Machine Learning for Intrusion Detection in Industrial Control Systems: Applications, Challenges, and Recommendations
It addresses cybersecurity challenges in industrial control systems for researchers and practitioners, but is incremental as it is a survey.
This survey paper examines the application of machine learning methods for intrusion detection in industrial control systems, focusing on network-level and physical process-level approaches, and provides a structured analysis and recommendations for researchers and practitioners.
Methods from machine learning are being applied to design Industrial Control Systems resilient to cyber-attacks. Such methods focus on two major areas: the detection of intrusions at the network-level using the information acquired through network packets, and detection of anomalies at the physical process level using data that represents the physical behavior of the system. This survey focuses on four types of methods from machine learning in use for intrusion and anomaly detection, namely, supervised, semi-supervised, unsupervised, and reinforcement learning. Literature available in the public domain was carefully selected, analyzed, and placed in a 7-dimensional space for ease of comparison. The survey is targeted at researchers, students, and practitioners. Challenges associated in using the methods and research gaps are identified and recommendations are made to fill the gaps.