# A Digital Twin-Based Approach for Detecting Cyber-Physical Attacks in ICS Using Knowledge Discovery
## 5 Methodology
### Data Preprocessing  
In this stage, we convert the raw device logs into an event log suitable for process mining analysis. This transformation is necessary in order to derive meaningful insights into the system's behavior and detect anomalies through the process traces. The following sections provide the theoretical foundations and design specifications of our framework, which is aimed at the detection and analysis of anomalous traces within process event logs. We represent the behavior of a SCADA device using sequences of state transitions driven by changes in register values. Instead of focusing on individual entries, our approach emphasizes state transitions to identify significant events. A _state_\(s\) is defined as a vector of register values at a specific timestamp. Let \(\mathcal{R}\) denote the set of all registers. A state at time \(t\) is represented as  
\[s(t)=\{(r_{i},v_{i}(t))\mid r_{i}\in\mathcal{R},v_{i}(t)\in\mathcal{W}_{r_{i}}\},\]  
where \(r_{i}\) is the register and \(v_{i}(t)\) is the value of the register \(r_{i}\) at time \(t\). A _state transition_ occurs when there is a change in the value of one or more registers between two consecutive timestamps. To account for insignificant changes, we introduce a threshold \(\delta_{r_{i}}\) for each numerical register \(r_{i}\). Formally, a state transition from time \(t_{1}\) to \(t_{2}\) is defined as  
\[\Delta s(t_{1},t_{2})=\{(r_{i},v_{i}(t_{1}),v_{i}(t_{2}))\mid r_{i}\in \mathcal{R},|v_{i}(t_{1})-v_{i}(t_{2})|>\delta_{r_{i}}\},\]  
where \(\delta_{r_{i}}\) is a predefined threshold for the register \(r_{i}\). This guarantees that only significant changes are taken into account as state transitions. Events are derived from significant state transitions. A transition is considered significant if it involves a change in key registers identified through domain knowledge. Table 2 illustrates an example of a state transitions device log. Data Filtering and Event Log Generation  
In process mining, event logs are organized into traces, each representing a sequence of tasks performed over several enactments of a process [42]. However, a device log from an ICS/SCADA system typically lacks direct information about trace identification [37]. Therefore, it is crucial to establish what constitutes a trace. To convert the raw device log into an event log, we apply the following steps:  
1. Transition Analysis: For each identified register \(r_{i}\), we monitor changes in its value over time. An event is generated whenever \(v_{i}(t)\) changes significantly, i.e., \(|v_{i}(t_{1})-v_{i}(t_{2})|>\delta_{r_{i}}\), capturing the nature of the change (increase, decrease, on, off, etc.). An event is represented as a tuple \(e=(t,r_{i},v_{i}(t_{1}),v_{i}(t_{2}))\), where \(t\) is the timestamp of the transition. The set of all possible events is denoted as \(E\). 2. Operational Cycle Detection: A cycle-start condition is defined based on specific register values. A new cycle begins when a particular register \(r_{s}\) changes to a predefined value \(v_{s}\). This condition is derived from domain knowledge and splits data into operational cycles. 3. Trace Grouping: Events are organized into traces based on detected operational cycles. Formally, each trace \(T_{i}\) is defined as a sequence of events \(\{e_{\text{start}},e_{1},e_{2},\ldots,e_{n},e_{\text{end}}\}\), where \(e_{\text{start}}\) and \(e_{\text{end}}\) are special marker events indicating the start and end of the cycle, respectively. The start of a trace is marked by the cycle-start condition, while the end of a trace is marked by the start of the next cycle or a predefined cycle-end condition. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Timestamp** & **Register** & **Previous Value** & **Current Value** \\ \hline \(t_{1}\) & \(r_{1}\) & \(v_{1}(t_{0})\) & \(v_{1}(t_{1})\) \\ \(t_{2}\) & \(r_{2}\) & \(v_{2}(t_{1})\) & \(v_{2}(t_{2})\) \\ \(\ldots\) & \(\ldots\) & \(\ldots\) & \(\ldots\) \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Example of state transitions in the event log.