Source-linked AI summary
A Review of Digital Twins and their Application in Cybersecurity based on Artificial Intelligence
MohammadHossein Homaei, Oscar Mogollon Gutierrez, Jose Carlos Sancho Nunez, Mar Avila Vegas, Andres Caro Lindo
TL;DR
Digital twins create cybersecurity challenges because threats to a twin can directly affect its cyber-physical system, while diverse applications complicate the assessment of risks and countermeasures. This review examines digital-twin security challenges and AI solutions, concluding that cybersecurity should be considered from the initial design stages. It also notes that AI is not a complete solution and remains difficult to implement at small scale.
Problem
Cybersecurity threats to digital twins can directly affect their cyber-physical systems, while the wide range of applications makes it difficult to investigate all risks and responses.
Source: §6 · p. 44Method
The review examines digital-twin applications and cybersecurity challenges, then surveys AI solutions and how they may be used to secure digital twins.
Source: §6 · p. 44Results
The review identifies cybersecurity as a major digital-twin challenge and presents AI solutions among the tools considered for addressing it.
Source: §6 · p. 44Takeaways & Limitations
The authors argue that cybersecurity should be addressed in the initial design stages of digital twins.
Source: §6 · p. 44AI is not an ultimate cybersecurity solution, remains difficult to implement on a small scale, and requires improvement.
Source: §5 · p. 42
Abstract
from arXiv · showhide
The potential of digital twin technology is yet to be fully realized due to its diversity and untapped potential. Digital twins enable systems' analysis, design, optimization, and evolution to be performed digitally or in conjunction with a cyber-physical approach to improve speed, accuracy, and efficiency over traditional engineering methods. Industry 4.0, factories of the future, and digital twins continue to benefit from the technology and provide enhanced efficiency within existing systems. Due to the lack of information and security standards associated with the transition to cyber digitization, cybercriminals have been able to take advantage of the situation. Access to a digital twin of a product or service is equivalent to threatening the entire collection. There is a robust interaction between digital twins and artificial intelligence tools, which leads to strong interaction between these technologies, so it can be used to improve the cybersecurity of these digital platforms based on their integration with these technologies. This study aims to investigate the role of artificial intelligence in providing cybersecurity for digital twin versions of various industries, as well as the risks associated with these versions. In addition, this research serves as a road map for researchers and others interested in cybersecurity and digital security.
1. Introduction
Digital twins have evolved into networked virtual representations that can interact with physical systems, but their growing applications and connections create cybersecurity challenges. This paper frames those challenges across digital-twin applications and considers the risks of attacks on connected systems.
1. Introduction
- Digital twins support applications across industries by creating virtual representations for testing and improving real-world activities, decisions, and outcomes.The paper traces the concept to NASA’s space activities roughly fifty years ago, when hardware, software, and processing limits restricted it to summary processes and monitoring.Source: §1 · p. 2
- Digital twins connect physical and virtual systems through networks such as IoT, with sensors supplying data and digital assets potentially sending commands back to physical equipment.The paper distinguishes digital models with no automatic connection, digital shadows with one-way communication, and digital twins with automatic two-way communication.Source: §1 · pp. 2–3
- The paper investigates security threats across diverse digital-twin applications, where attacks on basic infrastructure can also pose risks to national security.It notes that digital twins can support monitoring, control, and operational performance across industrial, urban, agricultural, and other applications.Source: §1 · p. 4
- Digital-twin applications combine services such as data acquisition, distribution, synchronisation, modelling, simulation, and representation, while integration of their technologies and computation systems brings security risks.The paper notes that standards are being published to stabilise communications, while secure platforms remain a challenge.Source: §1 · p. 4
- Digital twins are vulnerable to cyberattacks because of multiple attack levels, novelty, and insufficient standardisation and security requirements.The paper says attacks may target either the physical environment or digital space, potentially reaching underlying infrastructure and production assets; sensitive systems and protected intellectual property also limit security research access.Source: §1 · pp. 5–6
2. DT concepts and structures
The paper describes digital twins as virtual representations that connect physical and cyberspace through information processing. It distinguishes digital models, digital shadows, and digital twins by how data and influence flow between the physical and digital systems.
