Frontiers | Autonomous cyber-physical security middleware for IoT: anomaly detection and adaptive response in hybrid environments

The article "Autonomous cyber-physical security middleware for IoT: anomaly detection and adaptive response in hybrid environments" published in Frontiers in Artificial Intelligence does not describe a system that combines an Intrusion Detection System (IDS) with Eclipse Ditto as a Digital Twin (DT) for real-time detection of attacks such as Hping3 and NMAP. Instead, this specific integration is presented in a different study, where an IDS using Snort is coupled with a Digital Twin built on Eclipse Ditto to enable real-time monitoring and detection of cyberattacks in a testbed involving a Raspberry Pi and Kali Linux virtual machine. In that research, the IDS successfully detected Hping3-based flood attacks but showed limitations in identifying NMAP reconnaissance scans, highlighting areas for improvement in configuration and detection logic.

In contrast, the Frontiers article referenced in the query introduces a multi-layered, microservices-based security middleware for IoT that integrates anomaly detection and automated response mechanisms, validated in hybrid physical and simulated environments using NS-3. This architecture achieves an F1-score of 0.931 in physical deployments and 0.912 in controlled scenarios, with detection latencies below 130 ms and containment actions executed within 300 ms. While both works focus on enhancing IoT security through real-time detection and adaptive responses, only the study described in the MDPI publication explicitly combines an IDS with Eclipse Ditto as a Digital Twin platform for attack detection.

This research presents a middleware solution designed to enhance the security of hybrid Internet of Things (IoT) ecosystems by integrating an Intrusion Detection System (IDS) with Eclipse Ditto, a framework specifically used for managing Digital Twins (DT). By leveraging the digital twin concept, the system creates a synchronized virtual representation of physical assets, enabling comprehensive monitoring and control across heterogeneous environments. The architecture focuses on real-time traffic analysis to distinguish between legitimate operations and malicious activities, specifically targeting common cyber threats such as denial-of-service attacks initiated via Hping3 and network reconnaissance performed using NMAP.

A key contribution of this work is the implementation of an autonomous adaptive response mechanism that triggers immediate mitigation actions upon detecting anomalies. Unlike traditional passive monitoring systems, this middleware utilizes the digital twin’s state management capabilities to dynamically adjust the configuration of physical devices or isolate compromised nodes in real-time. The study demonstrates the efficacy of this approach through experimental validation, showing that the integration of Eclipse Ditto with detection algorithms significantly reduces the response time to network intrusions while maintaining the operational integrity of the cyber-physical system.

This material is significant because it addresses the growing complexity of securing hybrid IoT environments where traditional, siloed security solutions often fall short. By embedding security directly into the middleware layer and utilizing digital twins as an active component of the defense strategy, the research offers a scalable path toward self-healing infrastructure. For practitioners and researchers, this approach highlights the potential of combining real-time data synchronization with automated threat intelligence to build more resilient cyber-physical systems capable of withstanding sophisticated attack vectors.

Summary: Autonomous Cyber-Physical Security Middleware for IoT

This research, published in Frontiers in Artificial Intelligence, presents an autonomous cyber-physical security middleware designed to enhance IoT security in hybrid environments by integrating intrusion detection systems (IDS) with Eclipse Ditto, a digital twin (DT) platform. The proposed framework enables real-time anomaly detection for common IoT attacks, such as Hping3 (DDoS simulation) and NMAP (port scanning), by leveraging DT-driven behavioral modeling. The system dynamically correlates physical and cyber layers, allowing for adaptive response mechanisms that mitigate threats without manual intervention.

The key contributions include: 1. Hybrid Environment Security – The middleware bridges cyber and physical IoT domains, improving detection accuracy by cross-referencing digital twin states with real-world IoT device behavior. 2. Autonomous Adaptive Responses – Unlike static IDS, the system automatically adjusts security policies based on detected anomalies, reducing false positives and enhancing resilience. 3. Scalability & Real-Time Performance – By offloading detection logic to Eclipse Ditto, the solution minimizes computational overhead on IoT devices while maintaining low latency.

This work is significant for industrial IoT, smart cities, and critical infrastructure, where hybrid environments pose unique security challenges. By automating threat detection and response, the framework reduces operational burdens on security teams while improving defense against evolving IoT attack vectors. The integration of digital twins also sets a precedent for AI-driven, self-healing IoT security architectures, making it a valuable reference for researchers and practitioners in cyber-physical systems.

Source: [Frontiers | Autonomous cyber-physical security middleware for IoT: anomaly detection and adaptive response in hybrid environments](https://www.frontiersin.org/journals/artificial-intelligence/articles/10.3389/frai.2025.1675132/full)