PaperlayerView exact revision on arXiv

Source-linked AI summary

Digital Twin-Assisted Mapping of ICS Telemetry to ATT&CK for ICS with Evidence-Driven Dependency Reasoning

Konstantinos E. Kampourakis, Vyron Kampourakis, Vasileios Gkioulos, Sokratis Katsikas

arXiv:2610.02955v1cs.CR

TL;DR

ICS telemetry records physical changes more directly than the adversarial actions that produced them. The paper uses a DT-assisted pipeline to preserve evidence while mapping observations to ATT&CK for ICS and linking hypotheses in a typed dependency graph. DT enrichment reduced annotation-relative false-positive episodes across three SWaT generations, but did not establish a general mapping advantage.

  • Problem

    ICS process observations expose physical changes more directly than the adversarial actions and dependencies that produced them, complicating reconstruction of attacker behavior.

    Source: §1 · pp. 1–2

  • Method

    A synchronized DT converts state changes into evidence-preserving descriptions for retrieval-augmented LLM mapping to ATT&CK for ICS and typed dependency reasoning.

    Source: §1 · p. 2, §3.2 · p. 10

  • Results

    Across three SWaT generations, DT enrichment reduced annotation-relative false-positive episodes in every run, but recall and F1 advantages were inconsistent and the mapping advantage did not transfer to BATADAL or WADI.

    Source: §5 · p. 20, §6 · p. 21

  • Takeaways & Limitations

    The findings characterize both the potential and failure modes of DT context for semantic security interpretation, without establishing reliable autonomous attribution or general causal reconstruction.

    Source: §6 · p. 21

    False positives are annotation-relative: an unmatched semantic hypothesis is not thereby proven universally incorrect.

    Source: §4.4 · p. 14

Abstract

from arXiv · show

Reconstructing adversarial behavior from Industrial Control System (ICS) telemetry is difficult because process observations reveal physical changes more directly than the actions that produced them. This paper presents a Digital Twin (DT)-assisted framework that extracts synchronized state changes, converts them into evidence-preserving descriptions, maps them to ATT&CK for ICS through retrieval-augmented Large Language Model (LLM) reasoning, and constructs a typed dependency graph. Evaluation comprises a four-configuration ablation on nine held-out SWaT scenarios containing ten telemetry-evaluable ground-truth episodes, three independent generations of the principal mapping configurations, and external evaluation on BATADAL and WADI. Across the three SWaT generations, DT-enriched mapping produces fewer annotation-relative False Positive (FP) episodes in every run, with a mean per-run reduction of 34.1%. Both configurations obtain a mean recall of 0.633, although recall varies between 0.50 and 0.70 and DT enrichment does not improve F1 in every run. These observations are descriptive: the primary-run paired comparisons do not reach statistical significance, and the mapping advantage does not transfer to either external dataset. An exploratory positive-only dependency benchmark recovers eight of nine documented Co-occurrence relationships with DT context. A separate end-to-end benchmark containing one positive pair and 25 negative controls exposes propagation of mapping errors into unsupported edges. The findings identify both the potential and limitations of DT context for semantic security interpretation, without establishing reliable autonomous attribution, general causal reconstruction, or practical analyst benefit.

1. Introduction

ICS telemetry often shows physical effects more clearly than the adversarial actions and dependencies that produced them. The paper proposes a DT-assisted pipeline for evidence-preserving ATT&CK mapping and typed dependency reasoning, with evaluation showing conditional reductions in unsupported hypotheses rather than general superiority.

1. Introduction

  • The framework turns synchronized DT state changes into structured evidence, maps them to ATT&CK for ICS using retrieval-augmented LLM reasoning, and organizes time-indexed hypotheses in a typed dependency graph.Its objective is to structure evidence for investigation, not establish complete attacker provenance or physical causality from historian telemetry alone.Source: §1 · p. 2
  • The DT contextualizes security-relevant changes using assets, process variables, actuator and controller states, nominal behavior, temporal history, and operational relationships.Source: §1 · p. 2
  • The mapping pipeline retains the observations supporting each ATT&CK attribution while using frozen hybrid retrieval and structured LLM inference.Source: §1 · p. 2
  • DT enrichment reduced annotation-relative false-positive hypotheses in each evaluated SWaT generation, but the evidence did not establish statistically significant superiority or consistent cross-dataset benefit.The evaluation also examines generation variability, external datasets, and stage-wise failure modes.Source: §1 · p. 2
  • The exploratory dependency work represents relationships among time-indexed ATT&CK hypotheses and tests both operational coordination and propagation of incorrect upstream mappings into unsupported edges.Source: §1 · p. 2

2. Background and Related Work

The related work spans ATT&CK mapping, DT-assisted ICS cybersecurity, and cyber-physical attack graphs, which have largely developed independently. The paper positions its contribution as integrating these capabilities around observed process evidence.

