A Review of Anomaly Detection Strategies to Detect Threats to Cyber-Physical Systems

Abstract

Cyber-Physical Systems (CPS) are integrated systems that combine software and physical components. CPS has experienced rapid growth over the past decade in fields as disparate as telemedicine, smart manufacturing, autonomous vehicles, the Internet of Things, industrial control systems, smart power grids, remote laboratory environments, and many more. With the widespread integration of Cyber-Physical Systems (CPS) in various aspects of contemporary society, the frequency of malicious assaults carried out by adversaries has experienced a substantial surge in recent times. Incidents targeting vital civilian infrastructure, such as electrical power grids and oil pipelines, have become alarmingly common due to the expanded connectivity to the public internet, which significantly expands the vulnerability of CPS. This article presents a comprehensive review of existing literature that examines the latest advancements in anomaly detection techniques for identifying security threats in Cyber-Physical Systems. The primary emphasis is placed on addressing life safety concerns within industrial control networks (ICS). A total of 296 papers are reviewed, with common themes and research gaps identified. This paper makes a novel contribution by identifying the key challenges that remain in the field, which include resource constraints, a lack of standardized communication protocols, extreme heterogeneity that hampers industry consensus, and different information security priorities between Operational Technology (OT) and Information Technology (IT) networks. Potential solutions and/or opportunities for further research are identified to address these selected challenges.

1. Introduction

Cyber-Physical Systems (CPS) are integrated systems that combine cyber components, such as software (embedded) programmed computational algorithms, and physical components, such as sensors and actuators, into a unified real-time control system [1], where all the components are interconnected through communication links, such as computer networks and the Internet, with shared communication protocols and are interacted with and function based on their system architecture to serve particular applications. CPS is a broad field, encompassing traditional Industrial Control Systems (ICS), Supervisory Control And Data Acquisition (SCADA), and the more modern Internet of Things (IoT)-based smart systems.

The term “Cyber-Physical System” is commonly utilized in academic circles, whereas the industry predominantly employs “IoT” when referring to consumer-grade devices and “IIoT” (Industrial Internet of Things) for industrial control systems encompassing manufacturing, process control, and related domains.

The exponential expansion [2] of Cyber-Physical Systems (CPS) has surpassed the progress made in cybersecurity, leading to the emergence of novel threat models and security challenges. Unfortunately, there is a lack of a unified framework for ensuring secure design, resistance against malware, and effective risk mitigation. The majority of attention from both academia and industry is primarily focused on consumer-grade IoT devices, such as smart home automation. Regrettably, there seems to be comparatively less emphasis on industrial-grade IoT from both academia and industry, despite the fact that the consequences of IIoT failures can be significantly more severe, encompassing scenarios such as power grid failures, oil pipeline shutdowns, and transportation network interruptions [2].

The field of threat detection and prevention has reached a mature stage within enterprise networks, supported by established vendors (Cisco, Crowdstrike, FortiNet, Palo Alto, etc.) offering robust host-based and network-based Intrusion Detection Systems/Intrusion Prevention Systems (IDS/IPS). However, CPS currently lacks equivalent IDS/IPS capabilities [3].

Legacy ICS and SCADA environments have not fully adapted to the pervasive connectivity brought by Industry 4.0 [4]. Moreover, security measures in ICS often tend to be an afterthought or low-priority feature set. This can be attributed to the outdated belief that the ICS environment remains isolated from an air-gapped and trusted network [5], which is no longer accurate. As a consequence of heightened connectivity to hostile networks, Cyber-Physical Systems (CPS) have witnessed a rapid surge in malicious intrusions, leading to substantial economic losses and posing risks to life safety.

Academic research on ICS/SCADA systems used for industrial process control has been subsumed into the larger body of CPS, with active collaboration [6] between industry and academia enabling rapid enhancements, particularly in the areas of security and reliability engineering.

There is a gap in academic research and industry practice in the area of anomaly detection/intrusion detection/intrusion prevention. This paper aims to summarize the existing efforts in this area, which will enable the identification of gaps and weaknesses as well as opportunities for additional research.

As a systematic review, this paper is intended to be useful as a form of secondary study, providing a summation of existing literature in the field, identifying gaps or areas with limited existing research, and identifying opportunities for future works in the research area. A five-step methodology was used to develop this review, beginning with the framing of the research question and followed by an exhaustive search to identify relevant works. The identified works were then assessed to determine quality and relevance, followed by a summarization of the existing works and interpretations of the existing findings, with the goal of identifying gaps in the existing research for future development.

The remainder of this paper is organized as follows: Section 2 provides historical background on CPS as well as the rationale for the safe and secure operation of these increasingly critical infrastructures. In Section 3, a statistical analysis of the areas covered in the existing literature is presented, enabling the identification of gaps in current research. In Section 4, a literature analysis is conducted for each category that has been identified. Section 5 showcases the existing challenges and identifies potential solutions to advance the state of the art. Lastly, in Section 6, this paper discusses the conclusions drawn and highlights opportunities for future research.

2. Background and Rationale

In years past, the paramount objective in ICS design was to achieve utmost reliability and predictability. As a result, fundamental cybersecurity practices such as implementing complex passwords or enforcing stringent authentication requirements were perceived as hindrances to system accessibility. Consequently, designers and operators of these systems deliberately avoided such measures [7]. Similarly, traditional anti-malware programs like signature-based antivirus tools were eschewed to mitigate the risk of false positives mistakenly quarantining or disabling crucial system operations. These legacy systems were commonly operated on completely trusted and isolated networks, devoid of any connections to corporate networks and certainly without any link to the public Internet.

Furthermore, the absence of standardization in the early years of ICS design gave rise to a wide variety of proprietary communication protocols, which often relied on the principle of “security by obscurity” [8]. This approach was due to the lack of a rigorous peer review process. Moreover, system vendors typically lacked mechanisms for delivering updates or bug fixes, which meant that newly discovered vulnerabilities would persist throughout the lifespan of the system. In such cases, sole reliance was placed on network isolation as a means of protection against threats.

With the evolution from legacy ICS to modern CPS environments, the previously held design principles became unsustainable. The widespread adoption of wireless networks and the swift abandonment of isolated air-gapped network environments made the historical design considerations impractical in the face of the requirements for standardized communication protocols used on the public internet.

Legacy communication protocols employed by ICS, such as Modbus, DNP, Fieldbus, HART, and others [9], are gradually being replaced by TCP/IP protocols used in Cyber-Physical Systems (CPS). This shift is predominantly motivated by commercial interests to enable communication with business networks and the wider Internet.

The current landscape of CPS reflects a highly interconnected world where the presence of threat actors is pervasive, necessitating the assumption of a hostile network environment. As CPS becomes more extensively integrated with various corporate and public networks, the attack surface has exponentially expanded. Consequently, breaches targeting critical national infrastructure (CNI), including power grids [10] and more, have become increasingly frequent.

As a result of the historical design objectives in ICS, the level of observability of the system state [10] has traditionally been confined to the real-time status of individual sensors or actuators, accompanied by straightforward threshold-based alerts for system operators. The assumption that ICS would operate within isolated and completely trusted networks meant that IDS/IPS were not prioritized during the design phase. Consequently, there is a deficiency in observability within the increasingly hostile network layer of CPS, making it challenging to detect threats and malicious activities in an increasingly interconnected world.

Perhaps the most notorious example of a blended or integrated threat is the Stuxnet [11] malware that attacked the Natanz nuclear enrichment facility, using a combined suite of attacks against both the Cyber and the Physical components of the system. In what is widely considered the first large-scale attack on a CPS, the Stuxnet malware used zero-day exploits developed specifically for the Information Technology (IT) components of the CPS, which were then leveraged to run the Operational Technology (OT) components of the CPS slightly outside the operational tolerances of speed and pressure, resulting in the physical destruction of precision equipment.

Anomaly detection of security threats to CPS has become more urgent and critical to industry and life safety as CNI becomes increasingly interconnected with public networks. Therefore, further study is needed to advance the state of academic research on the issue and to develop and apply preventative solutions for industry to ensure safe and secure implementations of CPS.

