Security Attacks and Solutions for Digital Twins

Reconnaissance involves intelligence gathering. This is achieved through activities such as network scanning, exploiting zero-day vulnerabilities, and enumerating services to identify security loopholes in the underlying system. For instance, the Triton malware targeted a petrochemical plant in Saudi Arabia and gained a foothold in the IT/OT networks to target Safety Instrumented Systems (SIS). However, the attacker may go beyond conventional network reconnaissance in industrial ecosystems to achieve the desired objectives. Sophisticated malware can defeat isolation mechanisms, including air gaps, sandboxes, virtualization, and so on. For example, the Stuxnet malware aimed at a Uranium enrichment plant demonstrates how to overcome air gaps [9]. Thus, beginning with reconnaissance scans, the attacker may gather information about the loopholes in the infrastructure and then use Stuxnet- or Triton-inspired malware strategies to launch attacks on digital twins.

Digital twins do not need to replicate the CPS in its entirety [2]. Given that the virtual representation in digital twins mimics the functionality of corresponding processes or devices with enough details reasonable feature generalizations or simplifications can occur if they stay context-aware [10]. More precisely, the goal of building digital twins is to provide a cost-effective solution to test the physical system rather than replicating (in terms of simulation or emulation) the system. Nevertheless, accurate representation of digital twins also contributes to the likelihood of a successful attack. In this case, the attacker considers the operation modes of digital twins. Next, we discuss the operation modes of digital twins which could be exploited by attackers. In replication mode, we record the event in a real system and then replay it while emulating the system behavior [1]. To do so, twins and their physical counterparts must be synchronized through sensor measurements, network communication, or log files [4]. We maintain a constant connection with the physical counterpart by integrating the system specification and the current state’s data. The replication mode may initiate direct cyclic updates to and from the digital twins. However, to use the replication mode, the attacker may follow implicit or explicit attacking points and needs to stay active to avoid the problem of time-dependent state synchronization and consistency of information between the physical entity and its different replicas.

Simulation mode operates in an isolated virtual environment without having a direct connection to the live systems. It requires user-specified settings and parameters as input. In simulation mode, being reproducible and repeatable with a broad range of trial-and-error learning mechanisms [1], can be directly used or tailored according to the attacker’s needs. The attacker can reveal emergent system behaviors by resetting and re-running the simulation until he/she achieves his/her insidious goals. Even worse, it can target the theme of simulation mode - security by design by reversing the defined configurations during security tests within the virtual environment. Furthermore, the attacker can learn the system state passively. However, since the simulation mode runs independently of its physical counterpart, the attacker cannot trigger automated attacks on the system due to the absence of a direct feedback loop.

By moving deeper into the system in search of sensitive information or gaining control over high-value assets, attackers strategically target specific sensors and manipulate readings [2]. More specifically, to make the attack more sophisticated, attackers may even consider process dynamics, i.e., the time-dependent behavior of a process in response to data input, to launch an attack.

During the operation phase of CPSs, cyclic state updates can be allowed from the digital twins to the physical process or vice versa. Although such actions aim to optimize the underlying operations, however, doing so, attacks initiated through digital twins may have similar repercussions as those attacks which are launched directly on real field devices. Similarly, ranging from low to high, the precise representation of digital twins, i.e., fidelity, is essential in the deployment of digital twins. Usually, the required level of fidelity, i.e., the degree of state or behavioral accuracy, for the digital twins is based on the underlying use cases or other fidelity metrics. For instance, virtual honeypots need to be more realistic to lure attackers, thus requiring high-fidelity [2]. However, cross-checking the engineering knowledge (such as verifying device data against threshold values, identifying unidentified connections or unknown devices, and so on [13]) based on the design specifications of the underlying CPS at the network and logic layer that includes physical devices [5] can be achieved with low-fidelity digital twins. The design specifications of the underlying CPS at the network and logic layer [5] may provide low-level fidelity, however, real-time sensor data provides high-level fidelity digital twins. Simply put, the more the digital twins accurately reflect their physical counterpart, the easier it is for the attacker to understand the system behavior.

Given that the digital twin data is used as an input source to the CPS physical processes, the digital twin must be built on trusted data [4]. In this context, empowering digital twins with blockchain allow industries to manage data on a distributed ledger while ensuring trusted digital twin data coordination across multiple stakeholders [3]. Next, we discuss possible solutions that can mitigate the attacks we have identified earlier on digital twins.

Although digital twins operate virtually in an environment distinct from the live system, are prone to attacks. To thwart attacks on digital twins, one potential solution is to assess the security level of digital twins by launching attacks on them. However, such assessment must be performed in an isolated environment without negatively affecting the operation of digital twin modes (especially replication). To this end, we propose a gamification approach that provides twin assessment and a learning environment for security analysts. The following section discusses how the gamification approach can help evaluate the security of digital twins against the attacks specifically discussed in section II-B, section II-C, and section II-E.