2. DT concepts and structures
- A digital-twin-enabled technology virtually displays and optimises a physical object or real-life system through physical, information-processing, and cyberspace components.Information processing covers data storage, processing, and mapping; cyberspace models use the resulting data for virtual representation, visualisation, and simulation.Source: §2 · p. 7
2.1. DT Structures
- Digital models lack automatic physical-world connections, digital shadows use one-way communication, and digital twins provide automatic two-way connections.In the digital-twin structure, sensor inputs enter the model and decisions can be sent to system outputs, allowing the digital representation to influence the physical system.Source: §2.1 · pp. 7–8
- The paper presents Table 1 as a reference for widespread digital-twin misconceptions and Table 2 as specifications of digital-twin service categories.The supplied text identifies the tables’ scope but does not describe their individual entries.Source: Table 1 · p. 9, §2.1 · p. 9, Table 2 · p. 10
2.2. Classification of DTs by process
The paper presents process-based categories of digital twins and situates them in Industry 4.0, where connected manufacturing systems bring both efficiency opportunities and cybersecurity challenges.
2.2. Classification of DTs by process
- The paper presents Figure 5 and Table 3 as an alternative process-based categorisation of digital-twin types.The supplied text identifies the figure and table as covering different digital-twin types but does not specify their categories.Source: §2.2 · p. 10, Figure 5 · p. 10, Table 3 · p. 11
2.3. DT and Industry 4.0
- Industry 4.0 integrates IoT and cloud computing into manufacturing, while connected IIoT and cyber-physical systems seek to improve resource use and manufacturing efficiency.The paper notes that manufacturing businesses are still recognising cybersecurity’s importance and that secure digital-twin platforms remain a work in progress.Source: §2.3 · pp. 11–12
2.4. DT and the IoT
The section situates digital twins within connected manufacturing and IoT environments, where networked systems introduce cybersecurity risks. It outlines industrial security practices and notes that limited testbeds and incident data constrain IDS research for smart manufacturing and IoT.
2.4. DT and the IoT
- Connected manufacturing exchanges information across networks, making IT and data security more challenging than in isolated machinery environments.The section describes protocols including Modbus, DNP3, industrial Ethernet, PROFIBUS, and BACnet, while noting that security mechanisms are used only for supervisory and control mechanisms.Source: §2.4 · pp. 12–13
- Manufacturing security spans five CIM levels, from enterprise workflow decisions and plant management to supervision, process control, and sensor-actuator systems.The section also identifies business interruption, data breaches, cyber extortion, intellectual-property damage, and third-party claims as manufacturer cyber risks.Source: §2.4 · pp. 12–13
- Security practices include encryption and access controls, while PKI certificates can verify connected devices’ authenticity, configuration, and integrity.The section also names symmetric and hybrid encryption, hashes, digital signatures, and key-agreement and distribution protocols.Source: §2.4 · p. 13
- IDS can monitor dynamic security-system behavior for abnormal activity, but smart-manufacturing and IoT IDS research remains in its infancy because testbeds and real-incident data are limited.The section distinguishes knowledge-based from behavior-based detection and describes ROC curves as showing detection probability versus false-alarm likelihood.Source: §2.4 · p. 13
- The section cites industrial-control guidance from bodies and frameworks including JCS, NIST, DHS, and CPNI, and notes that major IT companies proposed platforms underpinning digital-city applications.It says Table 4 lists platform security challenges and solutions.Source: §2.4 · pp. 13–14
2.5. Layers, Models, and Technologies of DT
The section presents a four-layer digital-twin architecture as a comprehensive model while noting limited compatibility and functional granularity across existing layer models. It also points to DT protocols and their cybersecurity trade-offs.
2.5. Layers, Models, and Technologies of DT
- Existing DT layer models have limited compatibility and often lack the functional granularity needed for functional architectures; the section presents a four-layer model as one of the most comprehensive.Figure 6 is described as an adapted and modified architecture-and-layer diagram.Source: §2.5 · p. 14, Figure 6 · p. 14
- The section frames DTs as digital replicas using sensors, AI, and communication technology to mimic physical objects.The passage describes this capability as extending to fine detail.Source: §2.5 · p. 14
- Table 4 covers popular DT protocols and their definitions, strengths, and cybersecurity weaknesses.The supplied caption identifies the table’s scope but does not provide protocol-specific comparisons.Source: §2.5 · p. 15, Table 4 · p. 15
2.6. DTs Challenges
The section describes DT construction as a coordination challenge across CPS performance, data science, and optimisation. Its constraints include real-time service and scalability, data quality and volume, and coupled computation, communication, and control.
