Integrated Multi-Layer Security Framework for Water Distribution Digital Twins

Digitalization of Water Distribution Networks (WDNs) through Digital Twins (DTs) creates serious cybersecurity concerns, especially for small and medium-sized enterprises (SMEs) that operate with limited budgets and technical resources. Conventional security solutions are usually expensive and demand high computational capacity, which further widens the security gap in the water sector. This paper presents MOSAIC (Multi-Objective Security Adaptation for Infrastructure Cybersecurity), an adaptive framework that continuously balances security performance, computational cost, and system latency. Although multi-layer security architectures are well discussed in the literature, they are generally designed around static processing pipelines. Breaking from this paradigm, MOSAIC formulates the orchestration of security layers as a real-time Pareto optimization problem. Consequently, the core scientific contribution is not the individual detection algorithms, but the adaptive decision engine that mathematically balances their execution based on dynamic resource constraints in water distribution digital twins. The core innovation lies in framing security deployment as a constrained Pareto optimization problem, which dynamically routes data through one of three pipelines (Light, Medium, or Deep Validation) based on real-time threat assessment and data criticality. We validated MOSAIC over a 90-day real-world deployment serving 6,200 customers across six rural villages. Results show that MOSAIC achieves 91.6% weighted security effectiveness (attack recall: 94.3%) while reducing average latency by 60% (from 5.8 s to 2.26 s) and computational cost by 68% compared to static deep-only processing, with less than 8.2 percentage points security trade-off. An economic analysis confirms a 70% reduction in Total Cost of Ownership (TCO) compared to the best commercial alternatives, making MOSAIC a practical and economically sustainable solution for resource-constrained critical infrastructure.