1. Introduction
Network-based intrusion detection systems (NIDS) are essential for providing security to industrial and robotic systems in today’s cyber threats. An NIDS is a specific type of intrusion detection system (IDS) focused on monitoring and analyzing network traffic for suspicious activity, potentially detecting unauthorized access or malicious behaviors within a network. On the other hand, IDS is a security solution designed to detect malicious activities in a system and can be applied to multiple areas of a system, including web applications, packet filtering, enterprise applications, and database systems. In an NIDS, malicious activity is identified by monitoring the various interconnections between computers, with NIDS typically deployed on routers or switches within the network. The main objective of NIDS is to detect and flag suspicious or harmful activity and report this malicious information to the network administrator. The need for reliable intrusion detection systems (IDS) is increasing as industries adopt digital technologies to stay competitive. Intrusion detection technologies have evolved from simple signature-based methods to complex anomaly detection systems that rely on machine learning and artificial intelligence (AI). Although traditional techniques are effective against known threats, they have struggled to keep pace with the dynamic nature of modern cyberattacks, such as zero-day exploits and advanced persistent threats, which are increasingly common in industrial settings. Machine learning has been a powerful tool in advancing NIDS, enabling them to learn from past data and identify anomalies without explicit programming for every possible threat. This capability is vital in industrial settings, where disruptions can lead to substantial operational delays or safety risks [1]. Studies have shown that incorporating machine learning methods can significantly improve detection accuracy and reduce the occurrence of false positives, which is a common issue in traditional NIDS implementation [2]. Nevertheless, implementing these systems in industrial and robotic settings presents distinct challenges. These systems must possess not only a high level of accuracy but also the ability to operate in real-time, frequently under strict limitations on available resources.
Integrating NIDS in industrial and robotic systems faces significant challenges, including securing vulnerable industrial control system (ICS) protocols, addressing cyber–physical systems (CPS) vulnerabilities, and countering sophisticated advanced persistent threats (APTs). Real-time monitoring limitations, insider threats, and legacy system complexities add to the security demands. Supply chain integrity, regulatory compliance, new and evolving threats, and resource constraints further complicate implementation. Thus, adaptive lightweight NIDS approaches are essential to handle the evolving cyber threat landscape in these critical infrastructures.
The absence of balanced and specialized datasets designed specifically for ICS and robotic systems impedes efficient NIDS adoption. Public datasets, such as UNSW-NB15 and ADFA IDS, typically lack industrial-specific network traffic patterns, protocols, and device interactions [3,4]. The absence of uncommon, crucial attack types causes class imbalances, which leads to more false positives and negatives in detection. Models trained on imbalanced data frequently misinterpret typical operations for abnormalities, resulting in operational interruptions and costly troubleshooting, with large organizations potentially losing an estimate of about $10.3 million yearly and medium-sized companies roughly $11,000 yearly [5].
Therefore, in this survey paper, we aim to answer the following research questions: (1) What strategies can help NIDS detect threats quickly with a low false alarm rate for real-time use in industrial and robotic applications? (2) How can the lack of balanced and specialized datasets for industrial and robotic systems be addressed in NIDS research? (3) How can NIDS integrate well with emerging technologies for industrial and robotic use? To address these questions holistically, we divide the rest of this paper into several sections. Section 2 summarizes the research strategy used to organize this survey paper. Section 3 discusses related work on NIDS. Section 4 gives a brief overview of various existing approaches used to detect network intrusions in industrial and robotic systems, such as signature-based, anomaly-based, machine-learning-based, and deep-learning techniques. Section 5 discusses the integration challenges of NIDS within industrial and robotic systems, emphasizing cybersecurity issues due to increased connectivity and complexity. Section 6 discusses the challenges of existing datasets for industrial and robotic systems and raises suggestions to address these challenges. Section 7 discusses how to integrate NIDS with emerging technologies such as federated learning, quantum computing, blockchain, digital twins, and large language models (LLM). Lastly, Section 8 concludes the survey. The list of abbreviations used in this paper can be found in the Abbreviations section.
