TwinGuard: A Supervised Machine Learning Framework for DoS Attack Detection in IoT-Enabled Digital Twins Using Random Forest and Feature Selection Optimization

Abstract

Digital Twin (DT) technology enables real-time monitoring of Internet of Things (IoT)-integrated systems but faces severe threats from Denial-of-Service (DoS) attacks, which compromise data accuracy and operational stability. Existing security solutions struggle to adapt to these threats, creating a need for Machine Learning (ML)-based detection. This paper presents TwinGuard, a supervised ML framework that uses a Random Forest (RF) classifier with two feature selection methods: Correlation-based Feature Selection (CFS) and Genetic Algorithm (GA) to identify the optimal approach for DoS detection in DTs. Evaluated on the CICIDS2017 dataset, TwinGuard achieves 0.9994 accuracy and perfect Area Under the Curve (AUC) with GA-based selection, outperforming prior studies that used different datasets (e.g., NSL-KDD) and methods (e.g., decision trees, Support Vector Machine (SVM)). The core contributions of this research are threefold. First, we conducted a comparative analysis of feature selection methods, comparing a CFS approach against GA. Our findings reveal that the GA offers superior performance in identifying an optimal subset of features. Second, to address the common challenge of class imbalance in cybersecurity datasets, we employed the SMOTE technique, which significantly enhanced the generalizability of our model across diverse attack patterns. Finally, the practical application of these methods was demonstrated through the real-time deployment of our system within an Azure IoT-based Digital Twin environment, achieving a low inference latency of just 0.056 seconds. This low latency is a crucial factor, making the solution highly effective for time-sensitive security applications. The results demonstrate TwinGuard’s effectiveness as a scalable solution for securing Industry 4.0 and smart manufacturing systems against evolving cyberattacks.