# Enhancing Data Integrity with CSDT: A Solution to Predict Data Disturbance in IoT Systems

Meriem Smati, Jannik Laval, Vincent Cheutet, Christophe Danjou

► To cite this version:

Meriem Smati, Jannik Laval, Vincent Cheutet, Christophe Danjou. Enhancing Data Integrity with CSDT: A Solution to Predict Data Disturbance in IoT Systems. 21st IFIP International Conference on Product Lifecycle Management (PLM 2024), Jul 2024, Bangkok, Thailand. hal-04673726

HAL Id: hal-04673726

https://hal.science/hal-04673726v1

Submitted on 14 May 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Enhancing Data Integrity with CSDT: A Solution
to Predict Data Disturbance in IoT Systems

Meriem Smati¹,²[0009-0006-9399-3356], Jannik Laval¹[0000-0002-7155-5762], Vincent Cheutet¹[0000-0003-1920-2609], and Christophe Danjou²[0000-0002-9575-0087]

¹ INSA Lyon, Université Lumière Lyon 2, Université Claude Bernard Lyon 1, Université Jean Monnet Saint-Etienne, DISP UR4570, Villeurbanne, 69621, France
meriem.smati@insa-lyon.fr, jannik.laval@univ-lyon2.fr, vincent.cheutet@insa-lyon.fr

² Laboratoire Poly-Industrie 4.0, Département de Mathématiques Et Génie Industriel, Polytechnique Montréal, Montréal, Québec, Canada
christophe.danjou@polymtl.ca

**Abstract.** With the rapid growth in popularity of Digital Twins (DTs), there is a pressing need to ensure data integrity within Internet of Things (IoT) systems. The complexity of potential anomalies in Internet of Things (IoT) data requires mechanisms that can evaluate these behaviors and understands them in advance without disrupting live systems. DTs offer a solution by replicating physical systems in a virtual environment, allowing new functionalities like monitoring, optimization, and prediction. To improve these functionalities, cognitive capabilities are encompassed, leading to the emergence of Cognitive Digital Twin (CDT). The findings of this research underscore the transformative impact of CDTs in strengthening IoT system security, realized by harnessing the capabilities of cognitive technologies and the additional layer of data generation that introduce the new framework "Cognitive Super Digital Twin" (CSDT).

**Keywords:** Digital Twins · Internet of Things · Model-Driven Engineering · Machine Learning · Data Integrity.

# 1 Introduction

Amid the ongoing evolution and widespread adoption of IoT devices in today's data-driven world, a key challenge is ensuring uninterrupted functionality in the face of potential disruptions like cyber-attacks, power outages, physical damage, and data anomalies. Many traditional approaches exist to mitigate such risks, for example incorporating redundancy and failover mechanisms into the design of infrastructure and industrial systems [10]. Redundancy entails integrating backup devices, networks, or data centers to enable system continuity in case of component failure. However, implementing this methodology would require a significant investment of both finances and resources.
Nevertheless, this paper focuses on addressing data anomalies, also referred to as outliers, aberrations or irregularities, which pose a significant hurdle in the current data-centric era. These anomalies represent deviations from expected behavior within interconnected IoT networks. Detecting and understanding these anomalies are vital for ensuring system reliability and integrity across various sectors like manufacturing, healthcare, agriculture, and smart cities. But predicting problems in advance is even better.

Rather than relying solely on conventional methods to tackle anomalies i.e redundancy, a more cost-effective digital solution emphasizing data integrity preservation is proposed. In this context, DTs technology emerges as a promising strategy, particularly the concept of CDTs [2]. A CDT refers to a virtual representation of a physical or digital entity that possesses the ability to perceive, analyze, learn, and make decisions in a manner similar to human cognition<fnref n="3" /> [18]. It leverages Artificial Intelligence (AI) more particularly Machine Learning (ML) to replicate the cognitive processes and behaviors of its real-world counterpart.

Therefore the research objective of this paper is the following:

**How can DT be used as a tool for detecting and preventing data disturbance in an IoT system?**

To reach this objective, the paper is organized as follows. After reviewing a general introduction in Section 1, Section 2 covers the reviewed literature on IoT and Data anomalies as well as the use of DT as a prevention tool. The realised framework and its architecture is given in Section 3 and its application on a use case is in Section 4. And to conclude this article, Section 5 allows to see the solved problems as well as the limits and the future works.