2. Research Strategy
We mainly focus on recent developments in IDS and NIDS using research papers published between 2022 and 2024. We specifically focus on industrial and robotic systems since no previous survey papers filled this research gap. We searched for articles on famous online databases, including Google Scholar, IEEE Xplore, and ResearchGate. Articles published in high-ranking journals and conferences are selected for inclusion. On the other hand, we minimized the inclusion of preprints. We excluded papers not written in good English, papers with low-impact factors, and papers from unreputable journals. We use various combinations of keywords to search for articles on the aforementioned online repositories. Some of these keywords include “Network Intrusion Detection Systems”, “Network Intrusion in Robotic Systems”, “Network Intrusion in Industrial Systems”, “Intrusion Detection System”, and “Machine Learning-Based Intrusion Detection”.
3. Related Work
While several research papers exist on NIDS and intrusion detection systems (IDS), none directly addresses the unique requirements of industrial and robotic environments. Some of the relevant survey papers are discussed below.
Reference [6] provides a comprehensive and systematic review of network-based intrusion detection systems (IDS). Reference [7] is a review paper that focuses strictly on machine learning-based IDS. It discusses critical challenges and provides future research. Reference directions [8] provides an overview of NIDS types, techniques, and advancements. Although these works cover IDS extensively, they lack specific discussion on the demands and challenges associated with industrial and robotic systems. Similarly, Ref. [9] is a systematic review paper that discusses techniques to improve IDS efficiency, such as reducing false positives, increasing detection accuracy, and enhancing system performance. Additionally, Ref. [10] reviews artificial intelligence (AI)-based techniques for network-based intrusion detection systems. Ref. [11] explores learning-based techniques, particularly machine learning, applied to NIDS. Ref. [12] is a systematic literature review focusing on NIDS. It reviews various models used for network intrusion detection systems. Ref. [13] is a comparative study research paper focusing on intrusion detection in IoT networks. It compares the effectiveness of neural network-based intrusion detection with traditional signature-based detection, specifically within IoT network environments. Ref. [14] is another survey paper focusing on NIDS for IoT and non-IoT environments. However, it overlooks IDS and NIDS for robotic and industrial systems. Ref. [15] is yet another survey paper focusing on NIDS with combined deep-learning models. However, it does not consider the challenges unique to industrial and robotic applications. Finally, Ref. [16] is a survey paper focusing on IDS using machine learning and deep learning. However, this paper does not place a strong emphasis on industrial and robotic systems.
Therefore, there is a research gap on NIDS applications in industrial and robotic systems. Moreover, as cyberattacks are getting advanced, there is a need for a survey paper that focuses on how recent emerging technologies can be leveraged in NIDS to improve security in robotic and industrial settings. Thus, this presents a comprehensive overview of the state-of-the-art NIDS for industrial and robotic systems. Table 1 highlights the gaps in existing survey papers by comparing existing survey papers with the unique contributions and focus areas addressed in this study.
4. Methodologies of Intrusion Detection
A NIDS operates in several stages to ensure comprehensive threat detection in industrial and robotic systems. As shown in Figure 1, the architecture of an NIDS consists of multiple interconnected components, from network traffic monitoring and data preprocessing to detection processing and response. Each phase plays a crucial role in identifying and mitigating the potential threats. The architecture begins with network traffic monitoring, where data flowing between devices such as robots, computers, or sensors is constantly observed. The goal is to gather data on what is happening within the network. These data are then cleaned and organized in the data preprocessing phase, where irrelevant information is filtered out, making the data ready for further analysis. In feature extraction, key characteristics are extracted from the data to identify potential signs of malicious behavior or anomalies. This is followed by detection processing, in which algorithms analyze the extracted features to detect suspicious activities. Once a potential threat is identified, decision-making takes place to classify detection as either a legitimate threat or a false alarm. If confirmed, the system triggers a response that may involve alerting human operators, blocking certain actions, or taking measures to contain threats. This process ensures the security and smooth operation of industrial and robotic systems in real-time.
The rest of this section will discuss specific methodologies employed by IDS, including signature-based, anomaly-based, machine learning-based, and hybrid systems.