Serpanos [2] identifies how CPS differs from traditional computational systems due to the integration of a wide range of heterogenous technologies in the sensors and actuators and discusses how interaction with the physical world raises key issues around resilience, fault tolerance, and life safety issues. The integration challenges of combining IT and OT [12] are significant, as the design goals are often at odds, in part due to IT networks being approached from a Computer Science perspective while OT networks are approached from an industrial operations management perspective, each of which has differing goals and objectives.

3. Statistical Analysis

The search terms described in the Keywords section were used to identify relevant literature sources from assorted search engines, including the ACM Digital Library, Google Scholar, IEEE Xplore, Semantic Scholar, SpringerOpen, and Web of Science. Search results were further filtered by year, excluding references older than 5 years. Exclusions were performed by manual review to ensure relevancy. Additional inclusions were identified through manual review of the results returned by the above search engines and through use of the “Cited by” functionality of Google Scholar to identify related references. A total of 296 sources of literature have been selected and reviewed for this research. As a literature review, this section is designed not only to summarize the existing research in the field but also to be of use to future researchers. As such, this section will categorize the existing research literature reviewed in this paper by country of origin (based on the first author’s institutional affiliation), publication type, publisher, and publication year. As shown in

Table 1. Academic Publishers.

Publisher	Articles
IEEE	114 (39%)
Springer	47 (16%)
ScienceDirect	44 (15%)
MDPI	16 (5%)
ACM	12 (4%)
Other	63 (21%)
Total	296 (100%)

, The top two academic publishers comprise more than half of the available literature, resulting in an effective oligopoly in academic publishing in this specific research area.

The majority of available research in this field is contributed by the top five publishers, all of which are well-established academic publishers known for their rigorous peer review and high level of quality assurance processes. The so-called “network effect” of the overwhelming majority of available research being concentrated in such a small number of publishers makes it difficult for new or niche publishers to gain critical mass, as researchers gravitate to the publishers with the highest reputations and impact factors.

As shown in

Table 2. Publication Types.

Publication Type	Articles
Journal	182 (61%)
Conference	72 (24%)
Other	43 (15%)
Total	296 (100%)

, Academic journals account for the majority of research publications in this area, with academic conferences being a distant second and other publications (i.e., industry whitepapers, trade association standards) ranking as nearly insignificant.

The realm of CPS security is significantly shaped by industry, although the focus of these efforts is often geared towards immediate tactical measures to address current market threats and opportunities. Industry-driven initiatives, motivated by competitive advantage and the need to protect trade secrets, are seldom disclosed to the wider community. Consequently, the practice of “security by obscurity” remains prevalent in the industry. This situation highlights a distinct absence of collaboration between industry and academia in the field of CPS security, presenting a valuable opportunity for enhancement and progress.

In order to remain up-to-date in a swiftly evolving domain, the literature examined in this paper encompasses the past decade, primarily focusing on articles published within the last three years, as shown in

Table 3. Publications by Year.

Publication Year	Articles
2022	68 (23%)
2021	69 (23%)
2020	73 (25%)
2011–2019	86 (29%)
Total	296 (100%)

. The term “Cyber-Physical Systems” was introduced by the US-based National Science Foundation (NSF) in 2006 [13], resulting in limited pre-existing research prior to that timeframe. Earlier investigations pertaining to CPS were conducted within the domains of industrial process control, cybernetics, control logic, and engineering.

As shown in

Table 4. Publications by Country.

Country	Articles
USA	59 (19.9%)
China	34 (11.5%)
India	28 (9.5%)
UK	25 (8.4%)
Other	150 (50.7%)
Total	296

, the largest single contributor of research in this domain is the USA, generating one-fifth of the available literature, and the top four countries generate as much research as all other countries combined.

4. Literature Analysis

The existing research in the area of anomaly detection on CPS can be broadly classified into the following categories, each of which will be discussed further:

Table 5. Publications by Category.

Category	Articles
Comparison of Anomaly Detection Strategies	60
Using IDS/IPS for Anomaly Detection	63
Using AI/ML for Anomaly Detection	92
Improving Anomaly Detection with Simulators/Testbeds	27
Anomaly Detection at the Network Edge	20
Trusted Systems vs Zero-Trust Architecture	21

shows the statistical numbers of the literature reviewed in this paper by topic.

The categories shown in Table 5 should be considered broad in nature, and many of the sources in the existing literature have minor degrees of overlap in more than one category, but all sources will have a primary focus on a single category. In addition to the above publications, there are 13 sources referenced in the Introduction section of this paper that provide supporting historical references but are not included in the above table due to their inconsequential relation to the analysis performed in this paper.

Table 6. Category Overview.

Category	Overview
Comparison of Anomaly Detection Strategies	Each AD strategy can be classified as signature-based, threshold-based, or behavior-based, each of which has different advantages and disadvantages.
Using IDS/IPS for Anomaly Detection	IDS/IPS are mature strategies in IT networks, but still struggle in OT networks due to the much higher cost of false positives.
Using AI/ML for Anomaly Detection	AI/ML strategies are primarily leveraged for behavior-based AD strategies, with learning algorithms designed to distill big data problems into actionable intelligence.
Improving Anomaly Detection with Simulators/Testbeds	The physical components of large-scale CPS environments are economically infeasible to duplicate for dev/test, making simulations or small-scale testbeds an attractive alternative.
Anomaly Detection at the Network Edge	As IoT/IIoT sensor networks proliferate, performing initial data filtering and pre-processing at the network edge becomes necessary to avoid network saturation.
Trusted Systems vs Zero-Trust Architecture	For historical reasons, industrial networks were designed to be isolated and fully trusted, but with increasing connectivity to public networks, adoption of ZTA becomes increasingly important.

provides a brief summary of each category, with more detailed analysis to follow in the subsequent sections.

4.1. Comparison of Anomaly Detection Strategies

This is the third-largest category of research articles [14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72] covered in this review and discusses all the references that describe multiple strategies for performing effective anomaly detection for CPS. Due to the rapid rate of change and extreme heterogeneity of CPS, there are multiple competing recommendations and proposals, with no clear leader in industry or academia.

Threat detection methodologies can be categorized into three main groups [14]: signature-based, threshold-based, and behavior-based. A signature-based approach, like that used in traditional antivirus programs, relies on a centralized and regularly updated database of signatures to identify malicious files or traffic. When a match is found, it triggers an alarm on an Intrusion Detection System (IDS) and/or Intrusion Prevention System (IPS). Signature-based detection performs effectively on IT networks due to uniform communication protocols and relatively high homogeneity. However, it encounters challenges in OT networks, characterized by proprietary communication protocols and diverse physical components, resulting in higher rates of false negatives.

Threshold-based methodologies depend on established acceptable operational ranges, which are relatively straightforward to define in IT networks. These can include metrics such as network latency, link saturation, and levels of CPU utilization. However, accurately defining known ranges of acceptable operation in OT networks has proven more challenging due to the influence of real-world environmental fluctuations [15]. For instance, in a smart city setting, a network of air quality sensors utilizing wi-fi or cellular networks may experience variations in communication latency caused by factors like fog or rain. This unpredictability makes it difficult to establish consistent thresholds of acceptable operation, as they can differ based on the prevailing weather conditions.

Behavior-based methodologies pose considerable difficulties for accurate detection on IT networks, and these challenges are further magnified when applied to OT networks [16]. Establishing a precise benchmark or reference point for normal behavior on an IT network necessitates a profound level of comprehension of what constitutes typical system activity. However, it is uncommon for IT networks to remain unchanged throughout their entire lifecycle, making the definition of normal behavior a constantly moving target at best. These challenges are amplified on OT networks, which tend to be even more dynamic due to environmental factors such as weather-related variations in temperature, humidity, and ambient light, among others. Furthermore, the repercussions of false positive or false negative detections on OT networks are notably more significant. They can lead to physical equipment damage and pose serious life-safety concerns.

