用因果数字孪生提升工业水系统安全，降低误报率74%
Causal Digital Twins for Cyber-Physical Security: A Framework for Robust Anomaly Detection in Industrial Control Systems
- 结合因果推断与数字孪生，实现异常关联、干预和反事实分析
- 在三个数据集上F1-score超0.9，误报率降低74%，根因定位准确率78.4%
- 适合工业控制系统安全研究者，支持实时检测与可解释防御
供水与处理系统的工业控制（ICS）面临网络与物理漏洞的联合攻击。现有异常检测依赖相关性，导致高误报率且难以定位根源。本文提出因果数字孪生（CDT）框架，融合因果推断与数字孪生建模，支持模式关联、系统响应干预及反事实分析，用于攻击预防。在SWaT、WADI和HAI三个水相关数据集上评估显示，CDT满足90.8%的物理约束，结构哈明距离为0.133±0.02。F1分数分别为：SWaT（0.944±0.014）、WADI（0.902±0.021）、HAI（0.923±0.018，p<0.0024）。CDT将误报减少74%，根因定位准确率达78.4%，反事实防御使攻击成功率下降73.2%。3.2毫秒延迟保障中等规模水系统实时、可解释运行。
原文摘要 · Abstract (English)
Industrial Control Systems (ICS) in water distribution and treatment face cyber-physical attacks exploiting network and physical vulnerabilities. Current water system anomaly detection methods rely on correlations, yielding high false alarms and poor root cause analysis. We propose a Causal Digital Twin (CDT) framework for water infrastructures, combining causal inference with digital twin modeling. CDT supports association for pattern detection, intervention for system response, and counterfactual analysis for water attack prevention. Evaluated on water-related datasets SWaT, WADI, and HAI, CDT shows 90.8\% compliance with physical constraints and structural Hamming distance 0.133 $\pm$ 0.02. F1-scores are $0.944 \pm 0.014$ (SWaT), $0.902 \pm 0.021$ (WADI), $0.923 \pm 0.018$ (HAI, $p<0.0024$). CDT reduces false positives by 74\%, achieves 78.4\% root cause accuracy, and enables counterfactual defenses reducing attack success by 73.2\%. Real-time performance at 3.2 ms latency ensures safe and interpretable operation for medium-scale water systems.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。