4.1. Signature-Based
An IDS uses databases of known threat signatures to efficiently detect and prevent malicious activities. Signature-based intrusion detection has been widely applied in robotics and ICS. Kaouk et al. [17] discussed the significance of intrusion detection systems in defending these systems from cyberattacks, emphasizing the importance of IDS in protecting systems from cyberattacks. However, a major drawback of these systems is the requirement for frequent updates to the signature database to address new threats. In addition, Ring et al. [18] highlighted the challenges of maintaining up-to-date signature datasets to ensure robust defense against constantly evolving cybersecurity threats. Another aspect shown in [18] is how to make signature-based IDS work better in static environments with stable attack vectors. The industrial and robotics sectors continue to benefit from signature-based intrusion detection, offering a straightforward and effective way to identify malicious activities.
4.2. Anomaly-Based
Anomaly-based IDS excels in identifying zero-day vulnerabilities and complex cyberattacks that do not match known signatures, as they detect anomalies that differ from typical operational activities. Numerous applications of anomaly-based intrusion detection exist in industrial and robotic-related environments. Gillen et al. [19] emphasized the importance of customized security measures in these settings, specifically focusing on the impact of various configurations on safety. Two reviews, one by Kabore et al. [20] and the other by Rosa et al. [21], discussed how anomaly detection in ICS makes use of deep learning techniques such as convolutional neural networks (CNN) and long short-term memory (LSTM). Ganeshan et al. [22] and Alsoufi et al. [23] offered thorough assessments of IDS that depend on abnormalities. Ganeshan et al. categorized IDS into two primary classifications: characteristic-based and methodological. Characteristic-based classification focuses on the location and operation of an IDS within a system, encompassing host-based, network-based, stack-based, signature-based, and anomaly-based approaches. On the other hand, methodological classification emphasizes the techniques employed by the IDS, including tree-based, Adaboost algorithm-based, probabilistic-based, support vector machine (SVM)-based, neural network-based, and unsupervised classification-based methods. Tree-based methods use decision trees to differentiate normal and abnormal network packets. AdaBoost combines multiple weak classifiers to create a more accurate classifier. Probabilistic-based methods employ probabilistic models to handle noisy data and determine optimal solutions. The SVM is a supervised learning algorithm that identifies patterns by finding the optimal hyperplane to separate different classes. Neural networks can analyze network traffic in real-time and learn complex patterns. Unsupervised classification techniques handle large datasets without prior labeling, making them useful when the labeled data are limited or unavailable. The authors emphasized the need for improved detection algorithms to manage unidentified attacks within an IDS effectively. These enhancements can optimize performance and address specific cybersecurity challenges. Alsoufi et al. [23] conducted a detailed analysis of deep learning methods for Internet of Things (IoT) anomaly detection. IDS are increasingly employing deep learning owing to their superior data processing and accuracy. They also emphasized IoT security issues and recommended prioritizing the development of efficient deep-learning models for IoT devices with limited resources.
4.3. Machine Learning-Based
A machine learning-based IDS uses algorithms to learn from data and identify potentially harmful patterns. They can adapt to new cyber threats over time. Numerous studies have examined the application of machine learning for detecting intrusions in robots and industrial systems. Flaus and Georgakis [24] and Haripriya and Jabbar [25] explored the potential benefits of machine learning in this context. In particular, Hapripriya and Jabbar discussed how it could help achieve a low false alarm rate and a high detection rate. Unfortunately, Chattopadhyay et al. [26] pointed out problems such as the need for multiple detection methods and how challenging it is to define and use machine-learning techniques. Mishra and Mishra [27] provided more specific information about the challenges in intrusion detection and how to implement them in ICS. They include handling large network traffic volumes, uneven data distribution, continuous adaptation, distinguishing between faults and attacks, handling encrypted data, and ensuring the performance of IDS in large and complex systems. The authors also highlight the need for machine learning and other collaborative IDS solutions to address these challenges.