Signature-based anomaly detection provides excellent detection accuracy against known threats but suffers from excessive false negatives for unknown threats. To contrast, behavior-based anomaly detection excels in the detection of unknown threats but suffers from high false positives for known threats. Much of the existing literature describes methodologies to improve on the weaknesses of each method or combine both signature-based and behavior-based anomaly detection into a hybrid system for better accuracy.

Altunay et al. [17] focus on AI/ML methods for optimizing behavior-based anomaly detection by building a large data model of historical performance measurements and enhancing the machine learning model by correlating it with a signature-based database of known threats. This hybrid model of anomaly detection slowly grows in accuracy as more information is added to the learning model, but decreases in real-time performance as the amount of historical data grows.

Rubio et al. [18] focus on the emerging risks posed by Advanced Persistent Threats (APT), a specialized type of malware designed to exploit a specific organization or specific model of CPS. APTs are typically deployed against a high-value target, such as Critical National Infrastructure (CNI), by a highly skilled threat actor. Because the APT is often customized for a specific target, traditional signature-based anomaly detection strategies have limited accuracy due to the zero-day exploits used by the APT. For this reason, an intrusion detection system (IDS) can only be considered the first layer of a multilayered defense and should be used with other mitigation techniques, including network segmentation to minimize risks of lateral exploitation, threshold-based detection methods for observing performance metrics that fall outside of defined boundaries, and behavior-based anomaly detection of traffic patterns with other network hosts.

4.2. Using IDS/IPS for Anomaly Detection

This is the second-largest category of research articles [73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135] covered in this review and discusses all the references that propose novel methods of anomaly detection in CPS, with particular focus on IDS (Intrusion Detection Systems) and IPS (Intrusion Prevention Systems).

As discussed in previous sections of this paper, a CPS can be viewed as a fusion of IT and OT environments. The field of IT networks has mature and robust solutions for threat detection using IDS/IPS, but there have been significant challenges [73] in effective threat detection on OT networks.

Seng et al. [74] focus on the stark divide between industry and academia in the design and operation of IDS/IPS for industrial networks. The oldest and most common method of intrusion detection on both IT and OT networks is signature-based, which uses a database of known malicious patterns to recognize malicious traffic. Signature-based IDS are the oldest and most commonly used method for intrusion detection. They are extremely effective at detecting known attacks but are typically unable to detect novel or zero-day attacks, which means the signature database must be frequently updated. To contrast, anomaly-based detection is typically based on using AI/ML to model normal behavior, then classifying any behavior that falls outside those parameters as anomalous and therefore a potential threat. A simplistic method of anomaly-based detection is to use predefined thresholds to define normal behavior. In IT networks, these thresholds would apply to metrics such as processor or memory utilization, while OT networks would use physical environmental measurements such as temperature, pressure, voltage, etc.

While threshold-based detection methodologies do not require the same frequent database updates as signature-based detection methods, they still share the same high levels of accuracy and a relatively low administrative burden on the part of the system operator to maintain the IDS. This combination of minimal administrative requirements and high levels of accuracy for known threats has resulted in high levels of industry acceptance and adoption of this type of IDS/IPS.

Seng et al. report that while the overwhelming majority of industry adoption of IDS/IPS in industrial environments uses signature-based and threshold-based strategies, the academic community focuses almost entirely (97%) on behavior-based detection strategies using AI/ML, which have very little uptake in industry. AI/ML algorithms are able to achieve very high accuracy rates (typically >95%), but despite achieving high detection rates of both known and unknown threats, the proposed methods rarely progress from academia to industry. The extreme heterogeneity of IIoT environments is particularly challenging, as AI/ML models will typically have low applicability to other environments, making wide adoption difficult. The availability of representative datasets is another significant challenge, with most of the available research datasets being artificially generated by researchers with varying levels of fidelity to real-world IIoT environments. These limitations translate to a high administrative cost in terms of time and expertise on the part of the system operator, which significantly hinders widespread adoption. The primary challenges identified by Seng et al. with behavior-based IDS are the availability of exhaustive datasets containing accurately labeled data and the ongoing ease of administrative maintenance, both of which are currently unsolved problems.

Khraisat et al. [75] further develop the works of Seng by building a taxonomy of current IDS/IPS techniques and comparing the different AI/ML techniques common in academic literature. Systematic comparisons of several ML algorithms are provided, each with varying advantages and disadvantages, with a common theme being that an ensemble method that combines multiple ML algorithms to leverage synergies to improve overall accuracy by stacking different algorithms to achieve higher accuracy levels than can be achieved with a single algorithm. A disadvantage of this method is its higher complexity and additional time and expertise requirements on the part of the system operator, which have hampered industry adoption.

Vasan et al. [76] further develop the work of Khraisat on ensemble learning models to improve IDS/IPS accuracy in IIoT environments with a novel approach for feature selection by stacking heterogeneous features, achieving very high classification accuracy (99.98%) with low computational overheads that can be handled by resource-constrained IoT devices. This ensemble learning model focuses on cross-platform malware due to the rapid growth in IoT attacks against diverse processor architectures, driven by malicious actors refining their own adversarial capabilities. The proposed ensemble model is referred to as MTHAEL (Malware Threat Hunting based on Advanced Ensemble Learning) and combines multiple weak learner algorithms to train a strong learner to generate enhanced predictions based on the multiple predictions from the weak learner models.

MTHAEL generates a normal baseline through disassembly of the executable binary files on the IoT devices to determine the OpCode instructions (i.e., machine code, one level lower than assembly language) to determine which operations occur during normal operation. This extremely low level of instruction provides cross-platform compatibility for intrusion detection, which is advantageous in the highly heterogeneous market of IoT devices. The primary advantage of this methodology is the ability to leverage the same IDS/IPS across a broad range of IoT devices, which helps reduce the administrative burden on the system operator by making the IDS/IPS available to a wider audience without additional customization. However, the initial disassembly of all application binaries is a laborious process that requires high levels of expertise, which is not common outside of academia, thereby limiting broad industry adoption. This type of IDS would best be deployed as a SaaS (Software as a Service) offering, offloading the ongoing maintenance of the IDS to a centralized subject matter expert that can leverage a federated dataset to provide rapid intrusion detection of both known and unknown threats.

Abid et al. [77] propose a novel method of using a distributed IDS, defining the challenges as a big data problem, and using machine learning to sift through both legitimate and attack data from disparate sources in a centralized cloud-based environment, then feeding the analyzed/classified data back to the distributed nodes in the IDS to be acted upon. The value proposition of this method is to provide the Machine Learning (ML) model with richer data sources than can be obtained from a single viewpoint on the network, thus improving the classification accuracy of the IDS. While this approach is useful for a homogenous IIoT environment, it has limited applicability outside of a single organization due to the wide variation in IIoT architectures. This contrasts with IDS/IPS implementations in traditional enterprise networks, which tend to be more monocultural and thus better able to leverage distributed IDS/IPS learning models.

Bai et al. [78] propose an instruction-level methodology for malware detection in CPS/IIoT environments through the use of an out-of-band circuit board that collects power consumption details from the sensors and actuators in the CPS and performs offline analysis to determine if the components in the CPS are operating normally. This methodology avoids the more traditional signature-based detection of malware, opting for behavior-based anomaly detection by using side-channel characteristics such as power consumption, acoustics, response time fluctuations, etc. Analysis of side-channel characteristics essentially turns the entire CPS into a deterministic finite state machine, with the IDS/IPS considering any non-deterministic behavior as malicious. While this is a novel idea, requiring additional out-of-band hardware solely for behavioral monitoring adds significant complexity to a CPS, which is a significant barrier to industry adoption. Additionally, this method suffers from low detection accuracy if the CPS experiences normal load-based variation due to changing operational parameters being incorrectly classified as non-deterministic behavior, so this methodology is best suited to relatively small and static CPS/IIoT environments.

