Digital Twins for Detection, Localisation, and Attribution of Cyberattacks
Year: 2026
Type: article
Abstract: The increasing dependence of active distribution networks on synchronized measurements and communication-based monitoring has introduced significant vulnerabilities to false data injection (FDI) and coordinated stealth cyberattacks. This paper presents a per-node digital twin (DT)-based framework for cyberattack detection, localisation, and attribution in the IEEE 33-bus radial distribution network. The proposed framework integrates distribution-level phasor measurement unit (D-PMU) data, node-specific digital twin predictions, residual analysis, cumulative sum (CUSUM)-based anomaly detection, persistence verification, and watermark-assisted validation. Four digital twins corresponding to buses 9, 13, 28, and 33 are considered to evaluate identification accuracy and attack detection performance. The estimated time constants range from 19.91 to 19.95 ms against a reference value of 20.00 ms, resulting in relative errors between 0.25% and 0.45%, with an average error of 0.325%. Under a ramp FDI attack targeting bus 33, the node-specific residuals reveal progressively increasing measurement deviations, with attack confirmation reported at approximately 2.52 s. Furthermore, a coordinated stealth attack involving buses 9 and 13 demonstrates how oppositely signed measurement manipulations can conceal abnormalities in aggregated monitoring indicators. The per-node detection framework preserves individual residual signatures and identifies the affected nodes, with attack confirmation reported at approximately 2.50 s. The results demonstrate the potential of combining spatially resolved digital-twin monitoring with sequential anomaly detection to identify gradual, coordinated cyberattacks. The proposed framework provides a promising approach for improving measurement integrity, attack localisation, and cyber-physical situational awareness in active distribution networks.
Author: Harsh Pathak, Rajeev Thakur
Language: English
Subfield: Control and Systems Engineering
Field: Engineering
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7225737245
FWCI:
Cites:
Cited by:
Related to: