A Survey of Using Process Data and Features of Industrial Control Systems in Intrusion Detection

Protecting industrial control systems against cyber threats has become more pressing in the last decades. An increasing number of released vulnerabilities specifically targeting industrial systems makes protecting them exceedingly challenging. Incident detection is essential in protecting industrial systems, and this paper examines the state of the art in this area. The focus is on the research aspect, and the paper investigates "How has the research on the detection of cyber threats in industrial control systems evolved over the years?" This survey has explored research covering incident detection in industrial control systems from 1950 until today and reviewed a total of 750 papers, most of them published after 2003. After screening, 239 papers were relevant for a deeper exploration. The study reveals an increasing trend of published papers addressing detection capabilities in industrial control systems, with a rise in published papers from 2011. 86% of these research papers address standard features characteristic of industrial control systems, and 58% of the papers suggest using data from physical processes. However, most studies have a low technology readiness level; only 38 papers cover testing in a live test environment, and none cover testing in a system in operation. The overall findings show that, given the development of the threat landscape, and the urgency of good detection capabilities, there is a need for further research on detecting cyber threats using combined data sources in a live testing environment.