Source-linked AI summary
Machine Learning for Intrusion Detection in Industrial Control Systems: Applications, Challenges, and Recommendations
Muhammad Azmi Umer, Khurum Nazir Junejo, Muhammad Taha Jilani, Aditya P. Mathur
TL;DR
ICS require protection against cyber-attacks, while existing ML-based intrusion-detection research spans network traffic and physical-process behavior. This survey categorizes four ML paradigms, systematically analyzes selected literature in a 7-dimensional space, and identifies challenges, gaps, and recommendations. It concludes that the field has broad practical relevance but remains constrained by data, evaluation, computational, and coverage limitations.
Problem
ICS are critical infrastructure targets, and the growing ML literature on defending them requires critical synthesis to identify gaps and weaknesses.
Method
The survey categorizes supervised, semi-supervised, unsupervised, and reinforcement learning methods and places selected research in a 7-dimensional comparison space.
Results
The survey consolidates behavior-based ML, deep-learning, and statistical approaches for ICS intrusion detection while identifying research gaps and future directions.
Takeaways & Limitations
Reinforcement learning is least explored for ICS but appears promising across dynamic domains including smart grids, water, and gas systems.
Takeaways & Limitations
Supervised and deep-learning evaluation is constrained by scarce real attack data, reliance on simulated or non-CPS datasets, class imbalance, and computational complexity.
Abstract
from arXiv · showhide
Methods from machine learning are being applied to design Industrial Control Systems resilient to cyber-attacks. Such methods focus on two major areas: the detection of intrusions at the network-level using the information acquired through network packets, and detection of anomalies at the physical process level using data that represents the physical behavior of the system. This survey focuses on four types of methods from machine learning in use for intrusion and anomaly detection, namely, supervised, semi-supervised, unsupervised, and reinforcement learning. Literature available in the public domain was carefully selected, analyzed, and placed in a 7-dimensional space for ease of comparison. The survey is targeted at researchers, students, and practitioners. Challenges associated in using the methods and research gaps are identified and recommendations are made to fill the gaps.
1 INTRODUCTION
The survey examines machine-learning methods for detecting intrusions and anomalies in ICS and related cyber-physical systems. It motivates this focus by ICS criticality, increasing attacks, and the need to identify research gaps and promising methods.
- ICS integrate cyber and physical subsystems through sensors, actuators, and communications links to control processes such as power, water, and oil systems.
- Successful attacks on uranium enrichment, water services, and water treatment systems demonstrate the need for protections beyond traditional network firewalls.
- The survey critically evaluates ML research to help researchers and students identify literature gaps and practitioners identify promising methods for operational tools.
- The survey organizes the literature in a 7-dimensional space and plans regular online updates because the field is rapidly changing.
- It distinguishes network-intrusion detection from physical-process anomaly detection but uses intrusion detection broadly for both.
2 INTRUSION DETECTION SYSTEMS
The survey frames ICS intrusion detection as identifying anomalous operation through signature, specification, and behavior-based approaches. It highlights the trade-offs between known-pattern detection, process models, empirical data, and deployment challenges.
- Signature-based IDS detect predefined attack patterns but can miss zero-day attacks and struggle to build exhaustive signatures for complex physical processes.
- Specification-based detection flags deviations from mathematical models of normal physical operation, but model accuracy is difficult for complex or changing systems.
- Behavior-based approaches train on operational data describing normal and abnormal process behavior, reducing dependence on incorrect vendor specifications.
- Machine-learning behavior-based IDS face persistent challenges in zero-day detection, false-alarm control, and computational complexity.
- Table 1 reports incidents illustrating the operational consequences of attacks on industrial control systems.
3 COLLECTION OF ARTICLES
The article collection used multiple major databases, iterative screening, and relevance-based selection to identify literature focused on ICS or CPS intrusion detection.
- The search covered IEEE Xplore, ACM Digital Library, ScienceDirect, Springer, and Wiley because Web of Science and Scopus were inaccessible.
- Queries combined intrusion, attack, or anomaly detection with cyber-physical systems, critical infrastructure, and machine learning terms.
- Articles published from 2012 to 2020 were screened iteratively, first for properties and then for relevance to ICS.
- Selection excluded IDS studies that did not emphasize ICS or CPS and applied source-specific publication criteria.
4 RELATED SURVEYS
The survey differentiates itself from earlier reviews by consolidating ML-based IDS research specifically for ICS and by addressing methods, challenges, and research gaps across relevant domains.
- Earlier ML-focused ICS surveys discussed benefits and shortcomings but emphasized shifting ICS toward cloud infrastructure and provided limited IDS coverage.
- Reviews of deep learning and anomaly detection addressed broader IDS or taxonomy dimensions without focusing specifically on ICS.
- Physics-based anomaly-detection surveys organized work around detection, attack location, validation, metrics, and implementation.
- Network-based IDS surveys generally did not address the scenario-specific differences of ICS and CPS environments.