2.6. DTs Challenges
- A DT must represent spatial entities, objects, processes, and schedules while meeting quality-of-service and security requirements such as delay, reliability, scalability, distribution, privacy, and security.The section says addressing these challenges creates interdisciplinary research opportunities.Source: §2.6 · pp. 15–16
2.6.1. CPS Challenges
- CPS digital twins must reflect interacting network, computing, and control subsystems while meeting low-latency, high-reliability, and scalability requirements.The autonomous-driving example links accurate, fast virtual-counterpart calculations to driver and ecosystem safety, and notes that subsystem changes can affect overall CPS performance.Source: §2.6.1 · p. 16
2.6.2. Data Science Challengess
- Model-driven DT construction represents physical systems mathematically, while data-driven construction relies on collected state data; complex-system variables and data collection and selection complicate both approaches.The section identifies nonlinearity, high coupling, and time variability as challenges for mathematical models.Source: §2.6.2 · p. 17
- DT data challenges include uneven quality across sources, heterogeneous hardware, high-frequency sampling, and the storage and network burden of large data volumes.The section frames robust DT construction with minimal data and minimal adverse effect on effectiveness as a fundamental problem.Source: §2.6.2 · p. 17
2.6.3. Optimisation Challenges
- DT optimisation jointly involves computing, control, communication, and data analysis, including resource allocation, task offloading, control timing, and real-time feature extraction and prediction.Smart-manufacturing VR must deliver sensing data and execute control commands within latency constraints, so failure in one link can impair another.Source: §2.6.3 · pp. 17–18
- Distributed CPS makes optimisation harder because DTs add interactions among physical objects, virtual clones, other DTs, and human-control interfaces.The section also identifies limited resources, data selection, heterogeneous communication technologies, gateway costs and bottlenecks, and real-time latency as constraints; cited work used deep reinforcement learning to configure networks and sensor sampling rates.Source: §2.6.3 · pp. 18–19
2.7. Security and Privacy Challenges in DTs
DT security and privacy challenges arise across sensors, gateways, transmissions, digital systems, and user-facing services. The section describes integrity, confidentiality, authentication, and availability risks alongside mitigation approaches.
2.7. Security and Privacy Challenges in DTs
- Attackers can corrupt sensor data, compromise gateways, or inject false data directly into a DT, threatening the integrity of the connected physical-digital system.Because DTs are closely connected to physical objects, attacks on either side can adversely affect whole-system integrity.Source: §2.7 · p. 19
- Sensitive records and operational data require authentication for cyber-physical entities and communications, although implementing authentication on low-energy IoT devices is difficult.Sensors and gateways may also face DoS attacks or malware propagation.Source: §2.7 · p. 19
- The section identifies secure communication, access control, privacy regulations, anomaly detection, and user-level authentication as measures for protecting confidentiality and data integrity.It notes that traffic-camera data and vehicle locations can be sensitive, and that manipulated data can be detected at the application layer.Source: §2.7 · p. 20
- DDoS and malware can affect sensors and gateways, while large or time-consuming end-user queries can overload DTs; gateway traffic filtering, application-level mitigation, and load balancing are described as mitigations.Nearby low-load gateways can be used when a gateway is overloaded.Source: §2.7 · pp. 20–21
2.8. Security challenges by application
Security challenges vary by application, spanning infrastructure and monitoring weaknesses, health-data and ethical risks, and connected-vehicle threats. The section also identifies limited standardisation and security requirements as concerns for digital twins.
