Closed Source

ICS Digital Twin — Anomaly Detection

Next.js Three.js Modbus TCP OPC UA Unsupervised ML Anomaly Detection IEC 62443 ICS/OT Security

ICS Digital Twin — Anomaly Detection

Built and benchmarked a real-time Digital Twin platform (Next.js, Three.js, Modbus TCP/OPC UA) evaluating five unsupervised ML models against IEC 62443-aligned attack scenarios — achieving a top 71.6% F1-score in detecting stealthy ±2.5σ sensor spoofing attacks.

Overview

A real-time Digital Twin of an industrial control system (ICS) that mirrors live process telemetry and serves as a benchmarking testbed for detecting cyber-physical attacks against operational technology (OT) sensors.

Platform

  • Frontend / visualization: Next.js with a Three.js 3D digital twin of the monitored process.
  • Industrial connectivity: live sensor telemetry over Modbus TCP and OPC UA.
  • Threat model: attack scenarios aligned with the IEC 62443 industrial security standard.

Anomaly Detection Benchmark

  • Evaluated five unsupervised ML models against the IEC 62443-aligned attack scenarios.
  • Focused on stealthy ±2.5σ sensor spoofing — subtle manipulations designed to evade threshold-based monitoring.
  • Best-performing model reached a top 71.6% F1-score on the spoofing-detection task.