# A Digital Twin-Based Approach for Detecting Cyber-Physical Attacks in ICS Using Knowledge Discovery
## 4 Case Study  
To accurately replicate the environment of the industrial food processing plant within our digital twin, we have developed a system that mirrors real-world operations in a virtual space, as showcased in Figure 1.  
The digital twin is a virtual model of the food processing plant, with all containerized PLCs connected to a simulation of the physical processes. Each PLC in the physical plant was replicated in a Docker container by cloning the PLC logic into Python scripts, which were then interconnected using the pyModbus library [40]. This containerization allowed for isolation and portability, facilitating the replication of the PLC's behaviour in the virtual environment. The containers were configured to expose their Modbus interfaces to enable communication with the different components. These PLCs were connected to a virtual model of the food processing plant developed in Python by modeling physical components such as the mixing tank, sensors, and actuators. The model was designed to accurately replicate the behavior and interactions of these components, ensuring that the digital twin's operations closely mirrored those of the real plant. This simulation environment was continuously synchronized with the actual plant through a proxy system. The proxy was positioned between the real hardware PLCs and the physical plant, transparently forwarding all Modbus traffic from the PLCs to the real plant. When a write operation is detected, the corresponding command is transmitted by the proxy to the replicated physical container connected to the digital twin, ensuring that both the virtual and physical systems remain in a consistent state. This setup allows an accurate model of the real plant to be maintained without directly interfering in its operations. Our case study explores an industrial food processing plant for preparing and bottling pesto sauce. The process is divided into three stages: (a) a loading phase (Figure 2a) in which all the ingredients are loaded into the mixer according to specific dosages; (b) a mixing phase (Figure 2b) during which the heating element and blade are turned on to properly mix the ingredients; and (c) a bottling and packaging phase (Figure 2c) in which the product is inserted into bottles, packaged into boxes, labeled, and set aside to be shipped. For the sake of simplicity, we focus on stages (a) and (b). Figure 1: System architecture. In the first phase, the ingredients are initially prepared and weighed. Portioning takes place via three weighing funnels for olive oil, garlic, and basil, each fed by a speed-controllable screw valve (for the liquids) or a belt (for the garlic). Each funnel is controlled by a PLC and includes a load cell to sense the current amount of ingredients held within. The second phase is overlooked by the mixing-PLC; the system comprises a mixing tank that blends and processes the pesto sauce. This mixer is equipped with sensors monitoring its level and temperature as well as controls for adjusting the temperature. Another setpoint commands the drainage of the tank contents towards the bottling and packaging zone. The packaging phase features a controllable speed belt that is loaded with pesto containers at regular intervals. The measurements and setpoints are exposed via Modbus over port 502/TCP. Table 1 summarizes the PLCs and their corresponding registers, detailing the type, address, and kind along with a short explanation for each entry. The production cycle for pesto lasts approximately 17 min and is composed of nine distinct steps. This process begins with the loading and grinding of basil, followed by the incorporation of garlic and olive oil, and concluding with mixing, cooling, and packaging. Each step from ingredient loading to the final bottling is meticulously controlled by the corresponding PLC to ensure the highest quality of the final product. 1. Basil loading. The screw pump linked to the basil funnel activates and runs until the funnel load cell detects a minimum of 100 kg of basil.