ICS Digital Twin

Anomaly Detection

Next.js · Three.js · Modbus TCP · OPC UA · Unsupervised ML · Anomaly Detection · IEC 62443 · ICS/OT Security · Closed Source

ICS Digital Twin — Anomaly Detection

Built and benchmarked a real-time Digital Twin platform (Next.js, Three.js, Modbus TCP/OPC UA) evaluating five unsupervised ML models against IEC 62443-aligned attack scenarios — achieving a top 71.6% F1-score in detecting stealthy ±2.5σ sensor spoofing attacks.

Overview

Architecture overview: industrial telemetry flows into an anomaly-detection testbed and live dashboard.

Architecture overview based on this project. This diagram is not a dashboard screenshot.

A real-time Digital Twin of an industrial control system (ICS) that mirrors live process telemetry and serves as a benchmarking testbed for detecting cyber-physical attacks against operational technology (OT) sensors.

Platform

  • Frontend / visualization: Next.js with a Three.js 3D digital twin of the monitored process.
  • Industrial connectivity: live sensor telemetry over Modbus TCP and OPC UA.
  • Threat model: attack scenarios aligned with the IEC 62443 industrial security standard.

Hardware-in-the-Loop Testbed

  • Python physics simulation of a water-treatment process wrapped in Modbus/TCP, exchanging data with a physical Siemens S7-1200 PLC at under 20 ms round-trip latency.
  • Edge intrusion detection (Random Forest + Isolation Forest) reached sub-500 ms time-to-detection, with SHAP values used to explain flagged traffic.
  • Latency and detection-time figures were measured across repeated test runs and recorded in the project logs.

Anomaly Detection Benchmark

  • Evaluated five unsupervised ML models against the IEC 62443-aligned attack scenarios.
  • Focused on stealthy ±2.5σ sensor spoofing — subtle manipulations designed to evade threshold-based monitoring.
  • Best-performing model reached a top 71.6% F1-score on the spoofing-detection task.

My Contribution and Evaluation Scope

Built the telemetry integration and 3D dashboard, and benchmarked five unsupervised models across four attack scenarios. The 71.6% F1 result refers to the project’s simulated ±2.5σ sensor-spoofing scenario. It is not a claim about detection accuracy in a deployed industrial plant.

The public write-up does not include dataset size, train/test separation, class balance, the winning model, or repeated-run variation. Those details are needed to reproduce the benchmark. IEC 62443 is used as a reference for the attack scenarios; this project does not claim certification.