Digital twins (DTs) are increasingly used to monitor and secure Industrial Control Systems (ICS), yet detecting stealthy False Data Injection Attacks (FDIAs) that manipulate system states within normal physical bounds remains challenging. Deep learning anomaly detectors often over-generalize such subtle manipulations, while classical fault detection methods do not scale well in highly correlated multivariate systems. We propose a closed-loop Information-Theoretic Digital Twin (IT-DT) framework for real-time anomaly detection. N4SID identification is combined with steady-state Kalman filtering to quantify residual distribution shifts via closed-form KL divergence, capturing both mean deviations and malicious cross-covariance shifts. Evaluations on the SWaT and WADI datasets show that IT-DT achieves F1-scores of 0.832 and 0.615, respectively, with better precision than deep learning baselines such as TranAD. Computational profiling indicates that the analytical approach requires minimal memory and provides approximately a 600x inference speedup over transformer-based methods on CPU hardware. This makes the framework suitable for resource-constrained industrial edge controllers without GPU acceleration.

翻译：数字孪生（DTs）在工业控制系统（ICS）的监控与安全防护中应用日益广泛，然而检测那些在正常物理边界内操纵系统状态的隐蔽虚假数据注入攻击（FDIAs）仍具挑战。深度学习异常检测器常对此类细微操纵过度泛化，而经典故障检测方法在高相关性多变量系统中扩展性不佳。本文提出一种用于实时异常检测的闭环信息论数字孪生（IT-DT）框架。该方法结合N4SID辨识与稳态卡尔曼滤波，通过闭式KL散度量测残差分布偏移，同时捕捉均值偏差与恶意交叉协方差偏移。在SWaT和WADI数据集上的评估表明，IT-DT分别取得0.832和0.615的F1分数，其精确度优于TranAD等深度学习基线方法。计算性能分析显示，该解析方法内存需求极低，在CPU硬件上相比基于Transformer的方法可获得约600倍的推理加速，使得该框架适用于无GPU加速的资源受限工业边缘控制器。