Digital Twins for Detection, Localisation, and Attribution of Cyberattacks

The increasing dependence of active distribution networks on synchronized measurements and communication-based monitoring has introduced significant vulnerabilities to false data injection (FDI) and coordinated stealth cyberattacks. This paper presents a per-node digital twin (DT)-based framework for cyberattack detection, localisation, and attribution in the IEEE 33-bus radial distribution network. The proposed framework integrates distribution-level phasor measurement unit (D-PMU) data, node-specific digital twin predictions, residual analysis, cumulative sum (CUSUM)-based anomaly detection, persistence verification, and watermark-assisted validation. Four digital twins corresponding to buses 9, 13, 28, and 33 are considered to evaluate identification accuracy and attack detection performance. The estimated time constants range from 19.91 to 19.95 ms against a reference value of 20.00 ms, resulting in relative errors between 0.25% and 0.45%, with an average error of 0.325%. Under a ramp FDI attack targeting bus 33, the node-specific residuals reveal progressively increasing measurement deviations, with attack confirmation reported at approximately 2.52 s. Furthermore, a coordinated stealth attack involving buses 9 and 13 demonstrates how oppositely signed measurement manipulations can conceal abnormalities in aggregated monitoring indicators. The per-node detection framework preserves individual residual signatures and identifies the affected nodes, with attack confirmation reported at approximately 2.50 s. The results demonstrate the potential of combining spatially resolved digital-twin monitoring with sequential anomaly detection to identify gradual, coordinated cyberattacks. The proposed framework provides a promising approach for improving measurement integrity, attack localisation, and cyber-physical situational awareness in active distribution networks.