Improved real time data collection and processing have resulted in the interconnection of Cyber-physical Systems (CPSs) and of their components including sensors, actuators, network devices with other intelligent devices in the cyber space. This development comes with challenges especially in terms of security. Considering the increase of threats that may lead to data theft and equipment damage when attacked by hackers or intruders, there is an urgent need to proffer enhanced measures that will improve the security of CPS. Herein, anomaly detection is of great interest when it comes to safeguarding Cyber-Physical Systems from such targeted and sophisticated attacks that abound in CPS. They aim to detect behaviours of components of the CPS that do not conform with the normal operations of CPS or alter its processes. Machine Learning approach have provided the necessary means to learn and the ability to identify intrusions in a CPS. A new type of information technology called Digital Twin (DT) makes it possible to turn the real world into a virtual digital environment. Machine learning is applied on the data generated from the Digital Twin to predict the behaviours of components of the CPS during attack and normal operations. Digital Twin, which is a direct replica of the physical twin has been used in industries to study system behaviour and predict system performance. This paper intends to adopt the DHALSIM digital twin testbed for generating datasets that will subsequently be subjected to machine learning. A c-town use case was also adopted to mimic a real-world water distribution system. The physical, network and control processes of an operational CPS was also captured. This research will focus on the behaviour of the physical processes. A machine learning algorithm such as Random Forest algorithm will be applied to the generated dataset with the intention of ascertaining the performance and behaviour of the algorithm on the generated dataset. State of the art literatures were reviewed to identify the behaviour of physical and network processes in a CPS digital twin environment. Attacks will be simulated on the DHALSIM digital twin tested to also establish the behaviour of the system in times of possible attacks. Finally, it is expected that application of Random Forest machine learning algorithm will predict the behaviour (physical processes) of a water distribution system thus improving intrusion detections in CPS.