A Multi-Agent-Driven Hybrid Digital Twin Framework for Adaptive Cybersecurity Vulnerability Verification in Power Cyber-Physical Systems

Abstract

Power industrial control systems (ICSs) have evolved into tightly coupled cyber-physical systems, which enlarges the attack surface and makes online vulnerability verification risky for critical infrastructure. Existing software-only simulators usually abstract firmware, industrial protocols, and device-specific behavior, whereas purely physical testbeds are costly and difficult to scale. To address this gap, this paper proposes a multi-agent-driven hybrid digital twin framework for adaptive cybersecurity vulnerability verification in power cyber-physical systems. The core of the framework is a high-fidelity three-in-one verification environment that integrates physical entities, network emulation, and power-process simulation. The framework complements physical testbeds rather than replacing them: fidelity-critical controllers and source-grid-load-storage devices are retained in controlled hardware loops, while larger communication topologies and power-process contexts are virtualized. Red-team and blue-team agents then orchestrate vulnerability triggering, attack-chain replay, intrusion detection, mitigation, and impact assessment. A virtual–real cross-verification mechanism calibrates the virtual models using physical measurements and validates candidate vulnerabilities in controlled hardware loops. A wind-turbine PLC near-source attack case demonstrates how the framework links cyber events, controller behavior, and physical operating states, and the reported quantitative indicators are interpreted as scenario-specific verification logs rather than universal statistical guarantees. The framework therefore provides a safe, scalable, and evidence-driven path for vulnerability verification and resilience enhancement in power critical infrastructures.