Abstract

|_Keywords_:<br>Digital twin<br>ICS<br>ATT&CK for ICS<br>LLMs<br>RAG<br>Attack graphs<br>Reconstructing adversarial behavior from Industrial Control System (ICS) telemetry<br>is difcult because process observations reveal physical changes more directly<br>than the actions that produced them. This paper presents a Digital Twin (DT)-<br>assisted framework that extracts synchronized state changes, converts them into<br>evidence-preserving descriptions, maps them to ATT&CK for ICS through retrieval-<br>augmented Large Language Model (LLM) reasoning, and constructs a typed<br>dependency graph. Evaluation comprises a four-confguration ablation on nine<br>held-out SWaT scenarios containing ten telemetry-evaluable ground-truth episodes,<br>three independent generations of the principal mapping confgurations, and external<br>evaluation on BATADAL and WADI. Across the three SWaT generations, DT-<br>enriched mapping produces fewer annotation-relative False Positive (FP) episodes<br>in every run, with a mean per-run reduction of 34.1%. Both confgurations obtain a<br>mean recall of 0.633, although recall varies between 0.50 and 0.70 and DT enrichment<br>does not improve F1 in every run. These observations are descriptive: the primary-<br>run paired comparisons do not reach statistical signifcance, and the mapping<br>advantage does not transfer to either external dataset. An exploratory positive-<br>only dependency benchmark recovers eight of nine documented Co-occurrence<br>relationships with DT context. A separate end-to-end benchmark containing one<br>positive pair and 25 negative controls exposes propagation of mapping errors<br>into unsupported edges. The fndings identify both the potential and limitations<br>of DT context for semantic security interpretation, without establishing reliable<br>autonomous attribution, general causal reconstruction, or practical analyst benefit.