A Digital Twin and Lightweight Blockchain Logging Framework for Real-Time CPS Threat Detection
Salam Al-E’mari1,*, Yousef Sanjalawe2,*, Budoor Allehyani3, Ahd Aljarf4, Fares Alharbi5
1 Department of Information Security, Faculty of Information Technology, University of Petra (UoP), Amman, Jordan
2 Department of Information Technology, King Abdullah II School for Information Technology, University of Jordan (JU), Amman, Jordan
3 Department of Software Engineering, College of Computing, Umm Al-Qura University (UQU), Makkah, Saudi Arabia
4 Department of Cybersecurity, College of Computing, Umm Al-Qura University, Makkah, Saudi Arabia
5 Department of Computer Science, College of Computing and IT, Shaqra University, Shaqra, Saudi Arabia
* Corresponding Author: Salam Al-E’mari. Email: 
; Yousef Sanjalawe. Email: 
Computers, Materials & Continua https://doi.org/10.32604/cmc.2026.086552
Received 01 June 2026; Accepted 24 August 2026; Published online 07 September 2026
Abstract
Cyber-Physical Systems (CPS), including Industrial Internet of Things (IIoT) environments and smart infrastructures, are increasingly vulnerable to sophisticated cyberattacks due to their heterogeneous architectures, large-scale deployments, and strict real-time operational constraints. Conventional security mechanisms often struggle to provide low-latency threat detection, continuous monitoring, and reliable forensic traceability under resource-constrained conditions. This paper presents a lightweight Digital Twin (DT)-driven cybersecurity framework that integrates synchronized DT state modeling, hybrid anomaly detection, and tamper-evident audit logging for real-time CPS threat detection. Within this framework, the DT is realized as an operational, data-driven twin whose role is continuous bidirectional state synchronization, integrity-aware feature abstraction, and context-aware representation of CPS assets for detection, rather than a physics-based simulation, “what-if” scenario, or predictive-maintenance twin; these richer capabilities are enabled by the modular DT design and are identified as future extensions. The proposed framework employs a decoupled training-deployment strategy in which Isolation Forest (IF), Gradient Boosting Machine (GBM), and Multi-Layer Perceptron (MLP) models are combined during an offline ensemble calibration stage to optimize detection thresholds, while only a lightweight MLP model is executed during runtime inference to minimize computational overhead. To enhance detection reliability and interpretability, the learning-based detection pipeline is further augmented with domain-aware rule-based verification. In addition, validated security events are recorded via a lightweight, hash-chained, append-only logging mechanism that provides tamper-evident forensic traceability without the latency overhead of consensus-driven distributed ledger systems. Experimental evaluation on controlled synthetic CPS telemetry achieved 99.6% detection accuracy, 99.5% precision, 99.8% recall, and an F1-score of 99.6%. The framework was further validated on three real-world industrial CPS benchmarks (SWaT, WADI, and BATADAL), where F1-scores ranged from 0.976 to 0.986, demonstrating consistent generalization across heterogeneous operational environments. In addition, the proposed architecture sustained telemetry processing rates exceeding 5000 events per minute with an average logging latency of 0.84 s and CPU utilization below 65%. These results demonstrate that the proposed framework provides an efficient and practically deployable CPS security architecture that balances lightweight runtime inference, detection reliability, and forensic auditability in resource-constrained environments.
Keywords
Blockchain; cyber-physical systems; digital twins; hybrid anomaly detection; industrial Internet of Things
Open Access
Login
Register
Submit a Paper
Propose a Special lssue
Download PDF
Downloads
Citation Tools
