# A Digital Twin-Based Approach for Detecting Cyber-Physical Attacks in ICS Using Knowledge Discovery
## 3 Related Work  
Recent advancements in intrusion detection systems for ICS have increasingly leveraged knowledge discovery techniques to identify physics-aware attacks, which exploit the physical processes governing these networks [25; 26]. Although several IDS solutions targeting industrial protocols have been proposed, including those targeting Modbus/TCP in particular [27; 28], their real-world implementation remains limited. This is primarily due to their false positive rates, which compel users to lower their security posture in order to cope with the overwhelming number of alarms. Research in this domain can be broadly categorized into three main approaches for intrusion detection: behavior-based, machine learning-based, and process mining-based systems.  
(a) Behavior-based: The approach proposed in [29; 30; 31] focuses on the typical patterns and behaviors of ICS networks to detect anomalies and potential attacks. By establishing a baseline of normal operations, deviations from this baseline can indicate malicious activities. This approach primarily focuses on detecting out-of-bound values or deviations from historical behavior. However, it falls short of capturing the full sequence of events and interactions within the process, providing only a limited perspective on such incidents.  
(b) Machine learning-based: Machine learning techniques such as those in [32; 33; 34] can be employed to enhance the detection capabilities of IDS by learning from historical data and identifying complex patterns that may indicate an attack. The major advantage of these systems is their potential to detect previously unseen attacks and address zero-day vulnerabilities. Nonetheless, these systems frequently produce a significant number of false positives and false negatives, reducing their practical reliability.  
(c) Process mining-based: There have been several examples of the use of process mining within a security context [35; 36]. The first documented application of process mining in the field of security was introduced by [35], who proposed the use of process mining to detect anomalous process executions. Recent research has begun to explore the potential of process mining for enhancing the security of ICS. As proposed by [37; 38], process mining involves understanding the sequence and dependencies of events within the system through logs and conformance checking analysis. This detailed examination allows for anomaly detection via process mining-based IDS by identifying inconsistencies between the expected process model and actual system behavior. However, unlike our methodology these approaches do not incorporate background knowledge to reduce issues arising from noisy logs, which may impact the anomaly detection task. In addition to process mining-based techniques, process-oriented methods have also been explored for intrusion detection. In [26; 39], these methods were discussed in the context of monitoring critical process variables. [PERSON] et al. [39] focused on leveraging the expertise of control system operators to generate alerts based on critical sensor readings such as device temperatures. Similarly, [PERSON] and [PERSON] [26] applied process-oriented techniques in SCADA networks,utilizing process semantics to identify anomalies in process variables. However, directly implementing these methodologies in real systems may unintentionally disrupt normal operations, trigger false alarms, or even create vulnerabilities if not carefully managed. These risks highlight the need for extensive testing and validation of such approaches in controlled environments such as those provided by digital twins.