Digital Twin-Assisted Mapping of ICS Telemetry to ATT&CK for ICS with Evidence-Driven Dependency Reasoning
Digital Twin-enriched LLM mapping of ICS telemetry to ATT&CK for ICS cut false positives 34.1% on SWaT but gains didn't generalize to BATADAL/WADI.
The paper presents a Digital Twin-assisted framework that extracts synchronized ICS state changes, maps them to ATT&CK for ICS via retrieval-augmented LLM reasoning, and builds a typed dependency graph. On nine held-out SWaT scenarios, DT-enriched mapping produced a mean 34.1% per-run reduction in annotation-relative false positives, with mean recall of 0.633. However, paired comparisons did not reach statistical significance and the advantage did not transfer to BATADAL or WADI. An end-to-end dependency benchmark also showed mapping errors propagating into unsupported graph edges.
- Digital Twin context cut false-positive mapping episodes 34.1% per run on SWaT
- Mean recall was 0.633, varying between 0.50 and 0.70 across runs
- Improvements did not transfer to BATADAL or WADI external datasets
- Dependency benchmark recovered 8 of 9 co-occurrence relationships with DT context
Full article227 words · extracted from arxiv.org · click to collapse
Reconstructing adversarial behavior from Industrial Control System (ICS) telemetry is difficult because process observations reveal physical changes more directly than the actions that produced them. This paper presents a Digital Twin (DT)-assisted framework that extracts synchronized state changes, converts them into evidence-preserving descriptions, maps them to ATT&CK for ICS through retrieval-augmented Large Language Model (LLM) reasoning, and constructs a typed dependency graph. Evaluation comprises a four-configuration ablation on nine held-out SWaT scenarios containing ten telemetry-evaluable ground-truth episodes, three independent generations of the principal mapping configurations, and external evaluation on BATADAL and WADI. Across the three SWaT generations, DT-enriched mapping produces fewer annotation-relative False Positive (FP) episodes in every run, with a mean per-run reduction of 34.1%. Both configurations obtain a mean recall of 0.633, although recall varies between 0.50 and 0.70 and DT enrichment does not improve F1 in every run. These observations are descriptive: the primary-run paired comparisons do not reach statistical significance, and the mapping advantage does not transfer to either external dataset. An exploratory positive-only dependency benchmark recovers eight of nine documented Co-occurrence relationships with DT context. A separate end-to-end benchmark containing one positive pair and 25 negative controls exposes propagation of mapping errors into unsupported edges. The findings identify both the potential and limitations of DT context for semantic security interpretation, without establishing reliable autonomous attribution, general causal reconstruction, or practical analyst benefit.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2610.02955