A zero-trust digital twin framework for privacy-preserving multi-dataset intrusion detection in industrial IoT with lightweight blockchain auditing

Why smarter factory security matters

Modern factories, power plants, and warehouses increasingly rely on internet-connected sensors and machines to keep production running smoothly. While this connected world boosts efficiency, it also opens the door to hackers who may tamper with data or even disrupt physical equipment. This study presents a new way to watch over industrial networks that aims to spot digital break-ins quickly, protect sensitive data, and keep a clear record of what each device has been doing.

Many attacks, one combined view

Industrial networks see a huge variety of traffic, from harmless status updates to stealthy probes and powerful denial-of-service attempts. Instead of trusting a single dataset, the authors merged three well-known collections of attack data into one large, diverse benchmark. They cleaned and aligned the information, reduced it to the most useful 25 features, and carefully balanced the number of examples of each attack type. This balanced view helped the system learn to recognize not only common attacks but also rare and subtle ones that most detectors miss.

Teaching machines to spot trouble

On top of this unified data, the team trained two machine-learning models to tell normal behavior from five broad attack categories. One model was a relatively simple multilayer perceptron, while the other used a more elaborate design that combines convolutional and recurrent layers to capture patterns over time. Both reached around 89 to 91 percent accuracy and showed almost perfect skill at catching rare attack types. The results suggest that smart data preparation and class balancing matter more than ever-deeper model designs, which is good news for factories that must run security tools on modest hardware.

Trust, twins, and tamper-proof records

Detecting an attack is only part of the story; the system must also decide which devices to trust. The framework introduces a Zero Trust Manager that never assumes any device is safe by default. Instead, each new prediction from the intrusion detector adjusts a device’s trust score up or down. These scores drive a Digital Twin, a virtual mirror of the shop floor that shows each device as healthy, degraded, or quarantined, giving operators an at-a-glance picture of cyber risk across their equipment. At the same time, every trust update is written into a lightweight, hash-linked ledger, creating an audit trail that is easy to verify but hard to secretly alter.

Balancing privacy and performance

Industrial operators often want to analyze network traffic without exposing sensitive details about processes or equipment. To address this, the authors added controlled random noise to the data using a method known as differential privacy. With a moderate privacy setting, accuracy dropped from roughly 89–91 percent to around 78–81 percent, making the trade-off between secrecy and detection power clear and measurable. Tests also showed that the hash-chained logging and trust scoring add almost no delay, keeping the total time to analyze 500 samples just over a second, suitable for near real-time monitoring on resource-limited devices.

What this means for secure industry

In simple terms, the work shows that industrial networks can be guarded by a single, lightweight system that learns from varied attacks, tracks how trustworthy each device appears, protects sensitive data, and keeps a reliable history of security decisions. Rather than relying on fixed walls at the network edge, this approach continuously watches behavior and adjusts access in response. For plant managers and engineers, it points to a practical path toward factories that stay productive while quietly and efficiently resisting a wide range of digital threats.

Citation: Mishra, S., Aldafas, T.S.M. & Alshammari, N.S. A zero-trust digital twin framework for privacy-preserving multi-dataset intrusion detection in industrial IoT with lightweight blockchain auditing. Sci Rep 16, 15236 (2026). https://doi.org/10.1038/s41598-026-42041-w

Keywords: industrial IoT security, intrusion detection, zero trust, digital twin, differential privacy