# 2 Related Works

## 2.1 IoT Data Anomalies

Anomalies in IoT can be caused by multifaceted factors. These factors include not only unintentional occurrences or technical malfunctions, but also deliberate and malicious intrusions orchestrated by external actors who aim to exploit vulnerabilities and disrupt the smooth operation of these IoT systems.

Mishra et al. [11] discuss the detection of data anomalies in pervasive IoT systems, emphasizing the importance of validating input data to prevent severe consequences. The main focus was on two types of anomalies: data bias anomalies, where sensor values are forced to extreme values, and sensor cut-off anomalies, where sensors stop sending data. These anomalies can result from accidents, hardware or software failures, or cyberattacks. The study proposes using statistical techniques, specifically control charts, for anomaly detection in IoT systems. It highlights the challenges in differentiating the heterogeneity of edge networks normal from abnormal behavior in IoT. Another challenge is the importance of standardized datasets for evaluating IoT systems and a huge

<footnote n="3">³ https://fuseforward.com/cognitive-digital-twins/</footnote>
amount of data, especially abnormal ones, to do the training of the detection models.

Fahim et al. [4] presented a literature review and recognized that anomalies in data streams are crucial for optimizing system performance. Challenges include defining normal/abnormal boundaries and scarcity of abnormal observations for model training. Steps for anomaly detection include understanding data nature and structure, identifying anomaly types, and considering availability of training data. Statistical methods, ML techniques, and Deep Learning (DL) models are employed for anomaly detection, with each having its advantages and limitations. Research gaps include the need for easier access to real system data and the development of methods to handle complex data.

Yasaei et al. [17] propose an adaptive context-aware anomaly detection method for IoT systems using sensors and a fog computing platform. The method includes a sensor association algorithm, a predictor model with Long Short-Term Memory (LSTM) neural network and Gaussian estimator, and a consensus algorithm to identify anomalies and their source. The paper addresses challenges such as multi-variant time-series data, resource-constrained sensors, and dynamic characteristics of IoT systems. The contributions include a context-aware sensor association algorithm, a consensus-based strategy for unsupervised anomaly detection, and an adaptive data-driven model.

Riahi et al. [13] consists of a simulation platform for an IoT system that takes into consideration only sensors due to their communication with the real-world and them being a target for many hacks and disturbances. The faulty IoT Network generates many sensor and data disturbance such data alteration and data deletion.

Various facets of anomaly detection and prediction have been addressed and contributions concerning different attacks have been discussed. However, the subject of data anomaly detection poses several significant challenges. The first and foremost challenge involves the complexity of distinguishing between data that is considered normal in one scenario but abnormal in another, as highlighted in Mishra et al. [11]. An even more daunting challenge lies in the prediction and prevention of these outliers. Creating genuine anomalous behaviors is a formidable task due to the resource-intensive nature of the process or, in some cases, due to inherent system limitations, as discussed in Fahim et al. [4]. In Subsection 2.2, we explore potential solutions, including the utilization of DTs to replicate physical assets into virtual ones.

## 2.2 The Use of DT and Data Anomalies

DTs have several definitions depending on the domain of application. This concept has been first defined by Michael Grieves in his Product Lifecycle Management (PLM) course in 2002 as a virtual representation of a physical asset that serves as the effective counterpart to the real-world object [6]. And it consists of the physical object, the digital representation of the object and the communication channel between the physical and virtual representations [16]. In the field of IoT, it can be defined as virtual representation of system that is created
using data from connected IoT sensors. It allows and facilitate the monitoring of devices, assets, or processes from anywhere<fnref n="1" />.

DTs have two types [9]:

- *Dynamic DT*: it is a type of DT that is fed by live data flows from the physical asset, it needs real-time updates and impact the Physical Twin (PT) at the same moment.

- *Static DT*: it gives periodic updates to the PT.

Concerning the level of magnification the DT replicates, there are four types<fnref n="2" />:

- *Component Twin*: it is the creation of a model or a twin to each individual small asset.

