Current - Issue
Review Article
Beyond Anomaly Detection: A Systematic Literature Review of Semantic Validation, Consequence Prediction, and Adversarial Robustness in ICS Security Gateways
A Shivaleela Prasad1
Dr. Priyanka Dubey2
Dr. Surjeet Dalal3
1 2 3 Department of Amity School of Engineering and Technology, Amity University, Uttar Pradesh, India.
Published Online: May-August 2026
Pages: 501-513
Cite this article
↗ https://www.doi.org/10.59256/indjcst.20260502056References
1. H. Lin, A. Slagell, Z. T. Kalbarczyk, P. W. Sauer, and R. K. Iyer,“Runtime semantic security analysis to detect and mitigate control-related
attacks in power grids,” IEEE Transactions on Smart Grid, vol. 9,no. 1, pp. 163–178, 2018.
2. S. G. Abbas, M. O. Ozmen, A. Alsaheel, A. Khan, Z. B.Celik, and D. Xu, “SAIN: Improving ICS attack detection sensitivity via State-
Aware invariants,” in 33rd USENIX Security Symposium (USENIX Security 24). Philadelphia, PA: USENIX Association, Aug. 2024, pp.
6597–6613. [Online]. Available:https://www.usenix.org/conference/usenixsecurity24/presentation/abbas
3. G. Kabasele Ndonda and R. Sadre, “Exploiting the temporal behavior of state transitions for intrusion detection in ics/scada,” IEEE
Access,vol. 10, pp. 111 171–111 187, 2022.
4. X. Lin, Y. Yao, B. Hu, W. Yang, X. Zhou, G. Li, and W. Zhang, “A real-time anomaly detection method for industrial control systems
based on long-short period deterministic finite automaton,” IEEE Internet of Things Journal, vol. 12, no. 10, pp. 14 599–14 621, 2025.5. M. N. Nafees, N. Saxena, and P. Burnap, “On the efficacy of physics-informed context-based anomaly detection for power systems,” in
2022 IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids (SmartGridComm), 2022,
pp. 374–379.
6. W. Tang, J. Liu, Y. Zhou, and Z. Ding, “Causality-guided counterfactual debiasing for anomaly detection of cyber-physical systems,”
IEEE Transactions on Industrial Informatics, vol. 20, no. 3, pp. 4582–4593,2024.
7. A. Kumar, T. K. Das, and R. K. Pandey, “Sri: A simple rule induction method for improving resiliency of dnn based ids against adversarial
and zero-day attacks,” in Proceedings of the 10th ACM Cyber-Physical System Security Workshop, 2024, pp. 24–35.
8. M. Ike, K. Phan, K. Sadoski, R. Valme, and W. Lee, “Scaphy: Detecting Modern ICS Attacks by Correlating Behaviors in SCADA and
PHYsical ,” in 2023 IEEE Symposium on Security and Privacy (SP). Los Alamitos, CA, USA: IEEE Computer Society, May 2023, pp.
20–37. [Online]. Available: https://doi.ieeecomputersociety.org/10.1109/SP46215.2023.10179411
9. R. Kabore, A. Kouassi, R. N’goran, O. Asseu, Y. Kermarrec, and P. Lenca, “Review of Anomaly Detection Systems in Industrial Control
Systems Using Deep Feature Learning Approach,” Engineering, vol. 13, no. 1, pp. 30 – 44, Jan. 2021. [Online]. Available: https://imt-
atlantique.hal.science/hal-03174461
10. C. Fung, E. Zeng, and L. Bauer, “Attributions for ml-based ics anomaly detection: From theory to practice.” in NDSS, 2024.
11. G. Olaoye, “Deep learning-based anomaly detection for cyber threats in critical infrastructure systems,” Available at SSRN 5388831, 2025.
12. X. Zhou, Z. Cheng, C. Wang, S. Wang, C. Tao, Z. Zhou, X. Chen, J. Luo, D. Wang, and H. Zhou, “A dataset collected in real-world
industrial control systems for network attack detection,” Scientific Data, 2026.
13. C. Han and G. Gim, “Time-series-based anomaly detection in industrial control systems using generative adversarial networks,” Processes,
vol. 13, no. 9, p. 2885, 2025.
14. E. A. Boateng et al., “Anomaly detection for a water treatment system based on one-class neural network,” IEEE Access, vol. 10, pp. 115
179–115 191, 2022.
15. M. Abdelaty, R. Doriguzzi-Corin, and D. Siracusa, “DAICS: A Deep Learning Solution for Anomaly Detection in Industrial Control
Systems ,” IEEE Transactions on Emerging Topics in Computing,vol. 10, no. 02,pp.1117–1129,Apr.2022.
