# Machine Learning for Intrusion Detection in Industrial Control Systems: Applications, Challenges, and Recommendations

arXiv: https://arxiv.org/abs/2202.11917 · HTML: https://mlsanity.com/paper/2202.11917/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- Builds on 16 of its 224 references that are in the map.
- First posted on arXiv 24 Feb 2022.

## Builds on (most cited first, 16 of 16)

- [InfoGAN: Interpretable Representation Learning by Information Maximizing Generative Adversarial Nets](https://mlsanity.com/paper/1606.03657/) (2016)
- [Evaluation: from precision, recall and F-measure to ROC, informedness, markedness and correlation](https://mlsanity.com/paper/2010.16061/) (2020)
- [Zero-Shot Learning Through Cross-Modal Transfer](https://mlsanity.com/paper/1301.3666/) (2013)
- [Towards K-means-friendly Spaces: Simultaneous Deep Learning and Clustering](https://mlsanity.com/paper/1610.04794/) (2016)
- [Deep Clustering via Joint Convolutional Autoencoder Embedding and Relative Entropy Minimization](https://mlsanity.com/paper/1704.06327/) (2017)
- [Unsupervised and Semi-supervised Learning with Categorical Generative Adversarial Networks](https://mlsanity.com/paper/1511.06390/) (2015)
- [Deep Learning-Based Anomaly Detection in Cyber-Physical Systems: Progress and Opportunities](https://mlsanity.com/paper/2003.13213/) (2020)
- [Deep Continuous Clustering](https://mlsanity.com/paper/1803.01449/) (2018)
- [Anomaly Detection for a Water Treatment System Using Unsupervised Machine Learning](https://mlsanity.com/paper/1709.05342/) (2017)
- [Online Cyber-Attack Detection in Smart Grid: A Reinforcement Learning Approach](https://mlsanity.com/paper/1809.05258/) (2018)
- [Cybersecurity for Industrial Control Systems: A Survey](https://mlsanity.com/paper/2002.04124/) (2020)
- [DeepDyve: Dynamic Verification for Deep Neural Networks](https://mlsanity.com/paper/2009.09663/) (2020)
- [Deep Sparse Subspace Clustering](https://mlsanity.com/paper/1709.08374/) (2017)
- [Adversarial Attacks and Mitigation for Anomaly Detectors of Cyber-Physical Systems](https://mlsanity.com/paper/2105.10707/) (2021)
- [Attack Rules: An Adversarial Approach to Generate Attacks for Industrial Control Systems using Machine Learning](https://mlsanity.com/paper/2107.05127/) (2021)
- [Fast Sequence Component Analysis for Attack Detection in Synchrophasor Networks](https://mlsanity.com/paper/1509.05086/) (2015)

## Built on by (most cited first, 8 of 8)

- [Deep transfer learning for intrusion detection in industrial control networks: A comprehensive review](https://mlsanity.com/paper/2304.10550/) (2023)
- [A Review of Digital Twins and their Application in Cybersecurity based on Artificial Intelligence](https://mlsanity.com/paper/2311.01154/) (2023)
- [Machine Learning-Assisted Intrusion Detection for Enhancing Internet of Things Security](https://mlsanity.com/paper/2410.01016/) (2024)
- [Adversarial Sample Generation for Anomaly Detection in Industrial Control Systems](https://mlsanity.com/paper/2505.03120/) (2025)
- [Anomaly Detection Dataset for Industrial Control Systems](https://mlsanity.com/paper/2305.09678/) (2023)
- [Cyber-Resilient Digital Twins: Discriminating Attacks for Safe Critical Infrastructure Control](https://mlsanity.com/paper/2603.18613/) (2026)
- [Clustering-Enhanced Domain Adaptation for Cross-Domain Intrusion Detection in Industrial Control Systems](https://mlsanity.com/paper/2604.12183/) (2026)
- [Medoid Prototype Alignment for Cross-Plant Unknown Attack Detection in Industrial Control Systems](https://mlsanity.com/paper/2604.25544/) (2026)

## Abstract (arXiv)

Methods from machine learning are being applied to design Industrial Control Systems resilient to cyber-attacks. Such methods focus on two major areas: the detection of intrusions at the network-level using the information acquired through network packets, and detection of anomalies at the physical process level using data that represents the physical behavior of the system. This survey focuses on four types of methods from machine learning in use for intrusion and anomaly detection, namely, supervised, semi-supervised, unsupervised, and reinforcement learning. Literature available in the public domain was carefully selected, analyzed, and placed in a 7-dimensional space for ease of comparison. The survey is targeted at researchers, students, and practitioners. Challenges associated in using the methods and research gaps are identified and recommendations are made to fill the gaps.