- The surveyed behavior-based approaches are described as relatively easy to automate, scalable, and generalizable to new ICS.
5 DIMENSIONS FOR CLASSIFYING INTRUSION DETECTION SYSTEMS
The survey places ICS intrusion-detection research in a seven-dimensional framework covering domain, audit material, complexity, feature selection, time series, dataset, and metrics. This framework supports comparisons across applications, methods, data sources, and evaluation practices.
- The seven dimensions are domain, audit material, complexity, feature selection, time series, dataset, and metrics.The authors use these dimensions to formalize comparisons of surveyed works and discuss their utility in specific environments.
- Domain: Most ICS intrusion-detection applications concern energy, water, and gas, while gas is the least explored smart-utility domain.The gas studies identified rely on a relatively simple testbed containing a pressure sensor, pump, and solenoid valve.
- Audit Material: Audit material typically consists of network traffic or sensor measurements, with relatively few systems using both.Physical-process detection is challenging because ICS components, scale, and functionality differ across processes; hybrid studies combine network and physical features.
- Complexity and Feature Selection: Approaches range from simple feature-selection-and-classifier pipelines to hybrid designs using transformed feature spaces or cooperating classifiers.Feature selection may be manual or automatic, while deep learning can select features inherently; Tabu Search and Random Forest are one reported combination.
- Time Series: Time-series structure helps determine which algorithms are suitable for ML or deep-learning models.One surveyed study represented sensor time series through the distribution of their data samples and used fuzzy logic for classification.
- Dataset: Dataset limitations include scarce real attack data, reliance on simulated attacks or data, and benchmarks that may not represent CPS network traffic.The survey also discusses publicly available MSU, laboratory testbed, and SWaT datasets, noting acknowledged flaws in some datasets.
- Metrics: Because intrusion detection is class-imbalanced, evaluation should report multiple metrics rather than accuracy or recall alone.Recommended measures include accuracy, precision, recall, F-measure, ROC, and AUC; precision–recall trade-offs affect false-positive and false-negative behavior.
6 MACHINE LEARNING APPROACHES FOR INTRUSION DETECTION
Machine-learning intrusion detection for ICS is organized into supervised, unsupervised, semi-supervised, and reinforcement learning, with most existing work concentrated in the first two categories. These approaches trade off labeling requirements, false alarms, and zero-day detection capability.
- Four major learning categories are used for ICS intrusion detection: supervised, unsupervised, semi-supervised, and reinforcement learning.
- Unsupervised learning avoids labeled attack data and can detect zero-day attacks, but usually produces high false alarms.
- Supervised learning is more robust for attack detection but requires labeled normal and attack data.
- Zero-shot learning is proposed as a promising compromise that can use known attacks while detecting attack types absent from training data.
7 SUPERVISED LEARNING
Supervised learning models labeled feature vectors to predict intrusion classes, with ICS research spanning one-class and multiclass detection and numerous classifier families. Deep learning can learn features suited to differing ICS dynamics but introduces computational complexity.
- Supervised learning: Supervised learning learns a class variable Y from labeled features X through the relationship Y = f(X).
- Supervised learning: ICS intrusion detection is typically framed as classification, including one-class classification and multiclass problems.
- Classifier families: Supervised ICS studies use classifiers including SVMs, ANNs, instance-based methods, immune systems, logistic regression, decision trees, random forests, and Bayesian classifiers.
- Decision Tree-Based Approaches: Decision trees assign class labels by traversing feature-based tests from root to leaves, with pruning used to reduce overfitting.
- Deep Learning Based Supervised Learning Approaches: Deep learning learns features rather than requiring complex manual feature engineering and can handle high-velocity data, but its computational complexity makes deployment difficult.
8 UNSUPERVISED LEARNING
Unsupervised learning detects structure and anomalies without a corresponding class variable, using clustering and association-rule mining. ICS studies apply multiple clustering families and use support, confidence, and expert input to derive rules or critical states.
- Unsupervised learning: Unsupervised learning uses feature vector X without a corresponding class variable and commonly applies clustering or association-rule mining.
- Clustering: Clustering approaches include hierarchical, centroid-based, distribution-based, density-based, and grid-based methods.
- Clustering: K-means assigns instances to a fixed number k of clusters according to distance from central vectors.
- Association Rule Mining: Association-rule mining uncovers relationships through itemsets, with support measuring itemset prevalence and confidence measuring rule frequency relative to its antecedent.
- Association Rule Mining: Rules are generated by partitioning frequent itemsets into antecedents and consequents, retaining those that satisfy a confidence threshold.
- Association Rule Mining: Association-rule mining has been used to identify critical system states and generate invariants for water treatment plants, with expert opinion reducing candidate rules.
8.2 Deep Learning Based Unsupervised Learning Approaches
Deep unsupervised learning has limited reported use for ICS security, despite methods that learn representations, reduce dimensionality, and cluster data. These approaches face challenges from large real-time logs and sensitivity to reconstruction-loss design.