16. C. Tang, L. Xu, B. Yang, Y. Tang, and D. Zhao, “Gru-based interpretable multivariate time series anomaly detection in industrial control
system,” Computers & Security, vol. 127, p. 103094, 2023.
17. X. Yang, E. Howley, and M. Schukat, “Adt: Time series anomaly detection for cyber-physical systems via deep reinforcement learning,
“Computers & Security, vol. 141, p. 103825, 2024
18. S. S. Woo, D. Yoon, Y. Gim, and E. Park, “Raad: Reinforced adversarial anomaly detector,” in Proceedings of the 39th ACM/SIGAPP
Symposium on Applied Computing, 2024, pp. 883–891.
19. R. Khan, K. McLaughlin, B. Kang, D. Laverty, and S. Sezer, “A novel edge security gateway for end-to-end protection in industrial internet
of things,” in 2021 IEEE Power & Energy Society General Meeting (PESGM). IEEE, 2021, pp. 1–5.
20. J. Nivethan and M. Papa, “A linux-based firewall for the dnp3 protocol,” in 2016 IEEE symposium on technologies for homeland security
(HST).IEEE, 2016, pp. 1–5.
21. R. Amoah, S. Camtepe, and E. Foo, “Securing dnp3 broadcast communications in scada systems,” IEEE Transactions on Industrial
Informatics,vol. 12, no. 4, pp. 1474–1485, 2016.
22. G. Muriithi, B. Papari, A. Arsalan, L. Timilsina, A. Muriithi, E. Buraimoh, A. Khan, G. Ozkan, C. Edringto, and A. Papari, “Zero trust
architecture for electric transportation systems: A systematic survey and deep learning framework for replay attack detection,” IEEE Open
Journal of Vehicular Technology, 2025.
23. M. Al-Hawawreh and M. S. Hossain, “Digital twin driven secured edge-private cloud industrial internet of things (iiot) framework,” Journal
of Network and Computer Applications, vol. 226, p. 103888, 2024.
24. J. Bai, S. Hariri, and Y. Al-Nashif, “A network protection framework for dnp3 over tcp/ip protocol,” in 2014 IEEE/ACS 11th International
Conference on Computer Systems and Applications (AICCSA). IEEE, 2014, pp. 9–15.
25. “A network protection framework for dnp3 over tcp/ip protocol,” in 2014 IEEE/ACS 11th International Conference on Computer Systems
and Applications (AICCSA), 2014, pp. 9–1
26. I. N. Fovino, A. Carcano, T. De Lacheze Murel, A. Trombetta, and M. Masera, “Modbus/dnp3 state-based intrusion detection system,” in
2010 24th IEEE International Conference on Advanced Information Networking and Applications, 2010, pp. 729–736
27. J. E. Rubio, C. Alcaraz, R. Roman, and J. Lopez, “Current cyber-defense trends in industrial control systems,” Computers & Security, vol.
87, p.101561, 2019.
28. A. Sayghe, “Digital twin-driven intrusion detection for industrial scada A cyber-physical case study,” Sensors, vol. 25, no. 16, p. 4963,
2025.
29. M. Eckhart and A. Ekelhart, “Towards security-aware virtual environments for digital twins,” in Proceedings of the 4th ACM workshop
on cyber-physical system security, 2018, pp. 61–72.
30. D. Allison, P. Smith, and K. Mclaughlin, “Digital twin-enhanced incident response for cyber-physical systems,” in Proceedings of the 18th
International Conference on Availability, Reliability and Security, 2023, pp. 1–10.
31. M. Dietz and G. Pernul, “Unleashing the digital twin’s potential for ics security,” IEEE Security & Privacy, vol. 18, no. 4, pp. 20–27, 2020
32. A. Castellani, S. Schmitt, and S. Squartini, “Real-world anomaly detection by using digital twin systems and weakly supervised learning,”
IEEE Transactions on Industrial Informatics, vol. 17, no. 7, pp. 4733–4742, 2020.
33. F. Akbarian, E. Fitzgerald, and M. Kihl, “Intrusion detection in digital twins for industrial control systems,” in 2020 International
Conference on Software, Telecommunications and Computer Networks (SoftCOM).IEEE, 2020, pp. 1–6.
34. L. Jinghong, C. Chen, C. Junfei, M. Xinlei, M. Li, Y. Wang, Y. Zhang, and S. Yubo, “Condifffuzz: Dependency-aware consistency
checking for differential fuzzing of industrial control protocol implementations, “Electronics, vol. 15, no. 6, p. 1324, 2026.
