Automated cross-layer metamodeling for secure digital twins: attack detectability by construction

Abstract This paper presents an automated model-driven engineering approach for constructing secure digital twins of cyber-physical systems. The core contribution is a cross-layer metamodel that represents physical assets, information flows, AI analytics, optimization services and cyber threats as typed, interrelated software artifacts within one conformance-checked structure. A conforming model is instantiated as an executable digital twin, so security rules can access not only measured values but also information-layer properties such as packet sequence, timestamp and integrity metadata. The approach is evaluated through a smart-grid digital twin with photovoltaic generation, battery storage, residential demand and electric-vehicle charging, using eleven years of ERA5-Land data (2015--2025). The executable services combine multi-horizon neural forecasting, linear-programming dispatch and cross-layer anomaly detection. Forecasting achieves 6.8--10.6% normalized RMSE and the dispatch reaches a 45% renewable fraction. Under staged false-data-injection, denial-of-service and replay attacks, the value-only detector attains 0.92 ROC-AUC but detects no replay attacks, whereas the metamodel-enabled information-integrity check raises replay detection to 100% and recovers about 81% of the attack-induced operating cost. The results show that explicit cross-layer software models can make classes of cyber manipulation detectable by construction that remain invisible to value-space monitoring alone.