Chavez et al. [79] propose a hybrid IDS that treats the cyber and physical portions of the CPS as distinct environments with different threat profiles, using a signature-based IDS for the cyber components and a behavior-based IDS for the physical components. The objective of this hybrid model is to increase detection accuracy by increasing the level of difficulty for a malicious actor to bypass the IDS on both the cyber and physical portions of the CPS. Additionally, by separating the detection methodologies for the IT and OT portions of the network, the update frequency of intrusion signatures can be independent, which is advantageous for the typically higher velocity of updates on the IT portion of the CPS. Additionally, the detection methodology for the OT portion of the CPS tends to be primarily threshold-based fault detections (i.e., voltages or temperatures outside of defined ranges) rather than intrusion detections. This clear delineation between the IT and OT portions of the CPS allows for more precise tuning of the alert thresholds to minimize false positives, which can have significant economic and life safety issues in IIoT environments.

Gu et al. [80] propose a classification framework that uses Convolutional Neural Networks (CNN) to learn representative attack characteristics from raw network traffic to train a network-based IDS. This methodology is designed to counter the common ML challenge of having insufficient training data in an ML model due to the scarcity of malicious activity, as well as the heterogeneity of different IIoT environments preventing meaningful transfer of ML models between organizations. The proposed method attempts to minimize the data preprocessing by automatically transforming the data into fixed formats that are transferable across different data types, then using a discriminator to determine if the traffic is benign or malicious. The proposed use of CNN for automated feature extraction improves the accuracy of the ML model by mitigating the reduced accuracy typically introduced by unbalanced datasets, but still suffers from relatively high false positives and false negatives for previously unknown attacks.

Rakas et al. [81] suggest that many CPS environments are well-suited to anomaly detection via pattern recognition of a narrowly defined set of traffic patterns between specific hosts using specific communication protocols, with anything outside these narrowly defined boundaries defined as anomalous. This is essentially a threshold-based anomaly detection strategy, that works well for static environments in which all communication patterns are known in advance. This strategy suffers when the consumers of sensor data are dynamic or the amount of communication between nodes on the network varies due to external events that may be semi-random, such as weather fluctuations or human client behavior.

Ravikumar et al. [82] build on the work of Rakas by proposing a distributed IDS for federated CPS environments such as interconnected smart power grids. The proposed distributed IDS uses Ethernet switch port mirroring to capture network traffic flow data and consolidate that data in a centralized or cloud-based IDS environment for enhanced situational awareness of activity in a distributed and/or loosely coupled CPS. This allows IDS rules to be dynamically generated based on activity across a loosely coupled or distributed IDS, such as a smart power grid, to provide faster anomaly detection and greater protection against cascading failures. On test datasets, the accuracy of simulated anomaly events was very high, but it requires further development to be applicable to more dynamic live environments.

Sheng et al. [83] suggest that existing IDS are capable of detecting anomalies but cannot meaningfully describe the overall risk or impact on the CPS and propose a generalized model that characterizes the network environment and CPS processes through event correlation and activity patterns of the nodes on the network, with any violations of the model being considered abnormal behavior and thus an anomalous event. This proposed methodology has had some success when tested against public datasets, but suffers from high false positives on live systems.

Hwang and Lee [84] focus on improvements in anomaly detection from the perspective of minimizing false alarms from sensors by adding an interpretation layer to AI predictions that are opaque to the system operators, providing a higher quality of information to the human security analysts. This combines unsupervised machine learning with supervised machine learning by automatically adding data labels based on statistical mean prediction errors. Data labeling is typically a high-cost effort in terms of human time and expertise, which this proposal attempts to mitigate by automatically applying labels based on statistical analysis, with the intent of the IDS suffering from fewer false positive alerts.

4.3. Using AI/ML for Anomaly Detection

This is the largest category of research articles [136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227] covered in this review and discusses all the references that propose novel methods for using AI/ML for anomaly detection.

As sensors become more powerful and more numerous in CPS, transforming increasingly large amounts of raw data into actionable information becomes increasingly challenging, with AI/ML being used for data ingest, data pre-processing, pattern recognition, and analysis [136]. Along with increases in device processing power, both wired and wireless network technologies have tremendously increased in speed over the years, making the amount of data that can be feasibly retrieved from CPS sensors grow dramatically. As the amount of sensor data reaches so-called “Big Data” levels, the need for automated data processing has made AI increasingly popular for leveraging data from CPS.

The resulting wealth of data from CPS sensors has outstripped human capabilities to effectively process it, with AI/ML increasingly being employed [136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227] to process the large datasets produced from CPS sensors. AI/ML usage in CPS is typically used for data mining/analytics purposes, with the goal of extracting actionable insights from the raw data.

Individual sensors in a CPS are typically resource-constrained [137] and are only aware of the sensor readings from a single device. By having multiple sensors in the CPS feeding an AI learning model, a fuller understanding of the CPS as a cohesive whole can be achieved, including hostile activity such as a DDoS attack that would not be detected by individual sensors.

The adoption of AI in CPS has been notably rapid, particularly in the context of manufacturing processes within the realm of “Industry 4.0”. The utilization of AI in CPS serves two primary purposes: enhancing protection against cybersecurity attacks and improving operational efficiency. In their work, Alhaidari and AL-Dahasi [4] develop an enhanced framework that utilizes AI to detect Distributed Denial of Service (DDoS) attacks by employing multiple machine learning algorithms. The research involved analyzing different datasets using machine learning algorithms to enable swift detection of DDoS attacks. Preprocessing of raw data was employed to reduce the amount of data used for training the model, which proved instrumental in enhancing the mean time required to detect an attack. A noteworthy finding drawn from the study emphasized the necessity for increased collaboration between CPS operators and the broader industry to facilitate the sharing of vulnerability information.

Tsochev and Sharabov [138] approach the use of AI in CPS as a means for maximizing production efficiency in a manufacturing-based environment. By using AI as an expert system for near-real-time decision making based on all sensor inputs from the CPS, downtime can be minimized through predictive failure analysis to proactively schedule maintenance activities, which helps enhance life safety precautions. The overall efficiency of the CPS is improved due to machine learning algorithms that extract actionable intelligence from the big data sets generated by the sensors in the CPS.

Altunay et al. [16] propose an approach based on deep learning for training a behavior-based IDS, which shows some promise but is ultimately limited by the quality and breadth of the training data, which is notoriously difficult to gather and accurately label for OT networks owing to their lack of standardized communication protocols and high levels of heterogeneity.

Fatani et al. [139] expand on this concept by proposing an AI-based mechanism for behavior-based IDS using deep learning and metaheuristic algorithms to extract actionable threat intelligence from raw sensor data and network telemetry, leading to improved accuracy in threat detection.

Hindy et al. [140] propose the integration of SIEM (Security Information and Event Management) tools that are already commonly leveraged in IT networks to be more fully integrated into OT networks. The authors recognize the differing information security postures and priorities between IT networks and OT networks, so they customize the event correlation techniques used to build a machine learning model that is optimized for OT networks, focusing on the lack of open standards for CPS communication protocols and the lack of network segmentation in a typical CPS that enables lateral network exploitation.

Shahriar et al. [141] propose an IDS based on a Generative Adversarial Network (GAN) to train an AI model with automatically generated training data to predict anomalous events that have not yet been observed. The intent is to produce a generalized model of anomaly detection that is applicable to heterogeneous CPS environments without the extensive site-specific customization that is typically required.

Yadav et al. [142] build on the work of Shahriar et al. by further developing GAN as a method of improving accuracy in an IDS. GAN uses two opposing neural networks, with a generative model attempting to predict what a previously unseen anomaly might look like, while the opposing discriminatory model is used to determine if the prediction of the generative model is valid. The use of GAN can rapidly accelerate the detection of anomalous events by the IDS while reducing false alarms.

Chen et al. [143] further develop methods of GAN, focusing on hostile actors deliberately introducing slight variations to malicious payloads in order to evade both signature-based and behavior-based IDP/IPS. These evasive strategies from malware authors have long existed as polymorphic computer viruses in IT networks but have traditionally been mitigated by signature-based detection methods. Chen et al. build upon these countermeasures by employing GAN techniques to train a behavior-based detection system to recognize malicious traffic that has been intentionally obfuscated to evade signature-based detection algorithms. This is a novel implementation that provides defensive capabilities against polymorphic attacks using the same techniques as hostile actors by training an ML model with an expansive description of all potential mutations of a particular malicious payload.

Long Short-Term Memory (LSTM) is another promising ML algorithm for intrusion detection. Alsaedi et al. [144] propose a novel framework for detection of malicious behavior in CPS environments through a framework that uses Deep Neural Networks (DNN) to train a ML model to recognize the expected behavior of a complex multi-sensor industrial network. LSTM is used to model temporal sequences from time-series sensor data to capture long-term dependencies and is combined with a novel method of applying different weighting values to focus on the most relevant characteristics in the complex dataset, which improves prediction accuracy by reducing noise in complex datasets.

Al-Shabi et al. [145] further build upon LSTM methods for anomaly detection in IIoT environments by adapting Recurrent Neural Networks (RNN), a subset of DNN that provides better performance and accuracy. The use of RNN combined with LSTM allows the ML model to preserve knowledge about previous iterations of time-series sensor data in the IIoT network, making the model more efficient than typical neural networks that assume each input and output are independent of previous iterations. Utilizing RNN to develop iterative predictions typically suffers from low accuracy due to increasing entropy through fading gradients, but Al-Shabi et al. propose a method to counter this shortcoming with LSTM in order to achieve high accuracy levels with significantly reduced computing time compared to other DNN models.

A frequently cited shortcoming of existing intrusion detection methods that leverage AI/ML is the difficulty in enabling the human operators of IIoT networks to understand the predictive decisions reached by AI-based IDS/IPS, which is crucial for industrial networks that require human intervention for operations with significant economic or life safety considerations. The nascent field of Explainable Artificial Intelligence (XAI) is beginning to see more research interest in IIoT environments.

Borcherding et al. [146] propose a novel method that differentiates linear and non-linear ML models, starting from the hypothesis that linear models are less likely to learn dependencies between features, and this difference can be determined through statistical analysis in order to further tune the ML models with optimized algorithms, specifically Logistic Regression (LR) and Support Vector Machine (SVM) for linear models, while non-linear models are further trained using Neural Networks (NN) and Random Forest (RF). This method is somewhat similar to ensemble learning through its application of multiple ML algorithms, with the appropriate algorithm dynamically selected based on the contents of the particular dataset.

Ha et al. [147] further develop strategies for leveraging XAI in IIoT environments by proposing an extension to existing One-Class Support Vector Machine (OCSVM) and LSTM algorithms that solve the human comprehension issue by integrating XAI into the model and generating human-readable explanations of predictive decisions reached by anomaly detection methods using OCSVM and LSTM. The integrated XAI modules interpret the ML predictions for the human operator of the CPS, reducing maintenance costs and accelerating decisions that require human intervention. The proposed model uses streaming sensor data to feed an LStM autoencoder, which is then further processed via OCSVM and simultaneously filtered through an XAI model that visualizes a human-readable explanation for any detected anomalies. LSTM is particularly effective when used with time-series data, which maps well to sensor data from an IIoT environment, but LSTM suffers from poor performance with large datasets. Ha et al. propose overcoming this limitation by streaming incoming sensor data through OCSVM, which is optimized for rapidly classifying data as normal or anomalous.

Huong et al. [148] focus on improving XAI through the use of federated learning, approaching the existing challenges as a Big Data problem with low-powered edge devices feeding a centralized model called FedEX (Federated learning-based Explainable Anomaly Detection for Industrial Control Systems). This allows geographically distributed IIoT environments to leverage the resource-constrained sensor nodes to collect data, which undergoes local pre-processing on a moderately powerful edge node, with those pre-processed readings then forwarded to a more powerful centralized host for further processing and model training based on data aggregated from all the distributed edge nodes of the highly distributed control system. This two-stage processing allows for rapid anomaly detections in isolated segments of the distributed ICS, which allows distant nodes in the highly distributed environment to eventually learn of localized zero-day attacks through federated learning. This two-stage process is essentially a trade-off between rapid detection and accuracy, optimized by the judicious placement of edge nodes that feed back to the centralized federated learning system.

4.4. Improving Anomaly Detection with Simulators/Testbeds

Within a conventional corporate computer network, it is customary to have both a production environment, which facilitates the operational functions of the organization, and a parallel dev/test environment, specifically designed for testing changes and upgrades. However, when it comes to Cyber-Physical Systems (CPS), the presence of dev/test environments is less prevalent. This is primarily due to the considerable costs and complexities associated with maintaining a parallel version of all the physical components within the CPS [228].

To meet this challenge, numerous simulation platforms [228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254] have been developed to enable researchers and practitioners to test various aspects of a CPS in a controlled, non-production environment. These platforms offer a solution that mitigates the significant economic costs and potential risks to life safety associated with testing on live systems.

Simulated CPS environments find common application in vulnerability assessments, involving activities such as input fuzzing, man-in-the-middle (MitM) attacks, Distributed Denial of Service (DDoS), False Data Injection (FDI), and more. Performing such activities directly on a live CPS could result in substantial financial and/or life-safety consequences, making simulated environments highly appealing for testing purposes [229]. Additionally, these simulated environments are frequently employed for non-disruptive user training, either through parallel virtualized CPS setups or through Augmented Reality/Virtual Reality (AR/VR) simulations.

Simulated or test environments are prevalent in software-only domains, primarily because server virtualization technologies allow cost-effective simulation of extensive networks and applications. However, when it comes to CPS environments, which consist of customized and distinct combinations of cyber and physical devices, the quest for a universal testbed or simulator has proven challenging. The multitude of hardware sensors and actuators available in the marketplace has contributed to the elusive nature of achieving a one-size-fits-all solution.

AL-Hawawreh and Sitnikova [230] take a unique approach, recognizing that the existing installed base of ICS has lifespans that measure into decades, so there are many ICS still in use that were originally deployed in an era prior to ubiquitous connectivity, when networks were much less hostile than they are today. This large installed base of critical infrastructure typically lacks any method of bolting on security functionality after the fact, resulting in a proposal for a generic end-to-end security testbed for ICS environments using legacy protocols with the objective of facilitating cybersecurity testing. A generalized prototype was used, allowing modular plug-ins for assorted sensors, actuators, and other control devices. To allow for interconnection between legacy ICS protocols and modern CPS environments, an IIoT edge gateway is used to translate non-routable legacy protocols into modern TCP/IP protocols with integrated encryption.

The RITICS (Research Institute in Trustworthy Inter-connected Cyber-physical Systems, London, UK) organization [231] is perhaps the leader in academic research in this area, a consortium of universities and industry partners that collaboratively develop simulators and testbeds for a broad range of CPS, with a focus on Industrial Control Networks (ICS) and their interactions with external corporate networks and the public internet.

RITICS has a particular focus on developing simulated environments with a high level of fidelity to the real-world system being emulated, as well as the repeatability and accuracy of test runs. This high degree of fidelity to the real-world counterpart leads to higher levels of confidence in the simulator as being reflective of the real world, which is often lacking in other implementations.

Craggs et al. [232] build on the research conducted at RITICS, proposing a reference architecture for IIoT/ICS testbeds with a focus on cybersecurity issues rather than the real-world fidelity focus of RITICS. The proposed reference architecture generally follows the Purdue model [233], classifying the different attack surfaces of the CPS based on the six different zones defined in the Purdue Reference Architecture [233], plus the addition of a new zone called the Experimental Zone, which is specific to testbed environments.

Waraga et al. [234] propose an extensible open source platform for automated identification of security issues in IoT/CPS, with the goals of accelerating time to market and rapid identification of security vulnerabilities by minimizing human intervention through automated security testing of the CPS using a testbed. The existing testbed implementations have limited scalability for vulnerability analysis, and this modular and automated testbed environment aims to allow researchers to add new test cases through a plug-in architecture. This does provide a novel method that allows other researchers to extend the platform functionality to include new IoT devices that appear on the market, but the platform is heavily slanted towards the cyber portion, and very little coverage is provided for the physical portion of the CPS. This makes the platform most appropriate for the detection of network-based attacks that seek to exploit protocol vulnerabilities, but it has very little coverage for physical vulnerabilities caused by False Command Injection (FCI) attacks that seek to exploit the physical components of a CPS.

To avoid the limitations inherent in the testbed proposed by Waraga, Ani et al. [235] propose a testbed framework with greater real-world fidelity by modeling the physical components of the CPS with emulated hardware. This approach provides researchers with greater confidence that their testbed environments will produce higher quality results, but increases the level of effort, expense, and expertise required to build the testbed environment. A significant challenge with building testbeds that include emulated or simulated physical components is the researcher’s understanding of the behavior of the physical components at the edges of the operational thresholds, such as temperature, pressure, vibration, etc. Accurate modeling of edge-case behavior by emulated hardware is a significant design challenge and affects the real-world fidelity of the security testbed.

4.5. Anomaly Detection at the Network Edge

With the throughput of data communication networks and microprocessor speeds increasing exponentially over the past decades, it has become attractive to move certain functions to the network edge [255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274]. In decades past, early CPS were constrained [255] by the state of the art of microprocessor technology and network bandwidth, resulting in low-frequency, low-resolution data sampling from the sensors of the CPS. For example, a typical CPS in the 1990s may have only had sufficient processing power and network bandwidth to sample temperature and pressure sensors once every few minutes, while a modern system has sufficient processing power for continuous, real-time, high-resolution data sampling from sensors. Network throughput has also increased exponentially over the past few decades, but not nearly as quickly as improvements in microprocessor technology, so there is still a bottleneck in the collection of sensor data in a CPS. This bottleneck can be alleviated by pre-processing data at the network edge, close to where the sensor data is collected, and then sending a groomed or compressed subset of the data across the constrained network link, as illustrated in Figure 1.

An et al. [256] propose a lightweight HTTP-based method of anomaly detection using a distributed architecture at the network edge. Rather than traditional signature-based malware detection techniques that use a centralized or choke-point scanner that looks for specific binary strings in the payload section of the TCP packet, the proposed framework uses a distributed scanning architecture at the network edge that ignores the payload section of the TCP packet and only scans the HTTP header information. This moves the detection logic up from the transport layer to the application layer of the TCP/IP networking model, based on the concept that higher layers of the TCP/IP networking model contain richer information. The proposed framework has performance advantages over the more traditional signature-based detection strategies, and its distributed model allows for multiple nodes to perform anomaly detection closer to the sensors and actuators in the CPS, relieving congestion on the network code by processing data closer to the edge. Classification and data pruning occur at the network edge, with the resource-constrained distributed edge nodes forwarding a digest version of the data to a more powerful system at the network core for ingestion into a machine learning model. This hybrid model of performing pre-processing at the resource-constrained network edge plus more detailed processing of aggregate data in the network core shows promise but is limited to the inspection of HTTP traffic. While HTTP is a commonly used protocol in IoT/CPS networks, it is by no means universal, and as lightweight protocols such as MQTT and MATTER specifically optimized for resource-constrained environments continue to gain popularity, HTTP usage in IoT/CPS networks is likely to diminish in the coming years, making this proposed framework somewhat limited. However, due to its modular architecture, a potential future use for this framework would be to add extensions for other protocols.

Recognizing the limitations of being restricted to a single protocol, Huong et al. [257] propose a more generalized framework for distributed anomaly detection at the network edge using a protocol agnostic approach. Similar to An et al., this framework concentrates on higher layers of the TCP/IP networking model, using a distributed cluster of nodes for anomaly detection, placed as close as possible to the data generated by the sensors and actuators of the CPS in order to minimize bandwidth requirements on the resource-constrained network edge. Time series data is aggregated and normalized on the distributed edge nodes and then forwarded to the network core for deeper analysis of the aggregated data from all the distributed nodes. This allows all of the resource-constrained edge nodes to benefit from the compute capacity available in the network core and uses a federated deep learning approach to perform anomaly detection. This anomaly detection method is behavior-based rather than signature-based, so it excels at the detection of previously unknown threats.

Wang et al. [258] propose the insertion of an edge computing platform between the sensors and data consumers of the CPS, with the edge devices acting as a broker between the incoming requests for sensor data and the sensors themselves. This allows inline IDS/IPS functionality to be performed on a more powerful device than the resource-constrained sensors, as well as load balancing and caching of incoming requests and resource availability.

Javed et al. [259] propose a middleware solution based on the microservices architecture popularized by container-based workloads running on cloud computing platforms such as Kubernetes. By inserting a microservices abstraction layer at the network edge, one layer upstream of the CPS sensors, the proprietary communication protocols frequently used by CPS can be translated or encapsulated into open TCP/IP protocols by the microservices layer. This also allows for normalization of incoming client requests, which simplifies anomaly detection by tightly controlling the format of the incoming requests based on a publish/subscribe data broker model. In addition to simplifying anomaly detection, the publish/subscribe model allows for more efficient use of the constrained network bandwidth and processing power available to the sensors by allowing aggregation at the network edge, allowing multiple clients to subscribe to the cached output of a single sensor at the microservices layer.

Das et al. [260] focus on real-time intrusion prevention of edge devices, starting with the rationale that the sensors and actuators in a CPS were designed to operate in harsh environmental conditions but have limited emphasis on resilience in the face of cyberattack. Das et al. propose a generic framework for detection and prevention of Denial of Service (DoS) attacks on Programmable Logic Controllers (PLC) through the use of a novel IPS running at the network edge between the resource-constrained PLC devices and potentially malicious traffic. Recognizing that the physical components of the ICS will typically lack sufficient processing power to perform local intrusion detection, the IPS functionality runs on an inline perimeter device that functions as a TCP proxy server, inspecting traffic destined for a PLC and making real-time decisions to pass or block the traffic. This proposed framework is highly effective in detecting DoS attacks but has limited efficacy in preventing more subtle false command injection or false data injection attacks, limiting its use case to a small subset of threats to CPS.

Eskandari et al. [261] build on the work of Das et al., employing the same edge-based inline IPS but extending the functionality to cover more than simple DoS attacks by training a ML model using the Isolation Forest (IF) and Local Outlier Factor (LOF) algorithms to learn the normal behavior of the CPS and effectively classify anomalous data for multiple attack types, including DoS, port scans, HTTP brute force, and SSH brute force. The proposed framework uses unsupervised learning to autonomously train the model with one-class classification techniques, which can be achieved with relatively low computational effort on moderately powered edge devices but suffers from low performance when scaled to large sensor networks and is still limited to rather rudimentary threshold-based measurements that may be more suited to a centralized SIEM that receives telemetry feeds from edge devices.

Tsukada et al. [262] further develop the concepts of on-device anomaly detection using edge devices with a semi-supervised learning model for anomaly detection using Backpropagation Neural Networks (BP-NN). The use of BP-NN allows for the normal distribution of data in the learning model to change over time as new data is streamed from the edge devices to the centralized IDS. Unlike the binary classification model in supervised learning algorithms, this semi-supervised learning algorithm trains the model with normal, non-anomalous data in order to learn the distribution of the data samples. Semi-supervised learning models often suffer if the distribution of normal data changes over time, a phenomenon referred to as “concept drift.” The time-series sensor data in IIoT environments will commonly experience distribution shifts due to environmental changes (i.e., seasonal variations in usage or power consumption), which can cause the accuracy of a trained model to become quickly obsolete. Tsukada et al. propose a method to overcome this problem via BP-NN, using relatively low-powered edge devices to perform lightweight inference computations while feeding data back to a more powerful centralized host for the more computationally intensive BP-NN calculations that iteratively update the ongoing distribution shifts of normal data. After each training loop of BP-NN calculations is performed on the powerful centralized host, the results are returned to the relatively low-powered edge devices, which use the updated learning model to perform lightweight anomaly detection calculations on-device. This approach allows the edge devices to make rapid decisions on real-time traffic while leveraging a centralized IDS to iteratively account for concept drift over time, maintaining a high level of accuracy with streaming time-series data.