2.1. ATT&CK for ICS

  • ATT&CK for ICS provides a technology-independent semantic layer for adversarial behavior, but telemetry usually records effects rather than proving the action that caused them.The framework preserves links from technique observations to assets, process stages, timestamps, confidence, evidence levels, and state changes.Source: §2.1 · p. 3

2.2. Semantic ATT&CK Mapping

  • Prior semantic ATT&CK mapping commonly starts from text that already describes adversarial behavior, whereas ICS historian data require numerical cyber-physical behavior to be translated into evidence suitable for semantic interpretation.The proposed DT verbalizations preserve asset, process stage, variable role, temporal evolution, deviation from normal behavior, and operational context.Source: §2.2 · p. 3

2.3. DTs for ICS Cybersecurity

  • Reviewed DT approaches support secure synchronization, experimentation, expected-state estimation, runtime verification, and anomaly detection, while semantic incident reconstruction from DT context is less explored.The proposed framework uses synchronized state to interpret ATT&CK behavior and relate observations as an incident evolves.Source: §2.3 · p. 4

2.4. Attack Graphs for CPS

  • Prior cyber-physical attack graphs generally derive dependencies from explicit system or attack models, while the proposed graph relates ATT&CK observations inferred from DT state changes.Candidate relations use temporal compatibility, process stage, asset context, operational relationships, and semantic reasoning; typed edges distinguish causal, temporal, and co-occurrence relations, with None allowing abstention.Source: §2.4 · p. 4

2.5. Positioning of the Proposed Work

  • The comparison positions the work at the intersection of DT context, telemetry-based ATT&CK interpretation, and evidence-conditioned typed graph construction.The paper also identifies a tension: DT context may disambiguate sparse evidence while making an incorrect upstream hypothesis appear operationally plausible during dependency inference.Source: §2.5 · p. 5, Table 1 · p. 5

3. DT-Centered System Architecture

The framework uses a synchronized Digital Twin (DT) to contextualize ICS telemetry, map state changes to ATT&CK for ICS, and build an evolving graph of typed dependencies. Its six stages move from telemetry normalization and state-change extraction to analyst-oriented graph views.

3. DT-Centered System Architecture

  • The six-stage architecture links telemetry normalization, DT synchronization, state-change verbalization, retrieval-augmented ATT&CK mapping, typed dependency inference, and graph analysis.The DT supplies persistent state and contextual reasoning; attack labels are withheld during inference.Source: §3 · p. 6

3.1. Formal Model

  • The DT state combines modeled assets and process relationships with physical and cyber-control states and retained history; attack labels are excluded from its inference inputs.The state-change function forwards changes meeting frozen criteria, including transitions, nominal-range deviations, large rates of change, and persistent abnormalities.Source: §3.1 · p. 7

3.2. Operational Pipeline

  • State changes are verbalized with timestamp, asset, process, prior and current state, nominal range, related-asset state, persistence, and recent history.Unavailable context is marked unknown or omitted, and descriptions avoid labeling events malicious while retaining traceable observations.Source: §3.2 · p. 9
  • Retrieval-augmented mapping uses event descriptions and cyber-physical context to select ATT&CK for ICS techniques, while permitting NoMatch for ambiguous deviations.The subsequent dependency stage restricts candidate pairs by time and DT context, then classifies them as Causal, Temporal, Co-occurrence, or None; low-confidence and None edges are excluded.Source: §3.2 · pp. 9–10
  • Accepted graph edges retain relation type, inference confidence, and supporting evidence; Causal edges are inferred enabling relationships, not definitive proof of causation.Graph views support investigation and qualitative progression analysis, but full attack-path reconstruction and graph-centrality accuracy are not independently validated.Source: §3.2 · p. 10

4. Experimental Evaluation

The evaluation uses SWaT for held-out mapping and dependency experiments, with BATADAL and WADI for external mapping validation. Ground truth separates documented adversarial behavior from telemetry observability and the strength of the evidence available for mapping.