- *Asset Twin*: it represents when two or more components work together.

- *System Twin/Unit Twin*: this is considered as the next level of magnification, enabling to see how different assets come together to form an entire functioning system.

- *Process Twin*: It is the realization of an entire business process or customer journey and it is considered to be the macro level of magnification.

Regarding the CDT, it is an evolution of DT that integrates advanced learning and self-discovery capabilities using AI functions<fnref n="3" />. They are capable of achieving some elements of cognition, notably memory (encoding and retrieval), and can learn and evolve, integrating different sources of information for a specific purpose [3]. They are distinguishable by six key functionalities<fnref n="4" />:

- *Perception*: it involves the creation of useful and meaningful representations of data related to the PT and its surroundings for further processing.

- *Attention*: it is the act of selectively focusing on a task or a specific sensory information.

- *Memory*: it encompasses three types of memories. The working memory used for active use, the episodic memory for recalling episodes from the PT's life and semantic memory for retaining knowledge about the environment and its interactions with the PT.

- *Reasoning*: drawing conclusions that align with a starting point or memories.

- *Problem-solving*: it is the systematic process of identifying a solution for a given problem.

- *Learning*: a transformative process of converting the experience of the PT into reusable knowledge for new experiences like foreseeing the future and act accordingly.

Below are few works that have utilized DTs for prediction and fault detection:

<footnote n="1">¹ https://www.networkworld.com/article/3280225/what-is-digital-twin-technology-and-why-it-matters.html, last access in 21/11/2023</footnote>

<footnote n="2">² https://www.ibm.com/topics/what-is-a-digital-twin, last access in 21/11/2023</footnote>

<footnote n="3">³ https://fuseforward.com/cognitive-digital-twins/, last access in 21/11/2023</footnote>

<footnote n="4">⁴ https://fuseforward.com/cognitive-digital-twins/</footnote>
- Saraeian et al. [14] provide a detailed discussion a fault tolerance approach for predicting and detecting faults in Cyber-Physical Production Systems (CPPS) using a digital twin-based architecture. The proposed approach utilizes an extraction module to efficiently extract fault signatures and a prediction module to generate appropriate responses based on the extracted faults. The results show that the approach can predict reliable fault signatures and maintain CPPS at optimal levels. The proposed component aims to reduce complexity and improve fault detection and maintenance in CPPS. Yet this contribution has limitations since it is highly dependent on historical data and on the complexity of the production system and the accuracy of DTs.

- Flammini [5] discusses the concept of DT as a promising paradigm for modeling and predicting the performance of Cyber-Physical Systems (CPS). It focuses on data-driven evaluation and prediction of dependability attributes, as well as the challenges of addressing resilience in CPS. The contribution consists of a conceptual framework for hosting DT run-time models based on autonomic systems, and discusses the hierarchical architecture and trade-offs involved in implementing DT at different levels. However, this framework has several limitations due to CPS's sizes, heterogeneity, distribution, and criticality.

- Savaglio et al. [15] introduce the concept of Opportunistic Digital Twin (ODT) which combines AI, Edge Intelligence (EI) and DT technology to enhance applications. A use case of traffic prediction has been presented to demonstrate the improved performance and reduced network resources consumption where an LSTM Recurrent Neural Network (RNN) model trained on traffic intensity, air pollution, and atmospheric data has been used.

- Haidar et al. [8] conduct a review on the DT technology for fault detection in buildings. The study emphasizes that prediction plays a crucial role in Digital Twin technology. AI, such as ML and data analytics, is used to forecast the future behavior and health condition of the physical asset. Predictions are based on measured input and output values, as well as initial circumstances. The study acknowledges the ongoing debate about the maturity level required for accurate predictions and warnings about the asset's performance. It also mentions the importance of big data prediction strategies, which often involve ML or data mining techniques.