35. D. P. Parikh, “Adaptive reinforcement learning-based fuzzer for 5g rrc security evaluation,” Ph.D. dissertation, Virginia Tech, 2025.
36. T. Fen, D. Li, and Z. Yuan, “An industrial network protocol fuzzing framework based on deep adversarial networks,” in 2023 4th
International Conference on Computer Engineering and Application (ICCEA).IEEE, 2023, pp. 590–596.
37. Y. Maklad, F. Wael, A. Hamdi, W. Elsersy, and K. Shaban, “Multifuzz: A dense retrieval-based multi-agent system for network protocol
fuzzing,” in 2025 IEEE/ACS 22nd International Conference on Computer Systems and Applications (AICCSA). IEEE, 2025, pp. 1–8.38. D. Shu, N. O. Leslie, C. A. Kamhoua, and C. S. Tucker, “Generative adversarial attacks against intrusion detection systems using active
learning,” in Proceedings of the 2nd ACM workshop on wireless security and machine learning, 2020, pp. 1–6.
39. Y. Hsu, G. Shu, and D. Lee, “A model-based approach to security flaw detection of network protocol implementations,” in 2008 IEEE
International Conference on Network Protocols. IEEE, 2008, pp. 114–123.
40. M. Olivieri et al., “Janus: A trusted execution environment approach for attack detection in industrial robot controllers,” IEEE, 2024.
41. A. Carcano, A. Coletta, M. Guglielmi, M. Masera, I. N. Fovino, and A. Trombetta, “A multidimensional critical state analysis for detecting
intrusions in scada systems,” IEEE Transactions on Industrial Informat-ics, vol. 7, no. 2, pp. 179–186, 2011.
42. J. Goh, S. Adepu, K. N. Junejo, and A. Mathur, “A dataset to support research in the design of secure water treatment systems,” in
international conference on critical information infrastructures security. Springer,2016, pp. 88–99.
43. D. Pliatsios, P. Sarigiannidis, T. Lagkas, and A. G. Sarigiannidis, “A survey on scada systems: secure protocols, incidents, threats and
tactics,” IEEE Communications Surveys & Tutorials, vol. 22, no. 3, pp. 1942–1976, 2020.
44. P. Schneider, “Anomaly detection for cyber-physical systems,” Ph.D. dissertation, Technische Universit¨at M¨unchen, 2021
attacks in power grids,” IEEE Transactions on Smart Grid, vol. 9,no. 1, pp. 163–178, 2018.
2. S. G. Abbas, M. O. Ozmen, A. Alsaheel, A. Khan, Z. B.Celik, and D. Xu, “SAIN: Improving ICS attack detection sensitivity via State-
Aware invariants,” in 33rd USENIX Security Symposium (USENIX Security 24). Philadelphia, PA: USENIX Association, Aug. 2024, pp.
6597–6613. [Online]. Available:https://www.usenix.org/conference/usenixsecurity24/presentation/abbas
3. G. Kabasele Ndonda and R. Sadre, “Exploiting the temporal behavior of state transitions for intrusion detection in ics/scada,” IEEE
Access,vol. 10, pp. 111 171–111 187, 2022.
4. X. Lin, Y. Yao, B. Hu, W. Yang, X. Zhou, G. Li, and W. Zhang, “A real-time anomaly detection method for industrial control systems
based on long-short period deterministic finite automaton,” IEEE Internet of Things Journal, vol. 12, no. 10, pp. 14 599–14 621, 2025.5. M. N. Nafees, N. Saxena, and P. Burnap, “On the efficacy of physics-informed context-based anomaly detection for power systems,” in
2022 IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids (SmartGridComm), 2022,
pp. 374–379.
6. W. Tang, J. Liu, Y. Zhou, and Z. Ding, “Causality-guided counterfactual debiasing for anomaly detection of cyber-physical systems,”
IEEE Transactions on Industrial Informatics, vol. 20, no. 3, pp. 4582–4593,2024.
7. A. Kumar, T. K. Das, and R. K. Pandey, “Sri: A simple rule induction method for improving resiliency of dnn based ids against adversarial
and zero-day attacks,” in Proceedings of the 10th ACM Cyber-Physical System Security Workshop, 2024, pp. 24–35.
8. M. Ike, K. Phan, K. Sadoski, R. Valme, and W. Lee, “Scaphy: Detecting Modern ICS Attacks by Correlating Behaviors in SCADA and
PHYsical ,” in 2023 IEEE Symposium on Security and Privacy (SP). Los Alamitos, CA, USA: IEEE Computer Society, May 2023, pp.
