# Attack Pattern Mining to Discover Hidden Threats to Industrial Control Systems

arXiv: https://arxiv.org/abs/2508.04561 · HTML: https://mlsanity.com/paper/2508.04561/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 12 of its 28 references that are in the map.
- First posted on arXiv 6 Aug 2025.

## Builds on (most cited first, 12 of 12)

- [IDSGAN: Generative Adversarial Networks for Attack Generation against Intrusion Detection](https://mlsanity.com/paper/1809.02077/) (2018)
- [Social physics](https://mlsanity.com/paper/2110.01866/) (2021)
- [Adversarial Attacks on Time-Series Intrusion Detection for Industrial Control Systems](https://mlsanity.com/paper/1911.04278/) (2019)
- [Poisoning Attacks on Cyber Attack Detectors for Industrial Control Systems](https://mlsanity.com/paper/2012.15740/) (2020)
- [Adversarial Attacks and Mitigation for Anomaly Detectors of Cyber-Physical Systems](https://mlsanity.com/paper/2105.10707/) (2021)
- [Attack Rules: An Adversarial Approach to Generate Attacks for Industrial Control Systems using Machine Learning](https://mlsanity.com/paper/2107.05127/) (2021)
- [Saving Human Lives: What Complexity Science and Information Systems can Contribute](https://mlsanity.com/paper/1402.7011/) (2014)
- [A Deep Learning-based Framework for Conducting Stealthy Attacks in Industrial Control Systems](https://mlsanity.com/paper/1709.06397/) (2017)
- [Scanning the Cycle: Timing-based Authentication on PLCs](https://mlsanity.com/paper/2102.08985/) (2021)
- [AttackLLM: LLM-based Attack Pattern Generation for an Industrial Control System](https://mlsanity.com/paper/2504.04187/) (2025)
- [Constrained Concealment Attacks against Reconstruction-based Anomaly Detectors in Industrial Control Systems](https://mlsanity.com/paper/1907.07487/) (2019)
- [Adversarial Sample Generation for Anomaly Detection in Industrial Control Systems](https://mlsanity.com/paper/2505.03120/) (2025)

## Abstract (arXiv)

This work focuses on validation of attack pattern mining in the context of Industrial Control System (ICS) security. A comprehensive security assessment of an ICS requires generating a large and variety of attack patterns. For this purpose we have proposed a data driven technique to generate attack patterns for an ICS. The proposed technique has been used to generate over 100,000 attack patterns from data gathered from an operational water treatment plant. In this work we present a detailed case study to validate the attack patterns.