As observed in various literature sources and the reviewed studies, they collectively tackle the critical challenge of detecting anomalies in IoT systems either by using statistical methods, DTs or CDTs. Emphasis is placed on validating input data to avert severe consequences which leads to a noteworthy challenge. The DT relies fully and is intricately linked to the data provided by its counterpart, the PT. And like any IoT system, the normal collected data instances are more than the collected abnormal ones resulting an imbalanced dataset, so when aiming to train the prediction model of the CDT, a substantial waiting period is often necessary to achieve accurate results. To circumvent this challenge, a new approach needs to be established to address the data scarcity issue,
thus enhancing the efficiency and effectiveness of the prediction model training
process.

## 3 CSDT Proposal

IoT systems rely on a multitude of sensors and interconnected devices, have proven to be invaluable in enhancing efficiency and convenience. However, the seamless operation of IoT systems is not without its challenges. In the pursuit of ensuring the reliable and secure operation of IoT systems, the novel concept of CSDT is created.

### 3.1 Problematic

Before delving deeper in the CSDT concept, it is imperative to address the prob-
lems and issues that led to this contribution and it encompasses the following:

- Data imbalance, since IoT systems generally generate normal data, but anomalies are rare in comparison. This data imbalance poses a significant challenge when it comes to training models to detect abnormal behavior effectively,

- Behavioral Variability concerning what constitutes "normal" or "abnormal" behavior in IoT systems is not always straightforward. Behavior may vary with factors such as season, location, or context, making it difficult to establish clear boundaries,

- Traditional DT reliance on PT data, so data anomaly has to occur first to be predicted the next time after using it for training the model.

### 3.2 Solution Architecture

As it can be seen in Fig. 1, the chosen definition of a DT is a set of layers illustrated in pink.

The first layer is the **database** which plays a crucial role in storing and managing the vast amount of data required to create and maintain DTs. DTs can have multiple sources of information, such as information from processing the measured data and information collected previously from various data sources along the life cycle of a product [1]. In this context our database is considered to be constituted of two repositories, the "dataset acquisition" repository that collect dynamic time-series data and the "Vault" repository that preprocess the collected data in the first repository and make the archive of the system. The layer that is positioned above of it uses the database layer to **simulate** and replicate exactly what the PT does [12]. The **visualisation** layer in the DT is an important aspect since it allows users to see a virtual and real-time representation of systems or components [19]. And depending on all these layers, the final layer of the DT is the **decision** layer, helping the human being to make the decision. But to make predictions and make the decision-making more
automated, a **cognitive** layer is added, presented in orange, making the DT a CDT. Shifting focus on the contribution at hand which answers the problems mentioned in the Subsection 3.1: the **data generation** layer colored in Blue. This stratum makes a CDT a CSDT.

Since IoT systems are susceptible to a range of vulnerabilities stemming from both software and hardware failures, which can lead to a loss of control. Any disruption in the operation of an IoT system can, at the very least, cause inconvenience and, at worst, pose a life-threatening risk [11].

Finding unusual data points to train models in an IoT system can be quite challenging. In practical applications, instances of abnormal behavior, such as a sudden and significant increase in temperature in a temperature monitoring system, are quite infrequent when contrasted with the frequency of normal behaviors like maintaining a stable temperature within the desired range [4].

<figure><img src="image_2.png" /><figcaption>Fig. 1. CSDT's Generation Module</figcaption></figure>

Hence, the justification for the generation module is the lack of abnormal data compared to normal ones. This layer fabricates normal and abnormal data, both of those generations are essential to have a balanced global dataset. Therefore, distinguishing those two types of behavior is already a challenge [11]. For instance, a temperature of 10°C is considered normal during winter, but the same temperature in summer might be regarded as a deviation. This is discussed further more in Section 4. But as mentioned in [4], to commence with, we need to know the nature of collected data streams in our IoT system (binary, continuous, discrete) along with the relationship structure (time-series data, spatial data, graph data). Second, the type of anomaly needs to be identified (point anomaly which is an observation point in the data stream that is significantly
distant from the rest of the data, contextual anomaly, an observation point nor-
mal in one scenario yet abnormal in another and collective anomaly that is when
a sequence of observations are analyzed together to know the normal behavior of
a data stream. And any deviation is considered an anomaly). And finally know
the availability of training data to allow our model to learn.

