A Multi-Model Digital Twin-Based Intrusion Detection System: Integrating Autoencoder, DNN, and Anomaly Detection for Robust Cyber Threat Identification

Saifur Rahman

doi:https://doi.org/10.14445/22315381/IJETT-V73I11P112

Research Article | Open Access | Download PDF

Volume 73 | Issue 11 | Year 2025 | Article Id. IJETT-V73I11P112 | DOI : https://doi.org/10.14445/22315381/IJETT-V73I11P112

A Multi-Model Digital Twin-Based Intrusion Detection System: Integrating Autoencoder, DNN, and Anomaly Detection for Robust Cyber Threat Identification

Saifur Rahman

Received	Revised	Accepted	Published
05 Aug 2025	03 Nov 2025	10 Nov 2025	25 Nov 2025

Citation :

Saifur Rahman, "A Multi-Model Digital Twin-Based Intrusion Detection System: Integrating Autoencoder, DNN, and Anomaly Detection for Robust Cyber Threat Identification," International Journal of Engineering Trends and Technology (IJETT), vol. 73, no. 11, pp. 147-164, 2025. Crossref, https://doi.org/10.14445/22315381/IJETT-V73I11P112

Abstract

The rapid proliferation of Industrial Internet of Things (IIoT) systems has introduced unprecedented cybersecurity challenges that require advanced detection and response mechanisms. This paper presents a novel cybersecurity framework that leverages Digital Twin (DT) technology to create a comprehensive security solution for IIoT environments. The proposed framework addresses critical limitations in existing approaches by integrating three interconnected models within a unified digital twin architecture that provides real-time monitoring, intelligent anomaly detection, and automated threat classification. The methodology creates a dynamic virtual replica of the physical IIoT network, enabling proactive security management through continuous behavioral analysis and predictive threat assessment. The framework was evaluated using the Edge-IIoT dataset containing 63 features across 15 attack classes plus normal traffic. Experimental results demonstrate exceptional performance with a classification accuracy of 99.97%, Precision (Pr) of 99.77%, Recall (Re) of 99.64%, and F1-score (Fs) of 99.70% for multiclass threat classification. The anomaly detection component achieved a Pr of 99.74% and ROC-AUC of 90.79%, effectively distinguishing between normal and malicious network behaviors. The reconstruction-based anomaly detection mechanism showed clear separation between normal traffic (mean reconstruction error: 0.006) and attack traffic (mean reconstruction error: 1.289), validating the framework’s ability to identify previously unseen threats. These results demonstrate the effectiveness of the proposed digital twin-based approach in providing comprehensive cybersecurity protection for IIoT environments, significantly outperforming traditional security solutions while enabling real-time threat response and proactive incident management.

Keywords

Anomaly Detection, Cybersecurity, Digital Twin, Edge-IIoT Dataset, Industrial Internet of Things (IIoT), Intrusion Detection System (IDS), Machine Learning, Threat Classification.