20–37. [Online]. Available: https://doi.ieeecomputersociety.org/10.1109/SP46215.2023.10179411
9. R. Kabore, A. Kouassi, R. N’goran, O. Asseu, Y. Kermarrec, and P. Lenca, “Review of Anomaly Detection Systems in Industrial Control
Systems Using Deep Feature Learning Approach,” Engineering, vol. 13, no. 1, pp. 30 – 44, Jan. 2021. [Online]. Available: https://imt-
atlantique.hal.science/hal-03174461
10. C. Fung, E. Zeng, and L. Bauer, “Attributions for ml-based ics anomaly detection: From theory to practice.” in NDSS, 2024.
11. G. Olaoye, “Deep learning-based anomaly detection for cyber threats in critical infrastructure systems,” Available at SSRN 5388831, 2025.
12. X. Zhou, Z. Cheng, C. Wang, S. Wang, C. Tao, Z. Zhou, X. Chen, J. Luo, D. Wang, and H. Zhou, “A dataset collected in real-world
industrial control systems for network attack detection,” Scientific Data, 2026.
13. C. Han and G. Gim, “Time-series-based anomaly detection in industrial control systems using generative adversarial networks,” Processes,
vol. 13, no. 9, p. 2885, 2025.
14. E. A. Boateng et al., “Anomaly detection for a water treatment system based on one-class neural network,” IEEE Access, vol. 10, pp. 115
179–115 191, 2022.
15. M. Abdelaty, R. Doriguzzi-Corin, and D. Siracusa, “DAICS: A Deep Learning Solution for Anomaly Detection in Industrial Control
Systems ,” IEEE Transactions on Emerging Topics in Computing,vol. 10, no. 02,pp.1117–1129,Apr.2022.
16. C. Tang, L. Xu, B. Yang, Y. Tang, and D. Zhao, “Gru-based interpretable multivariate time series anomaly detection in industrial control
system,” Computers & Security, vol. 127, p. 103094, 2023.
17. X. Yang, E. Howley, and M. Schukat, “Adt: Time series anomaly detection for cyber-physical systems via deep reinforcement learning,
“Computers & Security, vol. 141, p. 103825, 2024
18. S. S. Woo, D. Yoon, Y. Gim, and E. Park, “Raad: Reinforced adversarial anomaly detector,” in Proceedings of the 39th ACM/SIGAPP
Symposium on Applied Computing, 2024, pp. 883–891.
19. R. Khan, K. McLaughlin, B. Kang, D. Laverty, and S. Sezer, “A novel edge security gateway for end-to-end protection in industrial internet
of things,” in 2021 IEEE Power & Energy Society General Meeting (PESGM). IEEE, 2021, pp. 1–5.
20. J. Nivethan and M. Papa, “A linux-based firewall for the dnp3 protocol,” in 2016 IEEE symposium on technologies for homeland security
(HST).IEEE, 2016, pp. 1–5.
21. R. Amoah, S. Camtepe, and E. Foo, “Securing dnp3 broadcast communications in scada systems,” IEEE Transactions on Industrial
Informatics,vol. 12, no. 4, pp. 1474–1485, 2016.
22. G. Muriithi, B. Papari, A. Arsalan, L. Timilsina, A. Muriithi, E. Buraimoh, A. Khan, G. Ozkan, C. Edringto, and A. Papari, “Zero trust
architecture for electric transportation systems: A systematic survey and deep learning framework for replay attack detection,” IEEE Open
Journal of Vehicular Technology, 2025.
23. M. Al-Hawawreh and M. S. Hossain, “Digital twin driven secured edge-private cloud industrial internet of things (iiot) framework,” Journal
of Network and Computer Applications, vol. 226, p. 103888, 2024.
24. J. Bai, S. Hariri, and Y. Al-Nashif, “A network protection framework for dnp3 over tcp/ip protocol,” in 2014 IEEE/ACS 11th International
Conference on Computer Systems and Applications (AICCSA). IEEE, 2014, pp. 9–15.
25. “A network protection framework for dnp3 over tcp/ip protocol,” in 2014 IEEE/ACS 11th International Conference on Computer Systems
and Applications (AICCSA), 2014, pp. 9–1
26. I. N. Fovino, A. Carcano, T. De Lacheze Murel, A. Trombetta, and M. Masera, “Modbus/dnp3 state-based intrusion detection system,” in
2010 24th IEEE International Conference on Advanced Information Networking and Applications, 2010, pp. 729–736
27. J. E. Rubio, C. Alcaraz, R. Roman, and J. Lopez, “Current cyber-defense trends in industrial control systems,” Computers & Security, vol.