<figure><img src="image_3.png" /><figcaption>Fig. 2. The Versatile CSDT Architecture</figcaption></figure>

On the macroscopic view, Fig. 2 represents the versatile architecture required to build a CSDT. As any DT, the architecture must be constituted of the three essential parts: a Physical asset, a communication medium and the digital asset.

In this paper, the considered PT is an IoT system. To facilitate the bidirec-
tional communication between the two assets, an intermediary communication
medium plays a pivotal role in establishing a seamless and real-time tunnel be-
tween the previously mentioned components. This medium ensures the secure
transportation and storage of all interactions, thereby rendering the communi-
cation process transparent and immediate.

Moving on to CSDT part, the data generation is represented in the "Database" layer. After the data generation, an operation of data acquisition will start, since the origin of the data processed by the CSDT can come from different sources (the generated data, the data collected from the IoT system, etc) so it serves to collect the data and process it to combine it and make it one global source of data or dataset. The over element of the CSDT is the simulator [12], which is the core of the DT which is a faithful replication of the PT's functionality.
## 3.3 Class Diagram

The viewed versatile architecture has also been represented in the form of a generic class diagram in Fig. 3 that has been inspired from [13] but the emphasis is on how the disturbances are made and how the DT is stressed and react to these anomalies, and is described below:

The "Component" class is at the head of the class diagram as it serves as a foundational element, with all classes ultimately deriving from it, ranging from complex to simple. This class gives rise to two specific inheriting classes: "PhysicalTwin" and "DigitalTwin". The "PhysicalTwin" class exhibits a self-contained nature and is composed of one system. It is further equipped with a predictive model trained on normal data.

In contrast, the "DigitalTwin" class is composed of the "DatasetAcquisition" and "Simulation" classes. The "Simulation" class, as the core component of the DT, closely replicates the functionalities of the PT. Consequently, it features a system and has a model trained on normal and perturbed data, eventually attaining the status of a "golden standard model" once sufficient data has been generated and the model has been fully trained. At this juncture, it supersedes the model in the PT. This model makes the DT a CDT. Notably, the inclusion of a "Sensor" class is required since it plays a major role in the data capture process within the "Simulation" class. Various forms of data disturbances are injected into the "Sensor" class, including Data alteration, data deletion, and temporary sensor stoppages, where expected data is not transmitted as anticipated. These injected disturbances generates disturbed data which makes a CDT a CSDT.

## 3.4 Implementation

The architecture presented in Fig. 2 and Fig. 3 has been implemented on a case study to test the ability and limits of CSDT, so it is essential to address the potential impact of disturbances as well that can be in the form of unexpected events such as irregularities in the data and see how it can significantly influence the performance of the system.

To fortify the system against these disturbance and since anomaly detection and prediction works on datasets, it is crucial to employ data mining techniques. It can consider multiple instances at a time, such as Classification-based anomaly detection techniques, which can be applied whenever sufficient amount of labelled data is available [5]. This would not pose an issue thanks to the presence of a data generation module.

The data generation in our system is done thanks to a JavaScript Object Notation (JSON) file where the current collected data is viewed and similar data is generated to create the normal data and the different ones are considered the abnormal ones.

Focusing more on the disturbance, the induced anomalies primarily involve manipulating the data. This, of course, is contingent upon the specific environment in which the data is collected, as what might be deemed anomalous in one environment may not be so in another. Another type of anomaly involves the
<figure><img src="image_4.png" /><figcaption>**Fig. 3.** The Generic CSDT Class Diagram - the colors used here are consistent with the ones in Fig. 2</figcaption></figure>

deletion of the data, wherein the data is anticipated by the receiving communication medium but is not transmitted. Lastly, simulating a sensor stop or a sensor halt occurs when the sensor does not generate at all the data for a certain amount of time.

# 4 Case Study

In this section, a case study is conducted to demonstrate the efficacy of the CSDT framework in detecting and predicting data anomalies. The primary objectives are:

- Test the CSDT and how its generation module is effective compared to a specific employed environment,

- Verify the scalability of the CSDT Simulator,

- Find a suitable ML or DL model for the PT and the CSDT.

