<scp>TwinSec</scp>‐<scp>IDS</scp>: An Enhanced Intrusion Detection System in <scp>SDN</scp>‐Digital‐Twin‐Based Industrial Cyber‐Physical Systems

ABSTRACT The increasing complexity and interconnectivity of industrial cyber‐physical systems (ICPSs), while enhancing operational security and reliability, have also introduced significant cybersecurity challenges. Software‐defined networking (SDN), a transformative technology for centralized and dynamic resource management, is particularly vulnerable as centralized control planes can become single points of failure. The integration of Digital Twin technology, which creates virtual replicas of physical systems for real‐time monitoring and prediction, further exacerbates security risks. To address these issues, we present TwinSec‐IDS, an advanced intrusion detection framework designed for SDN‐Digital‐Twin‐based ICPS. TwinSec‐IDS provides comprehensive and proactive intrusion detection, thereby enhancing the resilience of industrial networks. This paper introduces an ensemble approach, leveraging hybrid deep learning models—such as Bi‐GRU‐CNN, Bi‐GRU‐LSTM, and Bi‐GRU‐LSTM‐CNN—integrated with ensemble‐based feature selection techniques. The system employs weighted majority voting to combine predictions from multiple models, improving detection accuracy. To ensure optimal feature selection, the framework incorporates explainable AI and multiple filter methods, including mutual information, chi‐square tests, and correlation coefficients, aggregated through a voting mechanism. TwinSec‐IDS demonstrates high accuracy in detecting and categorizing anomalies and effectively responds to potential threats. Extensive evaluations show that TwinSec‐IDS significantly improves the security and resilience of SDN‐Digital‐Twin‐based ICPS, addressing critical cybersecurity concerns and making industrial processes safer and more reliable.