Author

This paper presents the DT-ML-CAFA (Digital Twin and Machine Learning empowered Cyber Attacking Flow Analysis) model for SCADA-based Industry 5.0 smart grids. A Directed Graph (DiGraph)-based knowledge graph constructs digital twins of SCADA components—IEDs, circuit breakers, network switches, and transmission lines—enabling dynamic visualization of cyber-attack propagation. XGBoost is integrated to detect and classify False Data Injection Attacks (FDIA), Remote Tripping Command Injection (RTCI), and System Reconfiguration Attacks (SRA). Evaluated on the publicly available MSU–ORNL SCADA dataset, the model achieves detection accuracy exceeding 99% with only 32 total misclassifications across more than 2.1 million samples.

This paper introduced the DT-ML-CAFA framework—a DiGraph-enabled Digital Twin integrated with XGBoost machine learning—for proactive cyber-attack detection and visualization in SCADA-based Industry 5.0 smart grids. By constructing a Directed Graph model of the SCADA network, the framework enables dynamic simulation and real-time visualization of FDIA, RTCI, and SRA attack-propagation paths—providing operators with situational awareness that conventional IDS systems cannot offer. The XGBoost classifier achieves detection accuracy exceeding 99% on the MSU–ORNL benchmark dataset, with only 32 misclassifications across more than 2.1 million samples. Label encoding of categorical SCADA data, Min-Max normalization, and DiGraph-derived topology features collectively enhance model learning efficiency. Confusion matrix analysis confirms strong balanced performance across all attack categories. The DT-ML-CAFA framework demonstrates that the synergy of digital twin technology and advanced machine learning provides a qualitatively and quantitatively superior cybersecurity solution compared to conventional ML-only approaches. It enables proactive threat simulation, real-time attack-path visualization, high-accuracy automated classification, and an accessible operator GUI—establishing digital twin technology as a practical platform for intelligent, proactive cyber defense in critical infrastructure.

[1] N. Ortiz and A. A. Cardenas, “SCADA World: An Exploration of the Diversity in Power Grid Networks,” Proc. ACM Meas. Anal. Comput. Syst., vol. 8, no. 1, 2025. [2] M. K. Hasan, M. M. Ahmed, and S. Islam, “Malaysia Energy Outlook from 1990–2050 Using AI-Based Projections,” Energy Strategy Reviews, vol. 53, 101360, 2024. [3] A. J. G. de Azambuja and T. Giese, “Digital Twins in Industry 4.0—Opportunities and Challenges Related to Cybersecurity,” Procedia CIRP, vol. 121, pp. 25–30, 2025. [4] R. Martínez, P. Sánchez, and J. Ortega, “Cybersecurity risks and opportunities of Digital Twin in Industry 4.0,” Computers & Industrial Engineering, vol. 181, pp. 109125, 2023. [5] A. Hoffmann and M. Becker, “Energy Digital Twin for smart manufacturing systems: Optimization of heating tunnel processes,” J. Cleaner Production, vol. 421, pp. 140758, 2023. [6] M. M. H. Sifat, S. K. Das, and S. M. Choudhury, “Design and Optimization of a Digital Twin Electric Grid Framework,” Electric Power Systems Research, vol. 226, 2025. [7] M. Mahmoud, C. Semeraro, and M. A. Abdelkareem, “Architecture of a Digital Twin for Wind Turbine,” Int. J. Thermofluids, vol. 22, May 2025. [8] F. Chen and G. Fang, “Harnessing Digital Twin and IoT for Real-Time Monitoring in Domestic Solar Energy Storage,” Energy Rep., vol. 11, pp. 3614–3623, 2024. [9] H. Naeem, F. Ullah, and G. Srivastava, “Classification of Cyber-Attacks in Smart Grids Using Deep Ensemble Learning,” AI for Security, Privacy, and Trust in Cloud and Fog Computing, 2024. [10] C. Martinez-Ruedas and J.-M. Flores-Arias, “Cyber–Physical System Based on Digital Twin and 3D SCADA for Olive Oil Mills,” Technologies, 2024. [11] Y. Yan and Y. Kunhui, “Cyber–Physical Architecture for Renewable-Based Smart City Using Digital Twin,” Energy Technol. Assess., 2024. [12] S. Khan, R. Kumar, and P. Banerjee, “Digital Twin–based cybersecurity analysis for SCADA systems in smart grids,” IEEE Access, vol. 12, pp. 3401–3416, 2024. [13] Oak Ridge National Laboratory and Mississippi State University, “SCADA System Cyberattack Dataset,” Univ. Alabama in Huntsville, 2020. [Online]. Available: https://ieee-dataport.org/open-access/msu-ornl-scada-dataset [14] T. Nguyen and Y. Lee, “Cybersecurity-empowered Digital Twin framework for smart grids,” Electric Power Systems Research, vol. 226, pp. 109376, 2024. [15] J. Lopez, J. E. Rubio, and C. Alcaraz, “Digital Twins for Intelligent Authorization in B5G-Enabled Smart Grid,” IEEE Wireless Commun., vol. 28, no. 2, pp. 48–55, 2021. [16] M. Sharma and K. Patel, “Intrusion classification using Grey-Wolf optimization and deep-stacked ensemble model,” Int. J. Electrical Power & Energy Systems, vol. 159, pp. 108327, 2024. [17] L. Zhao, Y. Lin, and F. Tang, “Digital Twin framework for electric power systems,” IEEE Access, vol. 11, pp. 112340–112356, 2023. [18] H. Wang and C. Liu, “Cloud-based Digital Twin Battery Management System,” IEEE Trans. Smart Grid, vol. 15, no. 1, pp. 155–168, 2024. [19] M. Jafari and H. Mahmoud, “Dragonfly optimization and LSTM-based cyberattack detection using Digital Twin simulation,” IEEE Trans. Ind. Informatics, vol. 19, no. 8, pp. 8501–8513, 2023. [20] T. Morris et al., Power System Datasets, Mississippi State Univ. / Oak Ridge Nat. Lab., Oak Ridge, TN, USA, 2014.

IJORET Paper Submission Call for Papers About IJORET Scope of the Journal Review Process Online Submission (Form)