Kaouk et al. [17] presented a detailed exploration of IDS for ICS, emphasizing the role of machine learning in advancing IDS for ICS and highlighting associated challenges. They discussed the role of machine learning in advancing IDS for ICS, the challenges associated with machine learning-based IDS, such as high false alarm rates, and the difficulty in distinguishing between faults and attacks. They also outlined future research directions, including methods to reduce false positives, improve accuracy, and adapt IDS to new technologies such as the Industrial Internet of Things (IIoT) and advanced encryption methods.
4.4. Deep Learning-Based
Deep learning-based IDS uses advanced neural networks capable of analyzing extensive data to detect complex and subtle threat patterns. This approach is particularly efficient for applications requiring large amounts of data, such as industrial and robotic systems, in which traditional detection approaches may be insufficient. Various studies have investigated the application of deep learning in IDS for industrial and robotic systems. Alani et al. [28] introduced DeepIIoT, an IDS that uses deep learning techniques to identify intrusions. Furthermore, DeepIIoT explains its decision-making process using Shapley additive explanation (SHAP) values. The system uses a multi-layer perceptron (MLP) classifier trained on the WUSTL-IIOT-2021 dataset. This dataset encompasses a range of cyberattacks, including command injection, Denial of Service (DoS), reconnaissance, and backdoor assaults. The model trained on the dataset provided enhanced IIoT security against cyberattacks. Notwithstanding, the increased connectivity and data interchange of IIoT devices make them vulnerable to assaults, especially in critical infrastructure such as power grids and water treatment facilities. The model attained a precision of 99 percent, exhibiting minimal rates of false-positive and false-negative outcomes. Using SHAP values allows the model to provide comprehensive insights into the primary factors that impact classification decisions, thereby improving the transparency and reliability of the system. In future studies, the authors aim to investigate how standardizing the feature set affects the model’s accuracy. The goal was to analyze the connection between IDS classification parameters and feature extraction methods to enhance the performance.
Mohamed et al. [29] conducted an extensive analysis of deep learning techniques employed in cyber intrusion detection. They discussed ten deep learning models employed for intrusion detection and applicable in robotics: deep neural networks (DNN), feed-forward deep neural networks (FFDNN), recurrent neural networks (RNN), convolutional neural networks (CNN), restricted Boltzmann machines (RBM), deep belief networks (DBN), deep auto-encoders, deep migration learning, self-taught learning, and replicator neural networks. They classified these deep learning models into two categories: deep discriminative and generative/unsupervised. Their research report categorized 35 well-recognized cyber datasets into seven distinct groups: network traffic-based, electrical network-based, inter-traffic-based, virtual private network-based, Android app-based, IoT traffic-based, and Internet-connected device-based datasets. The authors assessed the performance of these deep learning models using two actual traffic datasets: CSE-CIC-IDS2018 and BoT-IoT. They highlighted that deep learning models generally surpass conventional machine learning techniques, such as Naive Bayes and SVM, in terms of accuracy, detection rate, and false alarm rate. Their results showed that deep learning techniques, specifically CNN and RNN, demonstrated exceptional performance in managing data with many dimensions and capturing time-related patterns in network traffic. These results resulted in improved accuracy and reduced false positive rates. However, the research acknowledged notable obstacles, such as the requirement for extensive labeled datasets and substantial processing resources, which restrict the ability to use the technology in real-time situations and for resource-limited applications such as IoT devices. Their study determined that future investigations should prioritize the development of lightweight and efficient models to tackle these issues and improve the practical implementation of deep learning-based IDS in various domains, including ICS and IoT networks. Abdel-Wahab et al. [30] and Lánský et al. [31] conducted comparative and systematic evaluations of machine learning and deep learning models. Abdel-Wahab et al. [30] used the KDD-99 dataset to test different machine learning and deep learning models to identify intrusions based on unusual behavior. The tested models were SVM, K-Nearest Neighbor (KNN), Gaussian Naive Bayes (GNB), Decision Tree (DT), Random Forest (RF), and Gradient Boosting Classifier (GBC). The authors presented, compared, and evaluated the performance of these models. Multiple models have distinct advantages and disadvantages, and no single model is superior. Nevertheless, the RF model demonstrated encouraging outcomes and warrants further evaluation in actual IDS settings. Additionally, they established the foundation for future research in this emerging field, particularly in online learning, machine learning, deep learning, and IDS. The goal was to improve the current datasets, as those available were outdated and unsuitable for modern network systems. They planned to create dedicated datasets for mobile IDS or develop architectures for machine learning and deep learning-based IDS exclusively for mobile networks. On the other hand, Ref. [31] offers a detailed overview of IDS methods using deep neural networks to combat intrusions and malicious activities. The authors initially classified deep IDS strategies based on the deep-learning techniques employed. They then explained how each scheme attempted to use deep learning approaches to detect various intrusions. Researchers have investigated the application of several deep-learning techniques in intrusion detection to identify and categorize different types of attacks. Furthermore, they emphasized the failure to address cybersecurity issues in cyber–physical systems across different domains. They highlighted the necessity of a performance analysis using actual network traffic rather than relying solely on benchmark datasets. Moreover, they highlighted the importance of investigating how different CNN structures affect the model performance. Finally, they emphasized the need for further evaluation and fine-tuning of the proposed schemes.