References

[1] Alessandra De Benedictis et al., “Digital Twins for Anomaly Detection in the Industrial Internet of Things: Conceptual Architecture and Proof-of-Concept,” IEEE Transactions on Industrial Informatics, vol. 19, no. 12, pp. 11553-11563, 2023.
[CrossRef] [Google Scholar] [Publisher Link]
[2] Zhi Qiang Wang, and Abdulmotaleb El Saddik, “DTITD: An Intelligent Insider Threat Detection Framework Based on Digital Twin and Self-Attention Based Deep Learning Models,” IEEE Access, vol. 11, no. 10, pp. 114013-114030, 2023.
[CrossRef] [Google Scholar] [Publisher Link]
[3] Seba Anna Varghese et al., “Digital Twin-based Intrusion Detection for Industrial Control Systems,” 2022 IEEE International Conference on Pervasive Computing and Communications Workshops and other Affiliated Events (PerCom Workshops), Pisa, Italy, pp. 611-617, 2022.
[CrossRef] [Google Scholar] [Publisher Link]
[4] Qinghua Xu, Shaukat Ali, and Tao Yue, “Digital Twin-based Anomaly Detection with Curriculum Learning in Cyber-Physical Systems,” ACM Transactions on Software Engineering and Methodology, vol. 32, no. 5, pp. 1-32, 2023.
[CrossRef] [Google Scholar] [Publisher Link]
[5] Burcu Bolat-Akça, and Elif Bozkaya-Aras, “Digital Twin-Assisted Intelligent Anomaly Detection System for Internet of Things,” Ad Hoc Networks, vol. 158, no. 10, pp. 123-135, 2024.
[CrossRef] [Google Scholar] [Publisher Link]
[6] Mikail Mohammed Salim, David Camacho, and Jong Hyuk Park, “Digital Twin and Federated Learning Enabled Cyberthreat Detection System for IoT Networks,” Future Generation Computer Systems, vol. 161, pp. 701-713, 2024.
[CrossRef] [Google Scholar] [Publisher Link]
[7] Fatemeh Akbarian, Emma Fitzgerald, and Maria Kihl, “Intrusion Detection in Digital Twins for Industrial Control Systems,” 2020 International Conference on Software, Telecommunications and Computer Networks (SoftCOM), Split, Croatia, pp. 1-6, 2020.
[CrossRef] [Google Scholar] [Publisher Link]
[8] S. Krishnaveni et al., “CyberDefender: An Integrated Intelligent Defense Framework for Digital-Twin-Based Industrial Cyber-Physical Systems,” Cluster Comput, vol. 27, no. 6, pp. 7273-7306, 2024.
[CrossRef] [Google Scholar] [Publisher Link]
[9] S. Krishnaveni et al., “TwinSec-IDS: An Enhanced Intrusion Detection System in SDN-Digital-Twin-Based Industrial Cyber-Physical Systems,” Concurrency and Computation: Practice and Experience, vol. 37, no. 3, pp. 1-12, 2024.
[CrossRef] [Google Scholar] [Publisher Link]
[10] Easa Alalwany et al., “Stacking Ensemble Deep Learning for Real-Time Intrusion Detection in IoMT Environments,” Sensors, vol. 25, no. 3, pp. 1-21, 2025.
[CrossRef] [Google Scholar] [Publisher Link]
[11] Arreche, Osvaldo, Tanish Guntur, and Mustafa Abdallah, “XAI-IDS: Toward Proposing an Explainable Artificial Intelligence Framework for Enhancing Network Intrusion Detection Systems,” Applied Sciences, vol. 14, no. 10, pp. 1-41, 2024.
[CrossRef] [Google Scholar] [Publisher Link]
[12] A. Namrita Gummadi, J. C. Napier and M. Abdallah, “XAI-IoT: An Explainable AI Framework for Enhancing Anomaly Detection in IoT Systems,” IEEE Access, vol. 12, no. 5, pp. 71024-71054, 2024.
[CrossRef] [Google Scholar] [Publisher Link]
[13] Nabeel H. Al-A’araji, Safaa O. Al-Mamory, and Ali H. Al-Shakarchi, “Classification and Clustering Based Ensemble Techniques for Intrusion Detection Systems: A Survey,” Journal of Physics: Conference Series, Iraqi Academics Syndicate International Conference for Pure and Applied Sciences (IICPS), Babylon, Iraq, vol. 1818, pp. 1-35, 2020.
[CrossRef] [Google Scholar] [Publisher Link]
[14] Ahmed Mahfouz et al., “Ensemble Classifiers for Network Intrusion Detection Using a Novel Network Attack Dataset,” Future Internet, vol. 12, no. 11, pp. 1-19, 2020.
[CrossRef] [Google Scholar] [Publisher Link]
