A Digital Twin-Based Fuzzing Framework for Cyber–Physical Security Verification in Operational Technology Systems

Operational Technology (OT) systems are increasingly exposed to cybersecurity threats. Fuzzing is effective for vulnerability discovery, but conventional fuzzers judge test outcomes from crashes or protocol responses and cannot detect protocol-valid inputs that drive the physical process into an unsafe state; testing production OT systems is also risky. This paper proposes a digital twin-based fuzzing framework that integrates sensor emulation, PLC logic emulation, actuator emulation, monitoring, and fuzz testing, and judges each test input with a physical-state oracle that computes the true state of the process. A prototype based on Modbus and WebSocket communications was evaluated in two steps. A basic operational check showed response latency below 100 ms, 100% output consistency, and anomaly detection within 1 s. A quantitative experiment on a thermal power plant-inspired turbine startup controller, with 117 valid trials under four conditions, detected 57 failures, none of which produced a communication or software anomaly. Stuck sensor readings caused safety violations, an injected input-validation defect was exposed in every valid trial, and two unintended weaknesses in the controller’s plausibility check were revealed. These results indicate that fuzzing results in OT systems should be judged from the physical state of the process and that digital twins provide a practical platform for doing so.