Xu et al. [263] propose that rule-based or signature-based detection strategies are increasingly unable to scale to the rapid growth of IoT/IIoT devices, and ML approaches are required at the network edge. Edge gateways serve to acquire telemetry data from the end nodes, perform preliminary processing and aggregation, and then forward a pre-trained subset of the collected data to a centralized server for further processing. With the number of IoT devices growing faster than the increase in network speeds, performing robust pre-processing of data at the network edge becomes increasingly necessary to avoid overloading the communication bandwidth of the network. Xu et al. propose that as the computing power at the network edge increases due to advances in microprocessor power, it becomes increasingly feasible to shift more computational efforts in ML closer to the data collection points at the network edge. The proposed framework for intelligent edge computing leverages the increased processing power on edge devices to use an ensemble learning model to combine multiple ML algorithms in order to achieve higher accuracy than can be obtained from a single algorithm.

4.6. Trusted Systems vs. Zero-Trust Architecture

The field of CPS encompasses a wide range of applications, and within this domain, there exists a notable division between the conventional ICS environments employed for the control of industrial processes (now commonly known as IIoT) and the more consumer-focused IoT industry. This schism can be broadly defined as trusted systems vs. zero-trust [275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295] and affects the strategies used for anomaly detection.

Due to the extended product lifecycles spanning years or even decades [17] and the historical design assumptions of operating within fully trusted and air-gapped isolated environments, traditional ICS exhibit slower adoption of new technologies compared to their more flexible counterparts in consumer-focused Internet of Things (IoT) devices.

The consumer-focused IoT industry, unlike its IIoT-based counterparts, emerged during an era where ubiquitous connectivity to an increasingly hostile Internet was presumed. This environment drove the adoption of standardized communication protocols centered around TCP/IP, incorporating integrated authentication and encryption functionalities [78]. These protocols were specifically designed for lightweight messaging protocols, taking into account the limitations of devices with constrained processing power, limited battery life, and potentially inconsistent network connectivity.

Due to their long product lifecycles, there are many IIoT-based systems in use today that were originally designed with the assumption of an entirely isolated and trusted environment, meaning that network security was not a design consideration [10]. Those systems have adapted poorly to industry pressures for connectivity and interoperability with corporate networks and the public Internet, with varying levels of success in adding security functionality to a system not designed with security in mind.

When it comes to security design in ICS and IIoT, the predominant focus has traditionally been on implementing a robust perimeter firewall to protect the CPS from other potentially hostile networks. However, once inside the trusted network, there is limited protection, resembling the “hard shell, soft center” security posture observed in enterprise networks in the past [275]. The historical assumptions of an entirely trusted environment have resulted in significant resistance to the active deployment of IPS in CPS, primarily due to the high costs associated with false positives. While passive IDS are gaining acceptance in CPS, the extreme heterogeneity [143] poses a challenge, leading to false positives that make it difficult for CPS operators to distinguish genuine hostile network activity.

The more contemporary consumer-focused IoT industry has embraced a zero-trust model of information security. Recognizing the potentially hostile network environment they operate in, they prioritize incorporating strong authentication and encryption protocols by default [18]. Unfortunately, the rapid pace of IoT advancements means that product lifecycles are notably short, resulting in devices quickly becoming obsolete. This leaves numerous devices “orphaned” without ongoing vendor support or upgrades to address emerging security threats. While some vendors have implemented trusted over-the-air update functionality to counter newly discovered threats, there are still many IoT devices that lack any form of update capability, rendering them permanently vulnerable to emerging threats.

The net effect is that the more modern IoT environments have integrated functionality for telemetry and health monitoring that is designed to feed into Security Information and Event Management (SIEM) systems for anomaly detection, while the longer-lived legacy ICS environments have been forced to bolt on this functionality.

Perez et al. [144] explore the ramifications of continued use of legacy protocols that were designed in the era of fully air-gapped CPS environments and how they can be securely operated in the age of ubiquitous connectivity. Many risks can be mitigated through network segmentation, as described by the Purdue model [233], but the continued use of legacy protocols that operate without encryption or replay resistance against false data injection attacks will leave CPS vulnerable to exploitation. Perez et al. propose a machine learning model that ingests network traffic flow data to and from the sensors and actuators in the CPS to build a model of normal behavior without needing to communicate directly with the legacy devices themselves or even understand the proprietary communication protocols. By using traffic flow patterns as the basis of the machine learning model, anomaly detection is achieved using a behavior-based strategy rather than the more common signature-based detection techniques used by traditional IDS/IPS.

Szymanski [276] proposes a novel method for protecting CPS by using Software Defined Networking (SDN) to create deterministic data flows between the components in a CPS, with any deviation classified as an anomaly. Network communications between nodes have traditionally been considered non-deterministic, as Ethernet-based communications using a shared communication medium may need to wait until the channel is free to send data, and complex networks such as the Internet use dynamic routing protocols that can change based on network conditions. Szymanski proposes the use of Quantum Safe encryption to allow the SDN to embed millions of isolated Deterministic Virtual Private Networks (DVPNs) to hide the underlying complexities of the network from the CPS endpoint nodes, making each path between nodes deterministic. This proposed method is most useful for distributed CPS environments that use untrusted networks such as the Internet, but has limited value for physically airgapped environments that make use of more traditional network security models such as default deny.

Ameer et al. [277] propose a combination of Zero Trust (ZT) architecture with the 3-layer PEI (Policy, Enforcement, Implementation) model for providing access control and authentication for users and devices in IoT/CPS environments. Similar to the manner in which anti-spam filters use scoring to determine if a message is legitimate or not, the proposed model assigns scores to endpoint devices that are based on formally provable mathematical models defined by the PEI. By enforcing continuous mutual authentication along with end-to-end encryption, ZT can ensure that any unauthorized access attempts are automatically denied and flagged as anomalies for further investigation. Anomalies are detected by the score of a particular data flow, which uses a combination of RBAC (Role Based Access Control), MAC (Mandatory Access Control), location, time, and any other characteristics defined in the PEI. This avoids the shortcomings of the more traditional DAC (Discretionary Access Control) security models and avoids privilege abuse or lateral compromise through the use of continuous mutual authentication.

Federici et al. [278] focus on secure remote access to IIoT environments by implementing a ZT architecture to avoid the perimeter-based security approach that is common in CPS, which assumes all traffic that has been passed through the border firewall can be considered trusted. As modern CPS environments make greater use of collaboration and data exchange with other systems, this perimeter-based security model becomes less useful in protecting against threats of lateral compromise. This work builds on the NIST reference architecture [279] for ZT by proposing a dual-layered access control architecture that leverages a Policy Engine (PE) to automate the creation of rules to allow or deny remote connection requests. This methodology leverages recent developments in Edge Computing, using the concept of an Industrial Gateway as a policy enforcement point that makes authentication decisions, coupled with a resource mediator that makes more detailed access control decisions for each read or write request in the data stream. By dividing authentication and authorization into separate layers, this proposed ZT architecture simplifies some of the complexity of more monolithic architectures, making it easier to secure the overall environment.

Alshomrani and Li [280] propose a novel method for performing continuous authentication of endpoint devices in IoT environments, with the intent of avoiding device impersonation attacks such as address spoofing and false command injection. The proposed model uses physical unclonable function-based device continuous authentication (PUFDCA), which leverages device fingerprinting based on immutable hardware characteristics combined with network path details and WiFi signal characteristics to add location definitions to the device signature. These PUFDCA fingerprints are then used for continuous mutual authentication, which mitigates replay and MiTM attacks. This authentication protocol uses SHA-3 hash functions, which are lightweight enough for the resource-constrained devices typically found in CPS environments while sufficiently strong to resist brute-force decryption attempts.

5. Discussion of Selected Challenges

The field of CPS is still quite young, with the term first defined in 2006 by the US-based National Science Foundation [13]. CPS has grown in leaps and bounds over the past few decades, largely mirroring advancements in microprocessor technology and the increased availability of high-speed wired and wireless networks. Due to the rapid rate of change, CPS has a number of outstanding challenges, a selection of which are described below.