Aldweesh et al. [32] thoroughly examined deep-learning methods for identifying anomalies, showing enormous promise for industrial and robotic systems. This study sorts current methods into groups and highlights how well they work for managing data with many dimensions. It also discusses issues such as adversary resilience and real-time computation, which are critical in industrial settings where disruptions in operations can have severe consequences. The authors further highlighted the need to use simple models and integrate them with existing methods to enhance cybersecurity in industrial and robotic environments. This is especially significant because the ability to detect anomalies is essential for ensuring operational integrity and security. They used deep learning models such as CNNs, RNNs, autoencoders, Generative Adversarial Networks (GANs), DBNs, and DRL to monitor sensor data, identify problems with how these vital systems are working, and protect them from cyber threats. An important issue emphasized in this study is the vulnerability of deep learning models to adversarial attacks. Ensuring the robustness of anomaly-detection systems against attacks is crucial in industrial and robotic systems, where safety and reliability are of utmost importance. This difficulty is particularly relevant to critical infrastructure because successful attacks can have disastrous consequences. In addition, they deliberated on the importance of real-time anomaly detection, which is an integral part of industrial and robotic systems that require prompt reactions to anomalies. They suggested the development of easy-to-understand deep learning models that integrate well with conventional machine learning methods commonly used in industrial and robotic systems. This will make the deployment more practical and efficient by integrating deep learning-based IDS into industrial and robotic systems, leveraging existing security protocols and infrastructure.
4.5. Hybrid Systems
Hybrid IDS combines various detection methods and intrusion detection techniques to enhance security measures. This integration improves the ability to identify and lowers the chance of false positives, making it useful in industrial settings. Numerous studies have examined the application of hybrid-based IDS in robots and industrial systems. Many older IDS rely on anomaly and signature-based methods, which make it difficult to detect new or unknown threats and require manual updates to signature databases, thereby decreasing their effectiveness. Khacha et al. [33] created a new type of IDS that combines CNN and LSTM networks to better identify and classify cyberattacks in IIoT settings. This hybrid model combines the pattern recognition abilities of the CNN with the temporal analysis capabilities of the LSTM. They tested the proposed solution using the Edge-IIoTset dataset, which contains authentic network traffic data from various IoT and IIoT devices, including multiple forms of cyberattacks. The model performed well in both binary and multi-class classification tasks, with a high level of accuracy and a low false positive rate, suggesting that it can quickly find a wide range of attack types. The hybrid nature of the experiments necessitates a significant amount of computer resources. In addition, the system did not undergo real-world testing, which prompted concerns about overfitting owing to its high level of accuracy. The researchers outlined real-world testing, exploration of deep learning methods, and enhancement of model efficiency as their future research focuses. Kaouk et al. [17] discussed the significance of intrusion detection in safeguarding industrial environments but approached the topic differently. They thoroughly examined an IDS specifically developed for ICS. They emphasized the distinct difficulties these systems encounter owing to their tight integration with physical processes and growing interconnectivity with external networks. Their research classified different IDS methods, such as signature-based, anomaly-based, and specification-based methods. They tested each group to see how well it worked in ICS settings. They proposed future research directions that could result in substantial progress in this field.