- Scope: Only a few studies have reported deep unsupervised learning approaches for securing ICS.
- Challenges: Large real-time system logs and traces make online anomaly detection challenging.
- Representation learning: Autoencoder-based methods learn data encodings, reduce dimensionality, suppress noise, and minimize reconstruction loss.
- Limitations: Deep clustering methods primarily trained on clustering loss can corrupt the feature space when reconstruction loss is poorly designed.
- Deep generative methods: Variational autoencoders constrain the autoencoder latent code to a predefined distribution and can optimize variational inference with stochastic gradient descent and backpropagation.
- Deep generative methods: GAN-based clustering uses generative and discriminative networks in a min-max adversarial game.
9 SEMI-SUPERVISED LEARNING
Semi-supervised learning combines labeled and unlabeled data through iterative labeling and retraining. The survey highlights its assumptions and reports advantages when labeled data are scarce.
- Semi-Supervised Learning: Semi-supervised learning trains initially on labeled data, labels unlabeled data, then retrains using both datasets.The process is described as three phases: supervised training, pseudo-label assignment, and combined-data retraining.
- Assumptions: SSL favors decision boundaries in lower-density regions because nearby points are generally expected to share labels.The assumption can fail when nearby points belong to different classes.
- Assumptions: The cluster assumption assigns the same label to data points within the same cluster.
- Assumptions: The manifold assumption models data on a lower-dimensional structure, potentially reducing the curse of dimensionality.Learning can use distances and densities defined on the learned manifold.
- Applications: SSL has sometimes outperformed supervised and unsupervised approaches when labeled data are relatively scarce.The survey also cites applications to malware behavior extraction and automatic attack-detection updates using unlabeled malware data.
10 REINFORCEMENT LEARNING
Reinforcement learning trains an agent through interaction with an environment and reward rather than a conventional training dataset. The survey reviews model-free algorithms and ICS security applications involving detection, defense, and vulnerability assessment.
- RL Fundamentals: Reinforcement learning consists of an agent, an environment, and rewards generated by the agent’s actions.Unlike other machine-learning techniques discussed here, RL does not require a dataset for learning.
- Algorithms: Temporal-difference learning is model-free and updates value estimates through bootstrapping from current estimates.
- Algorithms: SARSA learns through a Markov Decision Process by updating its policy according to received rewards.Initial conditions, learning rate, and discount factor are identified as hyperparameters.
- Algorithms: Q-learning is model-free, learns policies for actions under different circumstances, and does not require adaptation to stochastic transitions or rewards.
- ICS Applications: RL applications include intrusion detection, smart-grid anomaly detection, CPS defense, and vulnerability assessment.Reported studies include simulated WSN detection, POMDP-based smart-grid anomaly detection, and bus-system simulations for vulnerability assessment.
11 MAJOR CHALLENGES AND RECOMMENDATIONS FOR IDS IN ICS
The survey identifies technical, evaluation, coverage, and deployment gaps in ML-based ICS intrusion detection. It recommends broader physical-process coverage, stronger benchmarks and metrics, comparative evaluation, and layered defenses.
- Threats and Robustness: Adversarial attacks can deteriorate ML-based intrusion-detection performance, including classifiers trained on normal data from real-world ICS.
- Zero-Day Attacks: Zero-day detection remains difficult because complex physical processes make exhaustive attack-signature dictionaries impractical.
- Zero-Day Attacks: Unsupervised attack-pattern generation may help address the scarcity of attack data in supervised intrusion-detection approaches.Association-rule mining was used to generate attack patterns for a real-world ICS.
- Method Limitations: Specification-based methods face aging-system and documentation problems, while behavior-based methods face zero-day, false-alarm, and computational-complexity challenges.
- Physical-Process Diversity: Heterogeneous ICS processes complicate detection because attacks on one stage can disrupt other stages, as illustrated by the six-stage SWaT testbed.
- Evaluation: Accuracy alone is inadequate for skewed IDS data, since labeling most instances as normal can produce high accuracy without useful deployment performance.A system reporting 99% accuracy but 50 false positives per day may not be used operationally.
- Research Gaps: Reinforcement learning is the least explored ML area for ICS security despite its potential across dynamic domains such as smart grids, water, and gas.
- Evaluation: Comparisons among signature-based, specification-based, and behavior-based approaches should use the same dataset and similar assumptions.
12 CONCLUSION
The survey consolidates ML-based behavior approaches for ICS intrusion detection, identifies research gaps, and proposes future directions. It emphasizes the need for stronger datasets, broader comparisons, time-series modeling, and new metrics.
- Conclusion: The survey categorizes ML, deep-learning, and statistical behavior-based approaches, identifies gaps, and proposes future research directions for ICS intrusion detection.It highlights the need for a high-fidelity benchmark dataset, comparisons with specification- and signature-based approaches, time-series modeling, and new metrics.