A Dual-Layer Digital Twin Approach for Anomaly Detection in the Oil and Gas Sector

In the oil and gas sector, the integration of Digital Twin (DT) technology enhances monitoring, predictive maintenance, and decision-making. However, DTs, being inherently network-connected, are vulnerable to cyberattacks that can compromise reliability without producing clearly traceable signs. This paper proposes dual-layer Anomaly Detection architecture combining a locally isolated control system—immune to remote interference—with the DT model. By comparing real-time plant data from trusted local sources with DT predictions, it is possible to detect anomalies even when the DT is compromised. The proposed system includes three parallel modules: Anomaly Detection (AD), Direct Prediction (DP), and Regressive Prediction (RP), whose outputs are integrated through error analysis and decision logic. The experimental setup, simulating gas extraction, validates this framework. Results highlight the complementary strengths of direct and regressive models, and demonstrate the system’s ability to identify deviations and support root-cause analysis using Isolation Forest and Hotelling T2 methods. This layered approach reinforces operational resilience and enhances cybersecurity in industrial environments.