## 4.1 Scenario

The case study focuses on detecting room occupancy by collecting environmental data. Following the workflow presented in [4], the collected data is continuous time-series data. The primary type of anomaly considered is a contextual
anomaly, which means that an observation may be normal in one context but
abnormal in another. For instance, in our case study, the anomaly introduced
by the data generation process could involve manipulating temperature data to
create abnormal conditions. In a normal room setting, a sudden drop to 10°C
may be flagged as an anomaly. However, in a cooled room, such as a server room
or cold storage, this temperature might be perfectly normal. The problem is ap-
proached as a binary classification for the PT (Occupied, Not Occupied) and as
a multi-class classification for the CSDT (Occupied, Not Occupied, Disturbed).
This multi-class approach allows the CSDT model to have greater knowledge and
predict disturbances resulting from the data generation layer and the predictive
model.

## 4.2 Configuration of the System

As depicted in the Fig. 4, the PT is an IoT system in the form of an Edge/Fog
architecture where the Edge is constituted of a Raspberry Pi 3 Model B and three
sensors: Grove DHT11 sensor, Grove Light sensor and Grove SGP30 sensor. The
Grove Barometer sensor has been added later on to prove that the CSDT’s
simulator is extensible. The collected data (temperature, humidity, CO2 and
Light) are sent to the Fog to train the model along with an external dataset<fnref n="5" /> to
have enough data in the PT.

The predicted output of the model along with the collected data are displayed
and and stored in a time-series database (InfluxDB) via the communication
medium, ensuring real-time data availability and analysis.

After all the data have been received, the communication medium forward
it to the DT where the data acquisition module makes the preprocessing and
combine the three sources of data (DT generated normal and abnormal data,
External dataset, collected data) to create on global dataset. The multi-class
model is trained on the global dataset. This golden standard model replaces the
one available in the PT periodically.

## 4.3 Disturbance Induction and Data Anomaly Detection

The CSDT's ability to handle data disturbances is critical. Disturbances can
take several forms:

- **Data Manipulation:** For instance, artificially creating data spikes or drops to test anomaly detection capabilities.

- **Data Deletion:** Simulating scenarios where expected data is not transmitted, testing the robustness of the system in handling missing data.

- **Sensor Halt:** Simulating a sensor stop, where no data is generated for a specific period, testing the system's ability to predict and handle such interruptions.

<footnote n="5">⁵ Occupancy Detection Data Set: https://archive.ics.uci.edu/dataset/357/occupancy+detection, last access in 21/11/2023</footnote>
<figure><img src="image_5.png" /><figcaption>Fig. 4. The use of CSDT on a Case Study.</figcaption></figure>
## 4.4 Results

The selection of the PT and DT models has been done after training several ML and DL models (Decision Tree, Random Forest, K-Nearest Neighbors (KNN), Naive Bayes, RNN, MultiLayer Perceptron (MLP)). The PT model that gave the best results is a RNN with LSTM layers [15]. The results are present in Table 1: an Accuracy of 99.51%, a Precision of 98.38% and a Recall of 99.81% so it gives an F1_Score of 99.09%, another reason why this model has been chosen is because it takes into consideration timestamps. But the model that outperformed concerning the CSDT are the tree-based models giving 99% scores and the RNN gave 67.03% F1_Score (Table 2). A trade-off must be done, either have correct predictions or taking the timestamps into consideration, in this study, the first choice has been picked, and as mentioned in [7], tree-based models perform better than other models on tabular data.

<table><caption>**Table 1.** PT Trained models.</caption><thead><tr><th></th><th>Decision Tree</th><th>Random Forest</th><th>KNN</th><th>Naive Bayes</th><th>RNN</th><th>MLP</th></tr></thead><tbody><tr><th>Accuracy</th><td>99.14%</td><td>99.34%</td><td>99.31%</td><td>97.03%</td><td>99.51%</td><td>99.27%</td></tr><tr><th>Precision</th><td>97.73%</td><td>97.85%</td><td>97.85%</td><td>88.36%</td><td>98.38%</td><td>97.34%</td></tr><tr><th>Recall</th><td>98.47%</td><td>99.23%</td><td>99.13%</td><td>99.89%</td><td>99.81%</td><td>99.46%</td></tr><tr><th>F1_Score</th><td>98.10%</td><td>98.54%</td><td>98.48%</td><td>93.77%</td><td>99.09%</td><td>98.39%</td></tr></tbody></table>

