Machine Learning for Intrusion Detection in Industrial Control Systems: Applications, Challenges, and Recommendations

Abstract

Methods from machine learning are being applied to design Industrial Control Systems resilient to cyber-attacks. Such methods focus on two major areas: the detection of intrusions at the network-level using the information acquired through network packets, and detection of anomalies at the physical process level using data that represents the physical behavior of the system. This survey focuses on four types of methods from machine learning in use for intrusion and anomaly detection, namely, supervised, semi-supervised, unsupervised, and reinforcement learning. Literature available in the public domain was carefully selected, analyzed, and placed in a 7-dimensional space for ease of comparison. The survey is targeted at researchers, students, and practitioners. Challenges associated in using the methods and research gaps are identified and recommendations are made to fill the gaps.

References in corpus (11)

• Evaluation: from precision, recall and F-measure to ROC, informedness, markedness and correlation
• Zero-Shot Learning Through Cross-Modal Transfer
• Towards K-means-friendly Spaces: Simultaneous Deep Learning and Clustering
• Anomaly Detection for a Water Treatment System Using Unsupervised Machine Learning
• Online Cyber-Attack Detection in Smart Grid: A Reinforcement Learning Approach
• Deep Continuous Clustering
• Deep Learning-Based Anomaly Detection in Cyber-Physical Systems: Progress and Opportunities
• Adversarial Attacks and Mitigation for Anomaly Detectors of Cyber-Physical Systems
• DeepDyve: Dynamic Verification for Deep Neural Networks
• Deep Sparse Subspace Clustering
• Introduction to Reinforcement Learning

Cited by in corpus (7)

• A Review of Digital Twins and their Application in Cybersecurity based on Artificial Intelligence
• Deep transfer learning for intrusion detection in industrial control networks: A comprehensive review
• Deep Reinforcement Learning for Intrusion Detection in IoT: A Survey
• A False Sense of Security? Revisiting the State of Machine Learning-Based Industrial Intrusion Detection
• SoK: Evaluations in Industrial Intrusion Detection Research
• Adversarial Sample Generation for Anomaly Detection in Industrial Control Systems
• A Cyber-Twin Based Honeypot for Gathering Threat Intelligence