A present-day CPS can be viewed as a fusion of IT and legacy OT environments, each with distinct priorities. Traditional IT networks adhere to the C-I-A (Confidentiality, Integrity, Availability) triad to define their security posture, prioritizing confidentiality, integrity, and availability in that order. Confidentiality ensures that data is only made available to authorized parties and is not available to anyone else. This is closely linked with the principle of least privilege, which provides the lowest amount of access (none, read-only, or read-write) in order to meet organizational requirements. Integrity means that the data has not been modified (intentionally or unintentionally) during transmission (i.e., using checksums) or in storage (i.e., using referential integrity checks). Availability means that the data is accessible when needed and is resilient against environmental issues such as computer hardware or network failure, power interruption, cyberattack, etc.

In contrast, OT networks have priorities that are the exact reverse of IT networks and follow an A-I-C (Availability, Integrity, and Confidentiality) approach [19,60]. Availability takes precedence, followed by integrity, with confidentiality considered the least significant pillar of system security. This distinction arises from CPS evolving from earlier ICS networks used in industrial control processes, where ensuring availability was paramount and integrity and confidentiality were rarely prioritized due to trusted and air-gapped isolated network environments. The emphasis on availability stems from the potential consequences of its loss, including economic impact and life safety concerns.

As OT networks merged with IT networks to form modern CPS, the divergent priorities have posed ongoing challenges that remain unresolved. IT networks place significant emphasis on authentication and authorization, which correspond to the confidentiality and integrity facets of the CIA triad. In contrast, OT networks traditionally focused so heavily on availability that authentication and authorization were assumed based on physical access to the trusted and isolated OT network.

However, this historical assumption of a fully trusted and isolated environment no longer holds true with the interconnection of IT and OT networks, making CPS vulnerable to network-based attacks such as DDoS, Man-in-the-Middle (MitM), replay attacks, impersonation, spoofing, and false data injection. Compounding the issue, OT networks often lack integration with anti-malware programs and detailed logging capabilities, hampering the detection of potentially hostile activity [81].

Efforts are underway to extend the Intrusion Detection System/Intrusion Prevention System (IDS/IPS) capabilities of IT networks into OT networks, but the absence of standardized protocols and interfaces for the physical components of CPS poses significant challenges for threat detection. IDS/IPS systems that have been extended into CPS environments struggle with high levels of false positives and false negatives due to the inherent complexity of CPS.

The most prominent challenge in secure CPS design and operation stems from the lack of standardized communication protocols and the proprietary nature of these systems [50]. Without a clear industry consensus on the system development life cycle of CPS, each system designer essentially builds a new CPS from scratch, often neglecting considerations for multivendor interoperability, secure patching mechanisms, or consistent system telemetry for health and security monitoring. While progress is being made through industry consortiums like O-PAS (Open Process Automation Standard) [296], achieving broad industry consensus remains elusive.

The high levels of heterogeneity found in CPS offer a plethora of research possibilities. However, the absence of a shared design framework [20] or standardized communication protocols poses challenges in effectively utilizing prior research and industry knowledge to advance the current state of the art. In simpler terms, the pervasive heterogeneity often necessitates “reinventing the wheel,” leading to duplicated efforts across academia and industry. This redundancy in work hampers progress within the field and slows down advancements.

The unique and bespoke characteristics of CPS products stem from their historical development based on ICS, which were originally designed to function within closed networks without the need for interoperability or communication with external networks. As the realms of OT and IT converged to form CPS, the open standards and communication protocols prevalent in IT networks have been swiftly embraced by OT networks [19]. However, considerable room for enhancement remains, particularly for OT networks that have unexpectedly found themselves interconnected with public and untrusted networks, including the Internet.

Recognizing that proprietary and heterogenous communication protocols are a barrier to effective anomaly detection as well as the effective development of industry best practices for CPS security postures, the O-PAS (Open Process Automation Standard) [260] is an industry consortium that is attempting to standardize the wide range of proprietary CPS into a set of open and collaborative standards around communication protocols and security postures, with the goal of increasing efficiency through multivendor interoperability. By achieving broad consensus within the open industry consortium, a particular CPS can be designed to meet the O-PAS standard, which allows for standardized methods of threat detection, health monitoring, and the use of standardized security methods. By designing a CPS to support open standards, significant benefits can be gained through the accelerated product development lifecycle thanks to the reliance on pre-existing standards, as well as ongoing efficiencies throughout the lifecycle of the CPS.

The use of IDS/IPS for anomaly detection is well established in IT networks but still suffers from excessive false positives in OT networks, which hinders their adoption in CPS. The use of machine learning models for anomaly detection shows promise but also suffers from excessive false positives due to the challenges of precisely defining abnormal behavior. Additionally, challenges in obtaining sufficiently representative data for the learning model can make the detection algorithm opaque and unpredictable to the human operators of the CPS, resulting in low confidence in the IDS alerts. Mahbooba et al. [145] propose a method of using Explainable Artificial Intelligence (XAI) to improve the accuracy of anomaly detection in IDS by bringing the human operator of the CPS into the loop by providing a human-readable explanation of why an IDS alert was generated, allowing the human operator to accept or reject the anomaly detection. The human-in-the-loop decisions are fed back into the learning model, leading to improved accuracy over time as well as increased confidence levels from the human operators of the CPS.

6. Conclusions and Future Works

The automated detection of anomalies and/or threats to CPS is still a field in a rapid state of development due to multiple confounding factors, the most significant of which are outlined below.

Many CPSs grew out of legacy SCADA and ICS networks, which assumed operation in an isolated and fully trusted network. The current reality of ubiquitous connectivity to increasingly hostile networks is only grudgingly accepted by many CPS network operators, who still see additional security requirements as an impediment to system availability.

Due to their extreme diversity, there is no one-size-fits-all anomaly detection model that can be generalized. Many researchers have proposed a generic or universal framework for anomaly detection in CPS, but as detection methods increase in generality to aid rapid test case development, they necessarily reduce in real-world fidelity, making them less representative of the live CPS. The reverse is also true: as anomaly detection accuracy for a real-world CPS increases, its generic applicability to other CPS environments decreases. The optimal solution seems to be a low-level generic framework with a modular architecture that allows plugins to be developed for the unique characteristics of a particular CPS.

CPS are typically not built with observability as a design feature. Gathering telemetry data is frequently an afterthought, if it is considered at all. This lack of observability makes it challenging to detect anomalies since a good baseline dataset is often unavailable. This is particularly challenging for AI researchers, as the quality of training data for ML is frequently lacking.

Signature-based detection (i.e., traditional antivirus) is less effective in CPS than in traditional enterprise networks due to the lack of standardization, i.e., heterogeneous sensors, different actuators, and various communication protocols.

Behavior-based detection methods (i.e., heuristic analysis, AI/ML) are less effective because CPS have highly variable (i.e., unpredictable) behavior (i.e., power grid fluctuations vary widely due to randomized events such as scheduled/unscheduled maintenance, weather events, etc.).

Threshold-based detection (i.e., power grid usage outside of “acceptable” thresholds). This is effectively a subset of behavior-based analysis, with the system operator deciding what the acceptable range of inputs/outputs should be. Unfortunately, accurately determining what those thresholds should be has proven elusive, especially because CPS tend to be dynamic, with regular changes throughout the system life cycle.

Future directions and opportunities for further research include embedding telemetry functionality at the design stage of CPS, which will provide higher quality baseline data, which is vital for AI-based models to accurately detect anomalous activity.

For low-power sensor devices with constrained CPU/battery/bandwidth resources, embedding resource-intensive intrusion detection functionality may be impractical. Consider moving IDS/IPS functionality up one level to the network layer (i.e., throttle access at the network perimeter to prevent DDoS attacks, use behavior-based traffic analysis on the upstream firewall, etc.).

There are recent enhancements in IDS/IPS (i.e., Cisco Talos cloud-based threat intelligence) designed for use in enterprise networks that can be adapted to CPS. These IDS/IPS leverage the use of network flow data gathered from the network edge, with resource-intensive data mining and intrusion detection performed outside of the resource-constrained CPS.

A particularly promising area of research is the development of a hybrid model for anomaly detection that includes threshold-based anomaly detection for simple threats such as brute force password attacks or temperature extremes, signature-based detection for known threats, and behavior-based detection for unknown threats. Behavior-based detection is the most difficult to perform with high accuracy, but there are promising options for using AI/ML to increase accuracy over time.