<table><caption>**Table 2.** CSDT Trained models.</caption><thead><tr><th></th><th>Decision Tree</th><th>Random Forest</th><th>KNN</th><th>Naive Bayes</th><th>RNN</th><th>MLP</th></tr></thead><tbody><tr><th>Accuracy</th><td>99.27%</td><td>99.38%</td><td>99.20%</td><td>97.84%</td><td>67.03%</td><td>86.26%</td></tr><tr><th>Precision</th><td>97.28%</td><td>99.39%</td><td>99.20%</td><td>97.43%</td><td>67.03%</td><td>77.22%</td></tr><tr><th>Recall</th><td>99.27%</td><td>99.38%</td><td>99.20%</td><td>97.84%</td><td>67.03%</td><td>86.46%</td></tr><tr><th>F1_Score</th><td>99.27%</td><td>99.38%</td><td>99.20%</td><td>97.85%</td><td>67.03%</td><td>78.39%</td></tr></tbody></table>

The same study was accomplished on a CDT, the faced problems are the lack of abnormal data so the anomalies were not able to be predicted on the contrary of what a CSDT is bringing. So the anomalies could be treated and help the user on the decision-making either by ignoring the anomaly or deleting it or calling for human-help to correct the anomaly.

This case study allowed to verify the accuracy and extensibility of the CSDT as well as injecting data disturbance to stress it and verify the prediction of the selected models that were proven to be suitable for the case study.

## 5 Conclusion

This paper explores the power and potential of DT as a preventative tool, particularly addressing its efficacy in detecting and mitigating data anomalies, in-
introducing the new framework called CSDT. While DT offers benefits and ad-
vantages, it is not a one-size-fits-all solution and requires significant investments
in data collection, analytics, computing power, and skilled personnel and they
should be seen as a complementary tool to traditional maintenance practices,
enhancing decision-making processes. Thanks to the CSDT that goes beyond
replicating the physical Twin and can detect and generate perturbations for im-
proved prevention and resilience strategies, aiming to enhance overall system
performance and preparedness.

While this contribution brings a lot to a significant issue, namely data in-
sufficiency and the full reliance of the DT on the PT data, it does have its
limitations. One of these constraints is related to the data distribution and en-
vironmental context and awareness. For example, a temperature of -10°C within
a typical office setting is considered abnormal, whereas the same temperature in
a cryogenic chamber or cold storage facility would be considered normal.

Another limitation is that, although the simulator of CSDT is extensible, it
can only simulate sensors that collect numerical data. For instance, it is still
unable to handle sensors that capture images, videos, frames, and similar non-
numeric data.

The future works and prospective endeavors encompass an evolution towards
a Systems-of-Systems (SoS) structure rather than working on only one system.
This evolution requires and entails the expansion of the CSDT from a component
twin to a system twin or a process twin and a transition from a static DT to
a dynamic DT that operates in real-time, providing instantaneous data and
responses. This will be possible by integrating real-time training mechanisms,
allowing continuous learning and improvement in performance over time.

A case study to showcase the power of CSDT could come in hand and incor-
porate reinforcement learning allowing it to learn and improve its performance
over time. Another future work is to analyse the patterns of the sensors to gen-
erate the data and predicting the source of anomaly as well as testing different
combination of anomaly injections based on Model-Driven Engineering (MDE)
which enables the integration of various models representing different facets of
the system, this holistic approach enhances anomaly detection accuracy by con-
sidering a comprehensive set of factors.

**Disclosure of Interests** The authors have no competing interests to declare that are relevant to the content of this article.

