SHAM-AI: A Self-Healing and Adaptive Multi-Modal Anomaly Intelligence Framework for Securing Cloud Digital Twins

Cloud-based Digital Twins (CDTs) enable real-time monitoring and control of complex cyber-physical systems but face critical security and reliability challenges due to multi-modal anomalies, evolving attack patterns, and cascading failures. To address these challenges, this paper presents a Self-Healing and Adaptive Multi-Modal Anomaly Intelligence ( SHAM-AI ) framework for securing CDTs. SHAM-AI integrates four key components: (i) robust telemetry preprocessing to standardize heterogeneous CDT data, (ii) dual anomaly prediction using Isolation Forest for spatial deviations and Spiking Neural Network Autoencoders for temporal patterns, (iii) adaptive, context-aware decision fusion that dynamically weighs evidence from multiple modalities, and (iv) reinforcement learning-based mitigation for automated alerting, containment, and recovery. By jointly modeling spatial and temporal anomalies through self-healing adaptive policies, the proposed SHAM-AI framework achieves high detection accuracy, reduces false positives, and effectively mitigates threat propagation. Evaluations on realistic cloud–digital twin (cloud-DT) testbeds using a benchmark data set confirm its ability to sustain secure, resilient and adaptive CDT operations. Quantitative results further show that SHAM-AI outperforms state-of-the-art baselines by up to 21.8% in temporal anomaly prediction accuracy and 18.6% in spatial anomaly detection, while attaining over 23.4% higher efficiency in handling and mitigating multi-modal anomalies across dynamic cloud environments.