Modelo de simulação para detectar invasões cibernéticas em gêmeos digitais industriais

Abstract

The consolidation of industry 4.0 and the widespread adoption of digital twins rely intrinsically on the integrity of data flows from the industrial internet of things. However, the convergence of information technology and operational technology now exposes critical infrastructures to cyber threats that compromise the synchronization between physical assets and their virtual models. Traditional defense approaches, focusing solely on protocol layer security or complex machine learning algorithms, often fail to balance efficacy and computational cost on resource-constrained edge devices. This thesis proposes and validates a protocol-agnostic statistical data rate monitoring approach, grounded on the premise that industrial traffic exhibits deterministic and cyclic behavior. Using a simulation environment based on containerization Docker and the MQTT protocol, scenarios of normal operation and denial of service, Man-in-the-Middle, and command injection (intrusion) attacks were emulated. The proposed method, employing a parametric statistical threshold μ + 3σ, demonstrated high effectiveness as a first line of defense, achieving a true positive rate of 100% and a false positive rate of 0% in the evaluated scenarios. The results confirm that it is possible to ensure real-time anomaly detection with minimal computational cost, offering a viable solution for protecting digital twins in heterogeneous industrial environments.