A Parameterised Entropy Control Plane and SPARQL-Queryable Explanations for Auditable Neurosymbolic Digital Twin Security

Digital Twins used as security replicas of cyber-physical systems must detect attacks while keeping decisions inspectable. Atop an existing entropy-gated neurosymbolic operator, we introduce an Entropy Analysis Layer (EAL), which treats estimator, window and stride as deployment variables with a two-sided gate |ΔHt|>τs calibrated per configuration, and a Semantic Explainability Layer (SEL), which exposes operator reasoning through three canonical SPARQL queries on a threat-intelligence-aligned ontology. Evidence types are separated: a 30-seed synthetic factorial; the official CIC-IDS2017 Friday capture, per second, with causal calibration and 4.46 h out-of-sample benign traffic; a minute-level robustness check; a synthetic stress test. On the capture’s single DDoS event, the two-sided permutation-entropy gate detects it in all nine overlapping, non-independent window/stride configurations (median delay 170 s, 33 false positives per benign hour with μ+3σ; 326 s and 2.7 per hour with the empirical 99.7% quantile); the one-sided gate detects it in none with μ+3σ and, via a single onset alarm, in one with the quantile. A rolling packet-rate z-score detects it after 43 s, with 91 false positives per hour. Shannon results depend on binning and calibration; no estimator dominates. Canonical queries run in 22–111 ms (median) at 5×104 triples. The layers provide auditable configuration evidence, not benchmark-level detection performance.