The integration and automation of industrial processes has brought significant gains in efficiency and productivity but also elevated cybersecurity risks, especially in the process industry. This paper introduces a methodology utilizing process mining and digital twins to enhance anomaly detection in Industrial Control Systems (ICS). By converting raw device logs into event logs, we uncover patterns and anomalies indicative of cyberattacks even when such attacks are masked by normal operational data. We present a detailed case study replicating an industrial process to demonstrate the practical application of our approach. Experimental results confirm the effectiveness of our method in identifying cyber–physical attacks within a realistic industrial setting.

Cyber Ranges and Digital Twins simulate real-world environments and mirror digital systems in order to provide realistic scenarios in a controlled space for practitioners and experts. As cyber adversaries evolve, such tools become more and more important to ensure readiness and resilience. In this paper, we employ Knowledge Graphs to describe digital twins. We then apply cyber-deception techniques to protect such graphs - for each digital twin of interest, we build a large set of fake versions of its description. This way, adversaries stealing descriptions of digital twins will have to cope with many fake versions and try to identify the original one, incurring in important additional costs.