Maseno et al. [34] discussed the use of diverse hybrid intrusion-detection techniques, such as signature-based and anomaly-based detection, to obtain the most out of each while minimizing the problems that come with it. This attribute improves the ability to detect occurrences, reduces the likelihood of incorrect identifications, and facilitates the development of more adaptable and responsive systems that can adapt to the specific needs of the network or environment they protect. They acknowledged the significant computational complexity and challenges of efficiently processing massive datasets in hybrid systems. They hope to implement hybrid models in real-world ICS applications, develop self-adaptive models, and reduce the computational complexity in future research.
Zhang et al. [35] proposed a hybrid intrusion detection model that uses a two-stage detection process. The first stage involved both anomaly and misuse detection. Any traffic identified as abnormal in the first stage underwent further analysis in the second stage to confirm whether it was a false positive or an actual attack. The model also uses data mining techniques to automate the detection processes and reduce false alarms. This serves as the core technology underpinning the hybrid intrusion detection model. The authors suggested that data mining is crucial for automatically extracting features, patterns, and rules from large volumes of network traffic data. This capability is fundamental for building detection models that can effectively identify known and unknown intrusions. However, they did not specify the algorithms and data mining techniques used to develop the model. The authors hope to improve their model while addressing data complexity, developing more robust anomaly detection algorithms, integrating the hybrid model with other security models, such as P2DR2, and commercializing viable IDS solutions that use data mining for future research. In [36], Hasan developed a novel hybrid real-time IDS for IoT contexts, departing from an IDS developed using data mining techniques. An IDS employs two machine learning methods. The first is K-means clustering, which is an unsupervised learning algorithm that groups network traffic based on similarity. This assists in the initial categorization of information by distinguishing between legitimate and potentially harmful traffic. The second method uses supervised learning to further classify traffic using RF classification based on the training data. The RF technique increases the detection process’s accuracy by employing several decision trees to forecast each data instance class. The hybrid IDS combines the K-means clustering method with an RF classifier to enhance the initial clustering results. The system was implemented using the NSL-KDD dataset, Python, the Anaconda platform, the Scikit-Learn library for machine learning, and PySpark for distributed computing. They evaluated the system using performance criteria such as accuracy, recall, F1-score, precision, detection rate, and false alarm rate. With a low false alarm rate and a detection rate of approximately 99%, the hybrid IDS displayed encouraging results. The author proposed that future research should focus on reducing the testing and training times of the system to prepare it for real-time applications. He also pointed to the possibility of growing the system to accommodate more varied network traffic and a wider variety of IoT devices. Table 2 summarizes the intrusion detection techniques covered in this section.
5. Practical Implementation and Challenges of Integrating Network-Based Intrusion Detection in Industrial and Robotic Systems
The integration of advanced networking and computing technologies into industrial and robotic systems has resulted in numerous benefits, including increased efficiency and automation. However, this integration introduces significant cybersecurity challenges. This section summarizes the primary challenges specific to industrial and robotic systems. These challenges are summarized in Figure 2.
5.1. Complexity of ICS
ICS is becoming increasingly complicated and interconnected with industrial and robotic systems, which has led to increased security concerns. Using the Modbus, PROFINET, S7COMM, and DNP3 protocols in critical infrastructure has posed security risks in many environments. For instance, the U.S. Department of Homeland Security demonstrated the vulnerability of Modbus communication in ICS in simulated attacks on power grid setups, showing how attackers could intercept or alter communication between devices [37,38]. Researchers and innovators have developed a wide range of approaches, including specification-based methodologies [39], process awareness [40], and anomaly detection, to address this issue. Research has shown conflicting opinions on how best to monitor and control network traffic and process semantics. Some studies recommend concentrating on the last connection in the network, whereas others highlight the importance of doing both at once. Applying statistical models and machine learning is promising for anomaly identification in ICS setups. Much work remains before we have an IDS that can handle the unique requirements of complicated industrial and robotic systems, even with current advancements [41].