Gamification is the process of incorporating game mechanics into non-game environments. In cybersecurity, the gamification approach aims to provide security analysts with a controlled, supportive virtual training environment. To investigate the resilience of physical processes against attack, determining the potential loss such as disruption of services or machinery breakdown can be gamified. For instance, the red-blue team cybersecurity exercises [4], penetration testing [2], Capture-The-Flag (CTF) challenges [1], or using cyber range to provide hands-on cyber skills and security posture testing [19] are among well-known approaches in the existing literature. By simulating attack and defense scenarios, without risking critical infrastructures, such solutions reap the following benefits: (i) we can train security analysts by defining context, environment, and learning objectives to gain practical knowledge and skills during an exercise or challenge, and (ii) we can evaluate the security of digital twins and eventually the physical asset. Leveraging gamification for security-awareness training, can further complement automated security testing of digital twins through incident response which may benefit in lateral movement. Furthermore, it can help to identify attacks during the hybrid approach (discussed in section II-C3) due to the connection between the learning environment and CPS (as Fig 1 shows). Note that a similar framework can be found in Dietz et al. [19]. However, their work focuses more on providing a training environment for security analysts.

Based on [19], Fig. 1 showcases the high-level architecture which includes main components of the proposed digital twin-based gamification approach, where our goal is to get the potential defensive solutions by analyzing the attack patterns in a simulated environment (also known as learning environment). Our proposed system comprises two main parts: 1) CPS and 2) gamification approach for intelligent incident response system. The CPS consists of (i) physical environment (such as a robotic arm) and (ii) digital twin environment (the virtual copy of a robotic arm). The gamification approach for intelligent incident response system consists of (i) a management console to assign roles and resources to security analysts, (ii) teams which include attacker and defender for respective scenarios, (iii) game scenarios with various attack scenarios, (iv) learning environment to replicate the digital twin environment for simulation purposes, and (v) digital twins assessment which analyzes the risks and resilience to automatically get the rules to improve the defensive mechanisms. Next, we describe the use case for the gamification approach. Initially, a security analyst (step 1) chooses the configuration of the teams (step 2) made up of attackers or defenders from the management console. Next, a security analyst chooses the game scenarios (step 3) that comprises security-enhancing use cases (for example, security testing, system testing and training) and cyber attacks scenarios (for example, Man-in-the-Middle (MitM), intrusion, altering device configurations or simulation parameters). Then, the learning environment (step 4) implements the ICS scenarios of different digital twin instances through the virtual machine. The purpose of using a virtual machine is to emulate the functionality of any of the desired digital twin instance without affecting ongoing processes (digital-physical mapping) in CPS. In a traditional approach, the learning material for the analyst is provided through videos or instructional texts. The simulated scenario produces log data documenting the operations. The digital twin assessment module (step 5) is then used to analyze the log data. Based on the incident response playbook, scenario-based learning can be reproduced in terms of the level of difficulty to guide the analyst through several training units (to and from step 4 and step 5).

Determining a viable response to a security incident is vital. Incidents can be a precursor to a future attack or it has already occurred or is currently underway. Investigating incidents provides an opportunity to learn and better prepare for similar incidents in the future. More specifically, it can expose activities (such as an attacker impersonating a legitimate user) associated with lateral movement. In this context, the incident response describes the action to be taken based on the type of incident. Responding to a security incident is indispensable to effectively minimize the damage and recovery time while finding and fixing the cause to prevent future attacks. To do so, we introduce an intelligent incident response module that can automate the incident response process. The agents deploy machine/deep learning algorithms (such as Generative Adversarial Networks (GANs)) to execute tasks such as attacking and defending the system. Depending on the game scenario, the attacker launches various types of attacks on the system. In contrast, the defender must detect anomalies and determine the risks associated with the occurrence of anomalies. Both the attacker and defender agents can choose the best attack/response strategy to attack/protect the digital twin environment based on the trained data. For instance, an attacker can determine the probability of a successful attack. To improve the agents’ capabilities, we can train our AI agents in the learning environment based on data used in actual attacks and simulated data. Moreover, an intelligent incident response can construct or update S&S rules depending on the log data input and resilience assessment sub-modules. As a result, we can develop the intelligent incident response for the CPS, where the intelligent agent (i.e., detect the anomaly and reconfigure the parameters to mitigate an attack or to reduce the damage) comes from the gamification process of the learning environment. Based on the intelligent incident response approach, the learning environment result can be directly replicated to the digital twin environment (step 6) and ultimately the physical environment (step 7).

To sum up, the proposed gamification approach is best suited for evaluating the security level of both digital modes, i.e., replication and simulation. Furthermore, the required ICS scenario can be virtualized to better understand specific types of attack. Since digital twins are the key source of input data, performing security assessments of digital twins can eventually secure the physical system.