Physics-informed zero-trust digital twins for resilient and safe cloud-controlled unmanned aerial vehicles under cyber-physical attacks

Cloud-controlled unmanned aerial vehicles (UAVs) are emerging as aerial nodes for inspection in smart factories, power plants, and critical infrastructure, where they face denial-of-service (DoS), replay, false-data injection (FDI), command manipulation, and compound attacks that exploit multiple communication channels simultaneously. Existing single-layer defenses, including packet verification, anomaly detection, and recovery control, provide limited protection against coordinated cyber–physical attacks; this paper proposes PZTwin-UAV, a physics-informed zero-trust digital twin (DT) framework for resilient UAV cyber–physical systems (CPSs). The framework fuses secure-packet trust features, DT innovation residuals, physics-consistency checks, replay evidence, and attack-mode confidence into a single continuous trust score supervising transitions among four control modes. Its specific novelty is the auditable closed-loop coupling of network trust, model-based physical evidence, and graduated control recovery; the individual packet, DT, and resilient-control mechanisms are not claimed as new in isolation. Seven attack scenarios, including an adaptive hybrid attack combining DoS, FDI, replay, command injection, and delay effects, stress the closed loop across individual and compound threat conditions. In a 60 s two-turn ascending spiral inspection scenario, PZTwin-UAV achieves a position root-mean-square error (RMSE) of 0.121 m versus 11.992 m for no defense, 9.456 m for resilient MPC, and 16.160 m for a fallback-only fairness baseline. The resilience index reaches 0.960 against the best baseline value of 0.286; MATLAB algorithm execution averages 0.227 ms per simulated step (0.335 ms P95), indicating computational headroom but not end-to-end real-time feasibility. Detection recall is 0.899 with precision 0.782 and false-positive rate 0.193; controller resilience and detector operating point are treated as independent objectives. A separate 600 s repeated-mission test shows no cumulative trust drift under the stationary simulated plant, while also exposing mission-dependent false alarms and the need for real sensor-drift validation.