Cyber-attack and Fault Detection using a Digital Twin of the Controller Software

Local control units typically control large infrastructures such Water Distribution Networks (WDN's). This control setup makes the system robust both to failures and cyber-attacks. However, today's trend is to connect the local controllers to a Supervisory Control And Data Acquisition system (SCADA), which gives access to all local control parameters. This means that, intentionally or unintentionally, access to the SCADA will provide access to the entire control system. Here, we propose a cyber-attack observer that is based on a copy of the control software. This observer can detect manipulations to the local controller settings and thereby determine malicious attacks through SCADA. We call the software copy a Digital Twin of the controller software. Moreover, the collected data for the cyber-attack observer is also used for burst detection in the WDN zone. The algorithm is tested on a simulation of a WDN with consumption data profiles derived from real-life consumption data.