Digital‐Twin‐Enabled, Time‐Aware Anomaly Detection for Industrial Cyber‐Physical Systems

ABSTRACT Industrial cyber‐physical systems (ICPS) operate under tight dynamics and strict safety constraints, where anomalous behaviour unfolds over time and requires operator‐actionable context. Although recent learning‐based detectors have improved point‐wise accuracy, deployment realism remains limited: evaluations often ignore temporal leakage, underreport event‐level performance and provide little support for situational awareness in the control room. This work introduces a digital‐twin‐enabled, time‐aware anomaly detection framework that couples a temporal LSTM–DNN classifier with data‐driven thresholding and an operator‐facing twin for live triage. The digital twin (web‐based React frontend with a Flask backend) mirrors plant state in real time to visualise alerts, hypothesise counterfactuals and accelerate response. Our aims are threefold: (i) detect attacks at the event level with low delay; (ii) surface explanations and sensor‐level rules that are actionable; and (iii) evaluate under realistic temporal protocols and imbalance. Methodologically, we combine sequence modelling with per‐sensor operating ranges learnt from unsupervised Isolation‐Forest analysis to capture abrupt shifts and multivariate inconsistencies; the twin surfaces both sequence scores and rule violations for human verification. On the SWaT benchmark, the system detected 31/41 attack events overall, including 22/23 SSSP (single‐stage single‐point), 3/6 SSMP (single‐stage multi‐point), 4/4 MSSP (multi‐stage single‐point) and 2/3 MSMP (multi‐stage multi‐point), demonstrating broad coverage across attack taxonomies. At the instance level, the classifier attained 94.6% accuracy, 99.8% precision, 94.8% recall and a 97.2% F1‐score on the held‐out test set, highlighting strong detection capability under class imbalance (specificity 18.4%). In sum, the contributions are (1) a digital‐twin‐enabled, time‐aware detection pipeline that integrates temporal learning with data‐driven operating envelopes; (2) event‐level evaluation and reporting aligned with operational practice; and (3) quantitative evidence that coupling sequence models with interpretable rules yields high precision and broad attack coverage while exposing residual specificity gaps that guide future cost‐sensitive calibration and threshold optimisation. Overall, DC‐GLNet (i) jointly exploits spectrogram‐level (SFEB) and ENF‐specific (ENFB) representations via a KAN classifier, (ii) incorporates robust harmonic selection and enhancement (RFA/HRFA) tailored to short, noisy clips and (iii) achieves > 90% accuracy on 5‐min clips, outperforming SVM, XGBoost and a NAS baseline by more than 7 percentage points on both SP‐CUP2016 and China‐Online‐Data benchmarks.