4.1. Experimental Setup

  • SWaT is the primary benchmark for mapping ablation and dependency experiments, while BATADAL and WADI provide external mapping validation.Dependency performance is not reported for BATADAL or WADI because their scenario documentation lacks sufficiently complete action-level dependency ground truth.Source: §4.1 · p. 10
  • The held-out SWaT mapping benchmark contains nine scenarios, and the principal mapping configurations are independently run three times without retuning.All seven documented BATADAL attacks and fourteen corrected WADI temporal attack scenarios are retained for external validation, including scenarios without a telemetry-evaluable primary node.Source: §4.1 · p. 11

4.2. Ground-Truth Construction

  • Ground truth separates scenario truth, telemetry observability, and evidence level, preventing physical consequences from automatically counting as direct evidence of an attack mechanism.Two authors independently annotated these elements and dependency relationships, resolving disagreements through discussion.Source: §4.2 · p. 11
  • SWaT command-message nodes without a recorded malicious command artifact remain scenario truth but are excluded from quantitative mapping recall.Manipulated sensor reports are telemetry-evaluable when the falsified process value is visible in the historian, even if the underlying network message is absent.Source: §4.2 · pp. 11–12
  • The five SWaT coordination scenarios yield nine documented action pairs, all labeled Co-occurrence because documentation does not establish reliable ordering or directional causality.No Causal or Temporal relation is inferred solely from historian timing.Source: §4.2 · p. 13

4.3. Ablation and Baseline Configurations

The mapping ablation varies structured evidence, verbalization, ATT&CK retrieval, and DT structural context. The M3–M4 comparison isolates the incremental contribution of structural context while holding evidence windows and retrieval outputs constant.

4.3. Ablation and Baseline Configurations

  • M1 uses structured evidence without RAG, M2 adds verbalized DT events without RAG, M3 adds ATT&CK retrieval without structural DT context, and M4 combines DT context with RAG.M4 is the complete proposed mapping pipeline.Source: §4.3 · p. 13
  • M3 and M4 share evidence windows, retrieved candidates, thresholds, and episode rules; only M4 supplies process relationships, control roles, and upstream/downstream context.This contrast tests structural context during semantic mapping conditional on shared DT-derived evidence and retrieval outputs.Source: §4.3 · p. 13
  • Dependency configurations include a time-only heuristic, deterministic DT rules, an LLM without DT structural context, and a DT-aware LLM.D1 labels overlaps Co-occurrence and nearby non-overlaps Temporal; D3 omits process-stage semantics, control roles, and topology, while D4 receives them.Source: §4.3 · p. 13

4.4. Evaluation Metrics

Mapping metrics use strict episode matches, while dependency experiments assess edge existence under limited or imbalanced ground truth. The evaluation also treats unmatched predictions as annotation-relative and notes the resulting limits on interpretation and statistical power.

4.4. Evaluation Metrics

  • Episode-level micro Precision, Recall, and F1 require agreement on technique, process stage, asset evidence, and temporal interval; macro F1 covers scenarios with primary ground-truth nodes.Predictions in zero-node scenarios still contribute false positives, although those scenarios are excluded from the macro-F1 denominator.Source: §4.4 · p. 13
  • Paired per-scenario F1 comparisons use the Wilcoxon signed-rank test, but nine held-out scenarios provide limited statistical power.Failure to reach significance does not establish equivalence or absence of an effect; generation variation is summarized descriptively.Source: §4.4 · p. 14
  • Unmatched episodes are annotation-relative False Positives, not proof that every unmatched semantic hypothesis is universally incorrect.A genuine abnormal process behavior can still count as a false ATT&CK attribution when evidence does not support the documented adversarial mechanism; scores therefore assess semantic attribution, not binary anomaly detection.Source: §4.4 · p. 14
  • The positive coordination benchmark has nine positive Co-occurrence pairs and no negatives, so precision and F1 cannot estimate false-positive predictions.It reports pair accuracy, coordination recall, and abstention rate instead.Source: §4.4 · p. 14
  • The end-to-end benchmark contains one observable positive edge and 25 negative controls, making positive-edge Recall and F1 highly uncertain.Its edge metrics evaluate existence independently of relation type, so edge recall does not measure relation-label accuracy.Source: §4.4 · p. 14
  • Graph Edit Distance and full attack-path recovery are not primary metrics because SWaT documentation lacks a sufficiently complete, directionally annotated multi-relation graph.Source: §4.4 · p. 14

4.5. ATT&CK Mapping Results

The frozen SWaT run favors M4, chiefly through fewer false positives, but paired tests are nonsignificant. Across three generations, false-positive reductions persist while recall and F1 gains vary.