References

1. Bonney, M.S., de Angelis, M., Dal Borgo, M., Wagg, D.J.: Contextualisation of information in digital twin processes. Mechanical Systems and Signal Processing **184** (2023). https://doi.org/10.1016/j.ymssp.2022.109657

2. Eirinakis, P., Lounis, S., Plitsos, S., Arampatzis, G., Kalaboukas, K., Kenda, K., Lu, J., Rožanec, J.M., Stojanovic, N.: Cognitive digital twins for resilience in production: A conceptual framework. Information **13**(1) (2022). https://doi.org/10.3390/info13010033
3. El Mokhtari, K., Panushev, I., McArthur, J.J.: Development of a cognitive digital twin for building management and operations. *Frontiers in Built Environment* **8** (2022). https://doi.org/10.3389/fbuil.2022.856873

4. Fahim, M., Sillitti, A.: Anomaly detection, analysis and prediction techniques in IoT environment: A systematic literature review. *IEEE Access* **7**, 81664–81681 (2019). https://doi.org/10.1109/ACCESS.2019.2921912

5. Flammini, F.: Digital twins as run-time predictive models for the resilience of cyber-physical systems: a conceptual framework. *Philosophical Transactions of the Royal Society A* **379** (2021). https://doi.org/10.1098/rsta.2020.0369

6. Grieves, M.: Digital twin: manufacturing excellence through virtual factory replication. *White paper 1* (2014)

7. Grinsztajn, L., Oyallon, E., Varoquaux, G.: Why do tree-based models still outperform deep learning on tabular data? (2022)

8. Hosamo, H.H., Nielsen, H.K., Alnmr, A.N., Svennevig, P.R., Svidt, K.: A review of the digital twin technology for fault detection in buildings. *Frontiers in Built Environment* **8** (2022). https://doi.org/10.3389/fbuil.2022.1013196

9. Lamb, K.: Principle-based digital twins: a scoping review. *CDBB* (2020). https://doi.org/10.17863/CAM.47094

10. Laszka, A., Abbas, W., Vorobeychik, Y., Koutsoukos, X.: Integrating redundancy, diversity, and hardening to improve security of industrial internet of things. *Cyber-Physical Systems* **6**(1), 1–32 (2020). https://doi.org/10.1080/23335777.2019.1624620

11. Mishra, A., Cohen, A., Reichherzer, T.: Detection of data anomalies at the edge of pervasive iot systems. *Computing* **103**, 1657–1675 (2021). https://doi.org/10.1007/s00607-021-00927-9

12. Nwogu, C., Lugaresi, G., Anagnostou, A., Matta, A., Taylor, S.J.: Towards a requirement-driven digital twin architecture. *Procedia CIRP* **107**, 758–763 (2022). https://doi.org/10.1016/j.procir.2022.05.058

13. Riahi, K., Kahn, G., Dafflon, B., Laval, J.: A Faulty IoT Network: Simulating Sensors and Perturbations. In: WorldCIST22. vol. 470. Budva, Montenegro (Apr 2022). https://doi.org/10.1007/978-3-031-04829-6\_9

14. Saraeian, S., Shirazi, B.: Digital twin-based fault tolerance approach for cyber-physical production system. *ISA Transactions* **130**, 35–50 (2022). https://doi.org/10.1016/j.isatra.2022.03.007

15. Savaglio, C., Barbuto, V., Awan, F.M., Minerva, R., Crespi, N., Fortino, G.: Opportunistic digital twin: An edge intelligence enabler for smart city. *ACM Trans. Sen. Netw.* (2023). https://doi.org/10.1145/3616014, https://doi.org/10.1145/3616014

16. Sharma, A., Kosasih, E., Zhang, J., Brintrup, A., Calinescu, A.: Digital twins: State of the art theory and practice, challenges, and open research questions. *Journal of Industrial Information Integration* (2022). https://doi.org/10.1016/j.jii.2022.100383

17. Yasaei, R., Hernandez, F., Faruque, M.A.A.: IoT-CAD: Context-aware adaptive anomaly detection in IoT systems through sensor association. In: Proceedings of ICCAD’20 (2020). https://doi.org/10.1145/3400302.3415672

18. Zheng, X., Lu, J., Kiritsis, D.: The emergence of cognitive digital twin: vision, challenges and opportunities. *International Journal of Production Research* **60**(24), 7610–7632 (2022). https://doi.org/10.1080/00207543.2021.2014591

19. Zhu, Z., Liu, C., Xu, X.: Visualisation of the digital twin data in manufacturing by using augmented reality. *Procedia CIRP* **81** (2019). https://doi.org/10.1016/j.procir.2019.03.223