Network packet

Control (management)

Process (computing)

Engineering

Computer security

Operating system

Anomaly detection

Data mining

Computer science

Reinforcement learning

Mathematics

Domain (mathematical analysis)

Mathematical analysis

Data science

Artificial intelligence

Intrusion detection system

Unsupervised learning

Industrial control system

Machine learning

International Journal of Critical Infrastructure Protection

Methods from machine learning are being applied to design Industrial Control Systems resilient to cyber-attacks. Such methods focus on two major areas: the detection of intrusions at the network-level using the information acquired through network packets, and detection of anomalies at the physical process level using data that represents the physical behavior of the system. This survey focuses on four types of methods from machine learning in use for intrusion and anomaly detection, namely, supervised, semi-supervised, unsupervised, and reinforcement learning. Literature available in the public domain was carefully selected, analyzed, and placed in a 7-dimensional space for ease of comparison. The survey is targeted at researchers, students, and practitioners. Challenges associated in using the methods and research gaps are identified and recommendations are made to fill the gaps.

Machine learning for intrusion detection in industrial control systems: Applications, challenges, and recommendations