4.5. ATT&CK Mapping Results

  • In the frozen primary run, M4 reached micro F1 0.1687 and macro F1 0.2501, with micro Precision 0.0959.The nine held-out scenarios contain ten telemetry-evaluable ground-truth episodes.Source: §4.5 · p. 14, Table 3 · p. 15
  • M3 and M4 each recovered seven of ten episodes (recall 0.70); M4 reduced false positives from 119 to 66 and raised micro F1 from 0.1029 to 0.1687.The primary-run difference is false-positive suppression rather than increased recall.Source: §4.5 · p. 15
  • Despite descriptive preference for M4, paired tests were nonsignificant (all p > 0.05), and several scenarios had zero F1.The reported tests were M4–M1: 0.0625, M4–M2: 0.1094, and M4–M3: 0.0781.Source: §4.5 · p. 15

4.6. LLM Generation Variability

  • Across three runs, M4 reduced false-positive episodes by a mean 34.1%; both averaged recall 0.633, while recall and F1 advantages varied.Recall ranged from 0.50 to 0.70, and M4 did not exceed M3 in every realization; three generations provide only a limited descriptive assessment.Source: §4.6 · pp. 15–16, Table 4 · p. 16
  • The frozen cross-dataset comparison shows that the SWaT improvement did not transfer to BATADAL or WADI.Source: Table 5 · p. 16

4.7. Cross-Dataset External Mapping Validation

The frozen external evaluation does not reproduce the SWaT advantage: M4 underperforms M3 on BATADAL and WADI. Stage-wise results locate important limits in telemetry evidence and retrieval availability.

4.7. Cross-Dataset External Mapping Validation

  • On BATADAL, M4’s F1 was 0.0387 versus M3’s 0.0615; on WADI, F1 was 0.0253 versus 0.0265, so M4 did not outperform M3 externally.WADI recall was 0.375 for both variants; BATADAL M3 obtained four true positives and M4 three.Source: §4.7 · p. 16
  • WADI’s correct target reached frozen top-8 retrieval for only three of eight nodes; both variants mapped those three, leaving recall at the 0.375 candidate-availability ceiling.The largest loss occurred before semantic selection, as one node was lost during DT extraction and several targets were absent from retrieval candidates.Source: Table 6 · p. 17, §4.7 · p. 17
  • Sparse hourly BATADAL telemetry supplies process context without equivalent adversary-specific artifacts, allowing plausible but unsupported interpretations.The external results indicate that added operational context cannot compensate for missing adversary-specific evidence.Source: §4.7 · pp. 16–17
  • BATADAL retained five of six primary nodes through DT evidence extraction and retrieval, after which M3 mapped four and M4 mapped three.One reporting-manipulation target lacked an eligible DT evidence window; remaining misses followed successful retrieval.Source: §4.7 · pp. 16–17
  • The external results qualify SWaT: DT context may constrain an already relevant interpretation, but in weakly observable settings it can broaden unsupported ATT&CK hypotheses.Downstream reasoning cannot recover a documented behavior removed by an earlier extraction or retrieval stage.Source: §4.7 · p. 17

4.8. Parameter Sensitivity and Robustness

Sensitivity checks and dependency experiments characterize where DT context helps relate observations and where it can support unsupported edges. Results are bounded by the small, selected benchmarks and do not establish general relation-classification performance.

