HySecTwin: A Knowledge-Driven Digital Twin Framework Augmented with Hybrid Reasoning for Cyber-Physical Systems
David Holmes, Ahmad Moshin, Surya Nepal, Leslie Sikos, Helge Yanicke
TLDR
HySecTwin is a knowledge-driven digital twin framework using hybrid reasoning for real-time, interpretable cybersecurity threat detection in Cyber-Physical Systems.
Key contributions
- Knowledge-driven digital twin with automated reasoning for real-time CPS threat detection.
- Uses semantic modeling to transform heterogeneous CPS data into machine-interpretable representations.
- Integrates deterministic and hybrid fuzzy reasoning for explicit, interpretable security assessments.
- Achieves sub-millisecond latency and up to 21.5% faster threat detection in experiments.
Why it matters
Existing Digital Twin approaches often lack semantic reasoning for effective CPS cybersecurity. HySecTwin addresses this by providing an interpretable, knowledge-driven framework that significantly improves threat detection speed and explainability. This enhances resilience in mission-critical infrastructures.
Original Abstract
Existing Digital Twin (DT) approaches often lack semantic reasoning capabilities for effective cybersecurity modelling in Cyber-Physical Systems (CPS). This paper presents HySecTwin, a knowledge-driven digital twin architecture that places automated reasoning at the core of real-time threat detection. HySecTwin incorporates semantic modelling to transform heterogeneous CPS telemetry, device attributes, and operational relationships into machine-interpretable representations, combined with an embedded reasoning engine operating over contextualized system states. Unlike opaque detection methods, the framework integrates deterministic rule-based inference with hybrid fuzzy reasoning to generate explicit, interpretable, and auditable security assessments from live device telemetry. This enables context-aware monitoring of complex CPS environments while preserving transparency and trust. Experimental evaluation using a representative CPS testbed and MITRE ATT\&CK campaign-inspired attack scenarios demonstrates sub-millisecond twin synchronization latency and up to 21.5\% faster threat detection compared with deterministic reasoning alone. The results show that semantic modelling, semantic enrichment, and hybrid reasoning improve explainability and resilience without extra system overhead. HySecTwin provides a lightweight, containerized, and extensible framework for secure-by-design digital twin deployments in mission-critical infrastructures
📬 Weekly AI Paper Digest
Get the top 10 AI/ML arXiv papers from the week — summarized, scored, and delivered to your inbox every Monday.