2.8. Security challenges by application
- Remote infrastructure, gaps in continuous monitoring, reactive security teams, and evolving attacker tactics complicate security across applications.The section describes sensitive data transfers as inadequately protected and notes that human teams do not monitor threats around the clock.Source: §2.8 · p. 21
2.8.1. Smart Cities
- Smart-city DTs support critical-asset maintenance, but remain vulnerable amid multiple attack levels, novelty, and limited standardisation and security requirements.The authors state that attack types depend on cybercriminals’ goals and discuss cybersecurity challenges for DTs with AI.Source: §2.8.1 · pp. 21–22
2.8.2. DT in Smart Health
- Healthcare DTs raise privacy, property-rights, and equity concerns, while their performance depends on high-quality, continuous data and protection against tampering.The section also flags data quality, privacy, possible racial bias, and healthcare professionals’ trust in AI modelling.Source: §2.8.2 · p. 22
- Collecting irrelevant personal data can increase hacking risk; healthcare DTs also face concerns about consent, data corruption, obsolescence, and overdiagnosis.The text calls for current security measures and reliable DTs whose data users cannot tamper with.Source: §2.8.2 · p. 23
2.8.3. DT in Smart Cars
- Connected and autonomous vehicles rely on wireless communication and complex sensors, making analysis of attacks and countermeasures important for mitigating threats.The section notes that wireless hazards may disrupt performance and result in serious incidents.Source: §2.8.3 · pp. 23–25
2.9. The potential uses of DTs in cybersecurity
The section describes DTs as potential cybersecurity tools for simulating attacks, testing virtual system replicas, and monitoring for intrusions. These uses may support security work without directly affecting live systems.
2.9. The potential uses of DTs in cybersecurity
- DTs offer three cybersecurity uses: testing secure designs, conducting penetration tests on virtual systems, and detecting intrusions in OT environments.The section frames these examples as a sample of potential applications and notes that improved anomaly detection alone does not thwart attacks without accelerated detection and response.Source: §2.9 · p. 25
- Simulated attacks can expose design weaknesses and inform more fault-tolerant systems before deployment, while architecture and traffic analysis can identify ways to reduce attack surface.The section gives smart grids, self-driving cars, and IoT blood-pressure monitors as example systems for attack simulation.Source: §2.9 · pp. 25–26
- Virtual DT representations allow comprehensive penetration testing without risking downtime on live ICS/OT production systems.The text says this approach can address more security risks while avoiding downtime.Source: §2.9 · p. 26
- DT-based intrusion detection can monitor mirrored OT system states and detect attacks rapidly without interfering with production.The passage describes feeding real-time information to intrusion-detection algorithms.Source: §2.9 · p. 26
3. Security and Threats in DT
The section surveys DT/IoT security challenges, attack paths across connected cyber-physical systems, and security goals drawn from literature. It emphasizes that connectivity and DT fidelity can shape both the risks and the prospects for detecting attacks.
3.1. Security Challenges in DT/IoT
- DT/IoT security is complicated by network scale, heterogeneous devices, continual connectivity and reconfiguration, and vulnerabilities including DDoS and injection attacks.The broader section also lists interoperability, trust, reliability, data quality, latency, and real-time simulation among DT challenges.Source: §3.1 · pp. 27–28, §3 · p. 27
3.2.1. Reconnaissance-based attacks
- Past DT/CPS incidents illustrate varied adversary tactics, while reconnaissance can include collecting system information, scanning ports and I/Os, and searching for vulnerabilities.The text notes that AI tools can enable cybercriminals to scan networks continuously.Source: §3.2 · p. 28, §3.2.1 · p. 29
3.2.2. Simulation and CPS
- Because DTs represent CPSs, attackers can record system inputs, outputs, and events, then use repeated simulations and trial-and-error learning to probe sensitive configurations.The account notes that attackers may target user settings and critical parameters, including when most CPSs are not connected to simulator versions in real time.Source: §3.2.2 · pp. 29–30
3.2.3. Targeting Physical system
- Infrastructure bugs and covert attacks can target physical systems; the Stuxnet example involved recording and altering signals to and from PLCs.The passage says AI and ML can continuously monitor system inputs and outputs during cybercriminal activity.Source: §3.2.3 · p. 30
3.2.4. Targeting the DT
- Attacks on DT assets can affect CPS performance, while deviations and data noise may be difficult to detect when attackers use legitimate system assets.The section describes DT monitoring as a possible way for security experts to detect bugs and intrusions, but also warns that attackers can correlate system trends and variables.Source: §3.2.4 · pp. 30–31
3.2.5. CPS/DT Hybrid targeting
- Stronger, more real-time CPS/DT connections can increase the likelihood of targeting both sides, while long preparation and AI-poisoned inputs complicate detection.The text says attacks may affect the DT without affecting the CPS and that specific countermeasures for silent attacks are not apparent.Source: §3.2.5 · p. 31
3.2.6. Lifecycle and DTs
- Across the DT lifecycle, AI models can be poisoned in their data, model, or algorithm, and transparency may expose them to exploitation.The section contrasts DT models that mimic system behavior with ML models that tend to acquire more knowledge, and notes that outdated CPS hardware or software can leave digital assets incomplete.Source: §3.2.6 · p. 32
3.3. DT’s security goals and threats
- The review organizes security goals and threats across sensor, network, and application layers, but notes that the literature lacks consensus on essential DT/IoT security goals.Terms can overlap, and the paper presents its goals based on existing literature.Source: §3.3 · pp. 32–33
4. AI in Cybersecurity
The section reviews AI’s dual role in cybersecurity, covering ML/DL approaches to intrusion detection, adversarial uses, and countermeasures for DTs. It discusses blockchain and gamified security assessment while noting an unresolved DT-to-CPS fidelity challenge.