87, p.101561, 2019.
28. A. Sayghe, “Digital twin-driven intrusion detection for industrial scada A cyber-physical case study,” Sensors, vol. 25, no. 16, p. 4963,
2025.
29. M. Eckhart and A. Ekelhart, “Towards security-aware virtual environments for digital twins,” in Proceedings of the 4th ACM workshop
on cyber-physical system security, 2018, pp. 61–72.
30. D. Allison, P. Smith, and K. Mclaughlin, “Digital twin-enhanced incident response for cyber-physical systems,” in Proceedings of the 18th
International Conference on Availability, Reliability and Security, 2023, pp. 1–10.
31. M. Dietz and G. Pernul, “Unleashing the digital twin’s potential for ics security,” IEEE Security & Privacy, vol. 18, no. 4, pp. 20–27, 2020
32. A. Castellani, S. Schmitt, and S. Squartini, “Real-world anomaly detection by using digital twin systems and weakly supervised learning,”
IEEE Transactions on Industrial Informatics, vol. 17, no. 7, pp. 4733–4742, 2020.
33. F. Akbarian, E. Fitzgerald, and M. Kihl, “Intrusion detection in digital twins for industrial control systems,” in 2020 International
Conference on Software, Telecommunications and Computer Networks (SoftCOM).IEEE, 2020, pp. 1–6.
34. L. Jinghong, C. Chen, C. Junfei, M. Xinlei, M. Li, Y. Wang, Y. Zhang, and S. Yubo, “Condifffuzz: Dependency-aware consistency
checking for differential fuzzing of industrial control protocol implementations, “Electronics, vol. 15, no. 6, p. 1324, 2026.
35. D. P. Parikh, “Adaptive reinforcement learning-based fuzzer for 5g rrc security evaluation,” Ph.D. dissertation, Virginia Tech, 2025.
36. T. Fen, D. Li, and Z. Yuan, “An industrial network protocol fuzzing framework based on deep adversarial networks,” in 2023 4th
International Conference on Computer Engineering and Application (ICCEA).IEEE, 2023, pp. 590–596.
37. Y. Maklad, F. Wael, A. Hamdi, W. Elsersy, and K. Shaban, “Multifuzz: A dense retrieval-based multi-agent system for network protocol
fuzzing,” in 2025 IEEE/ACS 22nd International Conference on Computer Systems and Applications (AICCSA). IEEE, 2025, pp. 1–8.38. D. Shu, N. O. Leslie, C. A. Kamhoua, and C. S. Tucker, “Generative adversarial attacks against intrusion detection systems using active
learning,” in Proceedings of the 2nd ACM workshop on wireless security and machine learning, 2020, pp. 1–6.
39. Y. Hsu, G. Shu, and D. Lee, “A model-based approach to security flaw detection of network protocol implementations,” in 2008 IEEE
International Conference on Network Protocols. IEEE, 2008, pp. 114–123.
40. M. Olivieri et al., “Janus: A trusted execution environment approach for attack detection in industrial robot controllers,” IEEE, 2024.
41. A. Carcano, A. Coletta, M. Guglielmi, M. Masera, I. N. Fovino, and A. Trombetta, “A multidimensional critical state analysis for detecting
intrusions in scada systems,” IEEE Transactions on Industrial Informat-ics, vol. 7, no. 2, pp. 179–186, 2011.
42. J. Goh, S. Adepu, K. N. Junejo, and A. Mathur, “A dataset to support research in the design of secure water treatment systems,” in
international conference on critical information infrastructures security. Springer,2016, pp. 88–99.
43. D. Pliatsios, P. Sarigiannidis, T. Lagkas, and A. G. Sarigiannidis, “A survey on scada systems: secure protocols, incidents, threats and
tactics,” IEEE Communications Surveys & Tutorials, vol. 22, no. 3, pp. 1942–1976, 2020.
44. P. Schneider, “Anomaly detection for cyber-physical systems,” Ph.D. dissertation, Technische Universit¨at M¨unchen, 2021
Related Articles
2026
Artificial Intelligence in Learning and Teaching
2026
Admin Assist: An AI – Driven Configuration and Orchestration for Enterprise Application
2026
Enhancing Blood Group Identification using pigeon inspired optimization: An Innovative Approach
2026
Eco-Genius: Power Up Smart, Power Down Waste
2026
Crowd-Sourced Disaster Response and Rescue Assistant
2026