Cyber-physical systems underpin many of our society’s critical infrastructures. Ensuring their cyber security is important and complex. A major activity in this regard is cyber security incident response, whose primary goal is to detect and mitigate cyber-attacks in order to ensure the continuity and resilience of services. For cyber-physical systems this is particularly challenging because it requires insights both from the cyber and physical (process) domains and the engagement of stakeholders that are not strictly concerned with cyber security. A technology that is receiving a lot of attention are digital twins – virtual representations of real-world (cyber-physical) systems. They can be used to support tasks such as estimating the state of a system and exploring the consequences of interventional activities (e.g., upgrades).

Digital twins can address the problem of data scarcity during the training machine learning models, as they can be used to simulate and explore a range of process conditions and system states that are too difficult or dangerous to explore in real-world Cyber-Physical Systems (CPSs). Meanwhile, advances in industrial control systems technology have enabled increasingly complex functionality to be deployed on or near so-called edge devices, such as Programmable Logic Controllers (PLCs).In this paper, we propose a methodology for training a machine learning model offline using data extracted from a digital twin, before converting the model for deployment on an edge device to perform anomaly detection. To examine the model’s suitability for anomaly detection, we execute several simulations of fault conditions. Results show that the model can successfully predict normal operations as well as identify faults and cyber-attacks. There is a negligible drop in performance on the edge device, when compared to executing the model on a personal computer, but it remains suitable for the application.