[15] Riccardo Lazzarini, Huaglory Tianfield, and Vassilis Charissis, “A Stacking Ensemble of Deep Learning Models for IoT Intrusion Detection,” Knowledge-Based Systems, vol. 279, pp. 1-13, 2023.
[CrossRef] [Google Scholar] [Publisher Link]
[16] Yongzhong Cao et al., “An Intrusion Detection System Based on Stacked Ensemble Learning for IoT Network,” Computers and Electrical Engineering, vol. 110, pp. 1-19, 2023.
[CrossRef] [Google Scholar] [Publisher Link]
[17] Ghalia Nassreddine, Mohamad Nassereddine, and Obada Al-Khatib, “Ensemble Learning for Network Intrusion Detection Based on Correlation and Embedded Feature Selection Techniques,” Computer, vol. 14, no. 3, pp. 1-23, 2025.
[CrossRef] [Google Scholar] [Publisher Link]
[18] Uday Chandra Akuthota, and Lava Bhargava, “Transformer-Based Intrusion Detection for IoT Networks,” IEEE Internet of Things Journal, vol. 12, no. 5, pp. 6062-6067, 2025.
[CrossRef] [Google Scholar] [Publisher Link]
[19] Moussab Orabi et al., “Anomaly Detection in Smart Manufacturing: An Adaptive Adversarial Transformer-Based Model,” Journal of Manufacturing Systems, vol. 77, pp. 591-611, 2024.
[CrossRef] [Google Scholar] [Publisher Link]
[20] Mustafa Abdallah et al., “Anomaly Detection and Inter-Sensor Transfer Learning on Smart Manufacturing Datasets,” Sensors, vol. 23, no. 1, pp. 1-22, 2023.
[CrossRef] [Google Scholar] [Publisher Link]
[21] Baibhab Chatterjee et al., “Context-Aware Collaborative Intelligence with Spatio-Temporal In-Sensor-Analytics for Efficient Communication in a Large-Area IoT Testbed,” IEEE Internet of Things Journal, vol. 8, no. 8, pp. 6800-6814, 2021.
[CrossRef] [Google Scholar] [Publisher Link]
[22] Yazeed Alotaibi, and Mohammad Ilyas, “Ensemble-Learning Framework for Intrusion Detection to Enhance Internet of Things’ Devices Security,” Sensors, vol. 23, no. 12, pp. 1-20, 2023.
[CrossRef] [Google Scholar] [Publisher Link]
[23] Tommaso Zoppi, Andrea Ceccarelli, and Andrea Bondavalli, “MADneSs: A Multi-Layer Anomaly Detection Framework for Complex Dynamic Systems,” IEEE Transactions on Dependable and Secure Computing, vol. 18, no. 2, pp. 796-809, 2021.
[CrossRef] [Google Scholar] [Publisher Link]
[24] Evgeniya Petrova Nikolova, and Veselina Gospodinova Jecheva, “Anomaly Based Intrusion Detection Based on the Junction Tree Algorithm,” Proceedings of the International Multiconference on Computer Science and Information Technology, pp. 641-649, 2007.
[Google Scholar] [Publisher Link]
[25] Danish Javeed et al., “An Intrusion Detection System for Edge-Envisioned Smart Agriculture in Extreme Environment,” IEEE Internet of Things Journal, vol. 11, no. 16, pp. 26866-26876, 2024.
[CrossRef] [Google Scholar] [Publisher Link]
[26] Minyue Wu et al., “TRACER: Attack-Aware Divide-and-Conquer Transformer for Intrusion Detection in Industrial Internet of Things,” IEEE Transactions on Industrial Informatics, vol. 21, no. 6, pp. 4924-4934, 2025.
[CrossRef] [Google Scholar] [Publisher Link]
[27] Ahmad Salehiyan, Pardis Sadatian Moghaddam, and Masoud Kaveh, “An Optimized Transformer-GAN-AE for Intrusion Detection in Edge and IIoT Systems: Experimental Insights from WUSTL-IIoT-2021, EdgeIIoTset, and TON_IoT Datasets,” Future Internet, vol. 17, no. 7, pp. 1-34, 2025.
[CrossRef] [Google Scholar] [Publisher Link]
[28] Haonan Peng, Chunming Wu, and Yanfeng Xiao, “FD-IDS: Federated Learning with Knowledge Distillation for Intrusion Detection in Non-IID IoT Environments,” Sensors, vol. 25, no. 14, pp. 1-31, 2025.
[CrossRef] [Google Scholar] [Publisher Link]
[29] Ali Abdi Seyedkolaei, Fatemeh Mahmoudi, and José García, “A Deep Learning Approach for Multiclass Attack Classification in IoT and IIoT Networks Using Convolutional Neural Networks,” Future Internet, vol. 17, no. 6, pp. 1-21, 2025.
[CrossRef] [Google Scholar] [Publisher Link]