Threat modeling is a critical proactive security technique for identifying threats and determining mitigations. However, traditional approaches often fall short for Industrial Control Systems (ICS), which automate operations in domains like manufacturing and energy and are a subset of Cyber-Physical Systems (CPS). CPS integrates computation, networking, and physical processes, with ICS requiring specialized cybersecurity approaches due to its operational and safety-critical nature. This study explores the use of digital twin technology as a promising cybersecurity tool for ICS, enabling testing and analysis without disrupting operations. By examining the capabilities of digital twins in analysis, simulation, and replication, the research evaluates their potential to enhance threat modeling across the CPS life-cycle. Insights from the European Cyber Security Organisation (ECSO) Technical Paper on Cybersecurity Scenarios and Digital Twins guide the exploration of their role in threat modeling. The study addresses four research questions: 1. What purposes do digital twins serve in cybersecurity? 2. What benefits do digital twins offer in cybersecurity? 3. How can digital twin technology be leveraged for threat modeling? 4. What advantages can the use of digital twins bring to threat modeling? Our findings reveal that digital twins enhance ICS threat modeling by enabling continuous, dynamic, and autonomous assessment, offering valuable insights for advancing cybersecurity strategies in ICS, CPS, and related domains.

The increasing integration of Industrial Control Systems (ICS) and Cyber-Physical Systems (CPS) with the Internet of Things (IoT) has significantly enhanced their operational efficiency but also exposed them to advanced cyber threats. Traditional cybersecurity approaches, often tailored for IT systems, must address the unique complexities of ICS and CPS environments. This paper systematically reviews the integration of three critical areas: context-based modeling, digital twins, and machine learning (ML), to enhance cybersecurity for ICS and CPS. Context-based modeling provides dynamic, situational awareness; digital twins offer real-time system replicas for monitoring and simulation; and ML delivers predictive and adaptive threat detection and response capabilities. The review synthesizes findings from recent literature to answer four research questions focusing on methodologies in context-based modeling, applications of digital twins and ML in attack detection, and integrating these approaches for improved cyber resilience. The results demonstrate the synergistic potential of combining these technologies, enabling real-time anomaly detection, predictive threat analysis, and adaptive response mechanisms. Challenges such as data limitations, scalability, and verification complexities are vital areas requiring further research. This integrated framework offers a robust pathway for securing critical infrastructure and advancing cybersecurity practices in increasingly interconnected ICS and CPS environments.

Industrial Control Systems (ICSs), which are essential components of critical infrastructures, are inherently complex and vulnerable to cyberattacks. Advanced Persistent Threats (APTs) that target these systems are multi-stage, coordinated attacks that can lead not only to information loss but also to physical damage and loss of life. Traditional threat modeling approaches fall short in adapting to the dynamic nature of ICSs, necessitating new methodologies to predict and prevent such complex attacks. This work presents a digital twin-assisted dynamic threat modeling framework for ICS environments. The framework leverages a knowledge graph that integrates system data and cyber threat intelligence to predict potential attacks. In addition, the digital twin environment enables the validation of mitigation strategies before deployment in the physical system, while also supporting adaptive response and real-time mitigation. To predict the attacker’s next move, we propose a Relational Graph Convolutional Network (RGCN)-based model that utilizes enriched relational data such as tactics, campaigns, groups, techniques, and assets. The proposed RGCN model achieves a recall of 0.887, an F1-score of 0.893, and an AUC of 0.957 in predicting potential attack sequences. These results demonstrate that the model provides reliable and well-balanced predictive performance.