4. AI in Cybersecurity
- AI adoption for cybersecurity is motivated by increasingly complex threats, while cybercriminals also seek to use AI and ML to their advantage.The section notes that AI-based attacks had remained rare in recent years, despite discussion of more powerful threats.Source: §4 · pp. 33–34
4.1. Explainable AI for Cybersecurity
- ML and DL support intrusion detection by classifying traffic and learning attack patterns, but feature selection and distributed real-time processing remain concerns.The review says these techniques can reduce false recognition rates relative to manual or statistical approaches.Source: §4 · pp. 35–36, §4.1 · p. 36
4.2. ML/DL in DT cybersecurity
- The review surveys ML/DL security across infrastructure, software, and traffic analysis, including supervised learning for signatures and unsupervised learning for unusual behavior.It notes that DL can reduce the effort required to redefine intrusion-detection rules and can also be used by attackers to steal or crack private information.Source: §4.2 · p. 37
4.3. Attacks via DTs
- Cybercriminals may employ malicious AI to thwart IoT intrusion-detection algorithms or turn beneficial AI against defenders.The section characterizes AI and ML tools as having both positive and negative uses.Source: §4.3 · p. 37, §4.4 · p. 37
4.4. Countermeasure Via DTs
- Blockchain is presented as a way to improve DT data reliability and security through distributed, trackable data, while gamification supports isolated security assessments and team learning.The section says the unresolved question of DT fidelity to CPSs makes the efficiency of blockchain and gamification difficult to establish.Source: §4.4 · pp. 38–39
5. Summary
The summary presents AI/ML as a means of detecting known and unknown cybersecurity threats to digital twins, while also recognizing AI-related threats and implementation drawbacks.
5. Summary
- Machine learning detected OceanLotus code disguised among meaningless combinations, a tactic that typical antivirus may miss.The paper says AI/ML can identify patterns resembling unknown virus strains and generate counterattack strategies.Source: §5 · p. 41
- AI creates both cybersecurity opportunities and threats for digital twins, with AI threats referenced in Table 13.Source: §5 · p. 41, Table 13 · p. 42
- AI-enabled attacks may become more accessible as financial and technological barriers decline, and AI/ML is not the only security challenge.The paper also says AI is difficult to implement at small scale, requires improvement, and has drawbacks compared with humans.Source: §5 · p. 42
- AI/ML can provide continuous oversight, detect distributed threats, learn new attacks, and address both unknown and catalogued agents.The paper also describes pattern detection and counterattack strategies for unknown threats.Source: §5 · pp. 41–42
6. Conclusion
The conclusion frames digital-twin cybersecurity as linked to cyber-physical-system security and reviews threats, attacks, and security tools. It calls for security attention during DT design while acknowledging that the breadth of applications makes full coverage difficult.
6. Conclusion
- Threats to a digital twin directly affect its cyber-physical system, and threats to the system can affect the twin in return.Source: §6 · p. 44
- The review examines applications and AI-based security tools, and argues cybersecurity should be addressed in the initial stages of DT design.Source: §6 · p. 44
- The wide range of DT applications makes it difficult to investigate all security risks, attacks, threats, and countermeasures.The paper presents DT security challenges as worth further exploration.Source: §6 · pp. 44–45