# A Digital Twin-Based Approach for Detecting Cyber-Physical Attacks in ICS Using Knowledge Discovery
## 6 Experimental Evaluation
### Results
#### 6.3.2 Anomaly Detection Analysis  
In this section, we turn our attention to the anomaly detection task. The anomaly data were produced by executing two distinct attacks, both targeting the mixer PLC. For simplicity, we assume that in each scenario the attacker is on the same network as the PLC and has direct access to it, enabling unrestricted traffic flow across the network.  
Attack 1: DoS Attack on Heating Coil  
In this scenario, the attacker's goal is to sabotage the pesto sauce production process by overheating the sauce, thereby ruining the entire batch. The pesto sauce is normally heated to 64.0 \({}^{\circ}\)C. When register IW2, which holds the temperature value, reaches this set point, the heating element is turned off by setting coil QX01 to false. The temperature is then maintained at 64.0 \({}^{\circ}\)C for approximately 10 min by toggling the coil to true as needed. After this period, coil QX01 is set to false definitively, allowing the temperature to drop. The attacker monitors register IW2 and initiates the attack when the temperature reaches 64 \({}^{\circ}\)C. The attacker continuously sends Modbus packets with function code to write a single discrete output coil QX05 on port 502/TCP, instructing the mixer PLC to keep the heating element on (setting QX01 to true). As shown in Figure 9, the temperature exceeds 100 \({}^{\circ}\)C. Consequently, this elevated temperature leads to the production being ruined.  
Figure 8: A screenshot of the process model extracted by DGMining from the baseline event log.  
Attack 2: Production Diversion through Coil Manipulation  
Here, the attacker's objective is to inflict damage to reputation by sending an excess of uncooked and improperly prepared sauce to the bottling phase. The attack begins as soon as the attacker gains access to the network. The attacker then continuously sends Modbus packets with function code to a single discrete output coil QX05 on port 502/TCP, instructing the mixer PLC to keep the drainage valve actuated by coil QX00 open. As shown in Figure 10, the ingredient funnels continually attempt to refill the mixing tank; however, because the drainage valve remains open, all the ingredients are directly routed to the bottling area. Consequently, the bottling area continuously receives raw unprocessed ingredients.  
The complete event log produced by the digital twin during the first attack consists of nine activities, 216 traces, and 406 events. Similarly, for Attack 2 the event log comprises five activities, one trace, and 375 events.  
Further tests were carried out to more deeply and systematically assess the capability of our method to detect even'stealth' attacks, i.e., a small number of malicious events hidden in a large benign log. In particular, we added varying amounts of benign events to the same attack scenarios; specifically, we increased the size of the two attack logs by different percentages, namely, 50%, 100%, 150%, and 200%. This resulted in attack logs with +50%, +100%, +150%, and +200% additional benign events, respectively.  
Table 6 reports the fitness scores obtained by our method against different percentages of benign events added to the attack logs. The fitness score reflects how well the model supports the given log, with higher scores indicating better support.