RECORD
Machine Learning for Intrusion Detection in Industrial Control Systems: Applications, Challenges, and Recommendations
Cryptography and Security · Submitted 24 Feb 2022
abstract compiled · 2026-09-23 · no language-model review
The authors' main claim Challenges associated in using the methods and research gaps are identified and recommendations are made to fill the gaps.
The compiled record
The paper's own sentences, arranged. Each label is drawn from a closed vocabulary; the number beside it is the probability the classifier gave that label. Numbers in the tables are the authors', checked by code. No sentence in this record was written by a model.
Open the compiled record
The abstract, sentence by sentence
Methods from machine learning are being applied to design Industrial Control Systems resilient to cyber-attacks. Such methods focus on two major areas: the detection of intrusions at the network-level using the information acquired through network packets, and detection of anomalies at the physical process level using data that represents the physical behavior of the system. This survey focuses on four types of methods from machine learning in use for intrusion and anomaly detection, namely, supervised, semi-supervised, unsupervised, and reinforcement learning. Literature available in the public domain was carefully selected, analyzed, and placed in a 7-dimensional space for ease of comparison. The survey is targeted at researchers, students, and practitioners. Challenges associated in using the methods and research gaps are identified and recommendations are made to fill the gaps.
background contribution method result interpretation main claim
| # | sentence | role | the authors' own work | states the main conclusion | strength |
|---|---|---|---|---|---|
| s0 | Methods from machine learning are being applied to design Industrial Control Systems resilient to cyber-attacks. | background 1.00 | 0.07 | 0.06 | asserted 1.00 |
| s1 | Such methods focus on two major areas: the detection of intrusions at the network-level using the information acquired through network packets, and detection of anomalies at the physical process level using data that represents the physical behavior of the system. | background 0.93 | 0.08 | 0.04 | asserted 1.00 |
| s2 | This survey focuses on four types of methods from machine learning in use for intrusion and anomaly detection, namely, supervised, semi-supervised, unsupervised, and reinforcement learning. | contribution 0.84 | 0.67 | 0.05 | asserted 1.00 |
| s3 | Literature available in the public domain was carefully selected, analyzed, and placed in a 7-dimensional space for ease of comparison. | method 0.96 | 0.89 | 0.03 | asserted 1.00 |
| s4 | The survey is targeted at researchers, students, and practitioners. | contribution 0.60 | 0.36 | 0.02 | asserted 0.99 |
| s5 | Challenges associated in using the methods and research gaps are identified and recommendations are made to fill the gaps. | future work 0.50 | 0.89 | 0.26 | asserted 0.99 |
What was examined, and what was not
- arXiv listing abstract v1
- full text
- figures and tables
- references and citing sentences
- relations to other papers
- P abstract
- S sections
- T body sentences
- C citations
- R cross-paper relations
The paper
Original abstract
Methods from machine learning are being applied to design Industrial Control Systems resilient to cyber-attacks. Such methods focus on two major areas: the detection of intrusions at the network-level using the information acquired through network packets, and detection of anomalies at the physical process level using data that represents the physical behavior of the system. This survey focuses on four types of methods from machine learning in use for intrusion and anomaly detection, namely, supervised, semi-supervised, unsupervised, and reinforcement learning. Literature available in the public domain was carefully selected, analyzed, and placed in a 7-dimensional space for ease of comparison. The survey is targeted at researchers, students, and practitioners. Challenges associated in using the methods and research gaps are identified and recommendations are made to fill the gaps.
Human review
How the literature uses it
What this paper does with the arXiv papers it cites
What it cites · 6 sentences without a confident label
Cites as support 1 paper
-
Therefore, studies that have used actual data from CPS have resorted to simulated attacks to train and evaluate its classifiers [ref] , thus making the realism and fidelity questionable.
Fast Sequence Component Analysis for Attack Detection in Synchrophasor Networks · Dataset · 0.96
Cites as background 4 papers
-
There are several AE-based deep clustering methods including Deep Clustering Network (DCN) [ref] , Deep Embedding Network (DEN) [ref] , Deep Subspace Clustering Networks (DSC-Nets) [ref] , Deep Multi-Manifold Clustering (DMC) [ref] , Deep Embedded Regularized Clustering (DEPICT) [ref] , and Deep Continuous Clustering (DCC) [ref] .
Deep Sparse Subspace Clustering · Autoencoder based deep clustering · 0.91
-
There are several AE-based deep clustering methods including Deep Clustering Network (DCN) [ref] , Deep Embedding Network (DEN) [ref] , Deep Subspace Clustering Networks (DSC-Nets) [ref] , Deep Multi-Manifold Clustering (DMC) [ref] , Deep Embedded Regularized Clustering (DEPICT) [ref] , and Deep Continuous Clustering (DCC) [ref] .
Deep Continuous Clustering · Autoencoder based deep clustering · 0.91
-
There are various GAN-based deep clustering algorithms including Deep Adversarial Clustering (DAC) [ref] , Categorical Generative Adversarial Network (CatGAN) [ref] , and Information Maximizing Generative Adversarial Network (InfoGAN) [ref] .
Unsupervised and Semi-supervised Learning with Categorical Generative Adversarial Networks · Generative Adversarial Network (GAN)-based deep clustering · 0.90
Discussion
Know something about this paper? Leave a comment, or highlight any passage above to comment on it.