4.8. Parameter Sensitivity and Robustness

  • Across mapping thresholds 0.50–0.65, M4 retained higher micro F1 than M3, but at 0.70 both rejected all true-positive episodes.Confidence values are not calibrated probabilities, and increasing the threshold did not necessarily yield a useful high-precision operating point.Source: §4.8 · p. 17

4.9.1. Documented Multi-Point Coordination

  • D4 recovered eight of nine documented Co-occurrence relations with DT context, while D3 inferred none without structural context.D1 also recovered all nine using a broad interval-overlap heuristic, so the benchmark does not demonstrate superiority over simple temporal reasoning.Source: §4.9.1 · p. 18

4.9.2. End-to-End Edge Specificity

  • D4 recovered the sole positive edge and rejected 12 of 25 negative controls, yielding 13 false edges and specificity 0.48 on the selected benchmark.Because the benchmark has only one observable positive edge, recall and balanced accuracy are not stable estimates of general performance.Source: §4.9.2 · p. 18, Table 8 · p. 19

4.10. Dependency Error Analysis

  • Twelve of D4’s 13 false edges linked pairs with explicit DT operational coherence, including eight sequential-operational and four overlap-operational pairs.Only one false edge involved an overlap-only pair, and none involved a sequential-unrelated pair.Source: §4.10 · p. 19
  • False-edge rationales treated temporal proximity and operational context as evidence of attack progression, including interpreting process pathways as evidence that one action caused or enabled another.Nine false edges joined two mapping false-positive nodes, and the other four joined one true-positive node and one false-positive node; none joined two correctly mapped nodes.Source: §4.10 · p. 19
  • Operational connectivity can prioritize events for joint analysis, but does not itself establish adversarial dependency or attacker-induced causality.Causal edges require stronger corroboration, such as command provenance, attributable state transitions, or additional security telemetry.Source: §4.10 · p. 19

4.11. Case Study: SWaT A39 Graph Reconstruction

The A39 reconstruction links two correctly mapped telemetry episodes but assigns a stronger relation type than the scenario documentation supports.

4.11. Case Study: SWaT A39 Graph Reconstruction

  • The two true-positive nodes correspond to T1692.002 (Reporting Message) episodes associated with FIT401 in P4 and AIT502 in P5.The frozen mapping output also contains two false-positive episodes, which are omitted from the graph updates.Source: §4.11 · p. 19
  • Figure 2 traces successive graph updates for two correctly mapped episodes, then introduces a relationship that the documentation supports only as Co-occurrence.D4 instead labels the relationship Causal with confidence 0.72; the graph updates show evidence availability, not verified attacker-action ordering.Source: §4.11 · pp. 19–20, Figure 2 · p. 20

5. Discussion

DT enrichment reduced annotation-relative false-positive episodes in every evaluated SWaT generation, but the discussion emphasizes variability, external limits, and risks from dependency reasoning.

5. Discussion

  • DT enrichment lowered annotation-relative false-positive counts in all three SWaT generations, but recall varied, F1 did not improve every run, and primary-run paired comparisons were not statistically significant.M4 did not outperform M3 on either BATADAL or WADI, so the observed SWaT pattern does not establish a general mapping advantage.Source: §5 · p. 20
  • DT context can help relate operationally coherent observations, yet it can also connect incorrect mapping hypotheses through plausible-looking edges.In the A39 case, the relationship was plausible while the predicted Causal semantics exceeded the documented Co-occurrence evidence; directional claims need corroboration.Source: §5 · p. 20
  • Potential review burden is substantial in frozen M4 outputs, but analyst workload and practical benefit remain unmeasured.The study does not include a non-generative retrieval baseline, and analyst-facing use would require evaluating prioritization, abstention, and investigation cost.Source: §5 · p. 20
  • Ground truth is annotation-relative and non-exhaustive, evaluations cover only water-sector CPSs, and the dependency benchmarks are too limited to establish general Temporal or Causal classification performance.The positive benchmark contains only Co-occurrence relations, while the end-to-end benchmark has one observable positive edge and 25 selected negative controls.Source: §5 · p. 21

6. Conclusion

The conclusion characterizes DT-assisted semantic reasoning as promising but bounded by inconsistent mapping results and dependency-error propagation.

6. Conclusion

  • Across three SWaT generations, DT enrichment reduced annotation-relative false positives in every run, but recall varied, F1 gains were inconsistent, and the advantage did not transfer to BATADAL or WADI.Exploratory dependency experiments found both coordination-recognition value and propagation of mapping errors into plausible operational edges.Source: §6 · p. 21

CRediT authorship contribution statement

Konstantinos E. Kampourakis led conceptualization, methodology, software, and validation; the four authors shared writing and review, while Vasileios Gkioulos and Sokratis Katsikas also supervised.

CRediT authorship contribution statement

Loading 2610.02955v1…