Causal Digital Twins for cyber–physical security in water systems: A framework for robust anomaly detection

Industrial Control Systems (ICS) in water distribution and treatment face cyber–physical attacks exploiting network and physical vulnerabilities. Current water system anomaly detection methods rely on correlations, yielding high false alarms and poor root cause analysis. We propose a Causal Digital Twin (CDT) framework for water infrastructures, combining causal inference with digital twin modeling. CDT supports association for pattern detection, intervention for system response, and counterfactual analysis for water attack prevention. Evaluated on water-related datasets SWaT, WADI, and HAI, CDT shows high compliance with physical constraints (90.8% for SWaT, 87.4%–90.8% across datasets) and structural Hamming distance 0.133 ± 0.02. F1-scores are 0 . 944 ± 0 . 014 (SWaT), 0 . 902 ± 0 . 021 (WADI), 0 . 923 ± 0 . 018 (HAI, p < 0 . 0024 ). Multi-scale temporal detection strategies ( τ ∈ { 5 , 10 , 20 } ) enable 91.7% detection of stealthy attacks through cumulative causal discrepancy analysis. CDT reduces false positives by 48% compared to state-of-the-art methods (70% vs. statistical baselines), achieves 78.4% root cause accuracy, and enables counterfactual defenses reducing attack success by up to 89.1%. Real-time performance at 3.2 ms latency ensures safe and interpretable operation for medium-scale water systems. • CDT links causal reasoning with digital twins for ICS behavior analysis • Scores 0.944 on SWaT, 0.902 on WADI, 0.923 on HAI with 48% fewer false alerts • Learns causal relations with 90.8% physical consistency, 78.4% Top-1 accuracy • Counterfactual analysis guides defenses, cutting attack success by 58.3% to 89.1% • Real-time feasible at 3.2ms latency; transfer keeps F1 between 0.847 and 0.889