aware preprocessing, temporal anomaly detection, adaptive thresholding, and STRIDE-based threat attribution into a single cyber-physical security architecture for nuclear DT. The framework combines a Long Short-Term Memory Autoencoder (LSTM-AE) with domain-specific normalization strategies, applying Min-Max scaling to bounded physical telemetry and Robust scaling to highly variable network traffic while preserving the statistical characteristics of each operational domain. A dynamic 99.5th-percentile anomaly threshold is employed to reduce false-positive alarms that could lead to unnecessary operational interventions in safety-critical environments. To improve the interpretability of unsupervised anomaly detection, the framework incorporates a deterministic feature-level attribution mechanism that maps localized reconstruction errors to the STRIDE threat taxonomy, providing human-readable cyber-physical threat intelligence for system operators. The proposed framework is validated across three publicly available industrial control system datasets acting as nuclear-relevant industrial proxies for complementary operational domains: HAI (primary power generation), SWaT (secondary cooling processes), and WUSTL-IIoT (edge network monitoring). Experimental evaluation demonstrates high discriminative capacity, achieving ROC-AUC scores of 0.944, 0.948, and 0.985, respectively. The results demonstrate that integrating domain-aware preprocessing, unsupervised anomaly detection, adaptive thresholding, and STRIDE-based threat attribution provides an effective and interpretable framework for enhancing cyber-physical security in DT -enabled nuclear environments.