5.2. Cyber–Physical System (CPS) Vulnerabilities
The combination of cyber and physical components in CPS poses a growing security problem. Cyberattacks on CPS can have real-world effects, such as breaking equipment, stopping production, or creating safety risks. CPS are considered dual because they integrate both physical and cyber components to provide real-time data processing and decision-making capabilities, thereby rendering hacking breaches more dangerous. One prominent example is the 2014 cyberattack on a German steel mill, where attackers compromised network systems, leading to the failure of production controls and significant physical damage. This event was often cited in discussions on CPS vulnerabilities by [42]. Protecting CPS, especially in industrial settings, requires an IDS [43]. Many recent studies have focused on improving the performance of IDS in CPS using machine learning [44]. Cybercriminals use advanced techniques to exploit vulnerabilities in CPS, particularly robotic systems. Concerning identifying suspicious actions and breaches in CPS, deep learning algorithms have demonstrated encouraging results [45]. Control theory has been used to investigate many attacks and methods for detecting them [46]. Identifying hazards in many CPS applications relies heavily on anomaly detection strategies, but there are also obstacles, such as different CPS settings, limited resources, and an absence of established standards [47].
5.3. Advanced Persistent Threats (APTs)
Industrial and robotic systems, particularly those involved in intrusion detection over networks, face severe threats from APTs. They are sophisticated cyberattacks carried out by skilled professionals, often infiltrating high-value systems, stealing sensitive data, or disrupting operations over extended periods. Unlike typical cyber threats, APTs involve a “low-and-slow” approach, where attackers focus on stealth and persistence, avoiding detection as they gradually establish control within a network [48,49]. APTs are typically state-sponsored or highly organized criminal enterprises, and they target critical infrastructure, government agencies, large corporations, and defense systems. A real-world example of an APT is the Stuxnet attack, widely regarded as one of the most prominent APTs in recorded history. Unearthed in 2010, Stuxnet was an exceptionally advanced computer worm created for the specific purpose of attacking Iran’s nuclear program. It deliberately targeted the software of industrial control systems, causing significant damage to approximately 20 percent of Iran’s nuclear centrifuges. The worm spreads across Microsoft Windows machines and can self-replicate [50]. The SolarWinds Attack of 2020 is another prominent example of an APT. Suspected to be state-sponsored, this attack targeted SolarWinds, a U.S. IT management company, by injecting malicious code into their Orion software updates. When customers installed these updates, attackers gained backdoor access to their systems, compromising numerous high-profile U.S. government agencies such as Homeland Security, Treasury, and State. Microsoft and FireEye were among the affected private sector companies. The attackers used stealthy methods to move laterally within the affected networks, exfiltrating sensitive information and maintaining access over several months. The incident highlighted APT’s ability to operate undetected within a supply chain, demonstrating how such threats exploit trusted software and vendors. This event reinforced the need for enhanced cybersecurity measures in government and industry. Traditional security assessment methods are extremely difficult to deal with because they are crafty and effective at evading detection [51]. Artificial immune systems, recurrent neural networks [52], graph theory, and deep learning are some of the machine learning algorithms that have been recently examined as possible ways to find APTs [53]. These strategies aim to improve the detection capacities of both the IT and OT systems. The analysis of network traffic patterns, event correlation, and multi-stage detection frameworks are common components of the proposed solutions [54].
5.4. Lack of Real-Time Monitoring
Monitoring cyber dangers in real-time and promptly responding to them is crucial for ensuring the safety of industrial systems. However, owing to the need for low latency and high reliability in industrial settings, it is not always possible to use full real-time monitoring systems [55]. The lack of real-time monitoring in industrial and robotic systems poses a notable obstacle because of the strict demands for minimal delay and exceptional reliability. These systems require immediate reactions to prevent operational disturbances; however, real-time monitoring can cause delays and put pressure on the limited computational resources. The large amount and speed at which data are produced, along with the complicated nature of diverse networks and the requirement for cyber–physical integration, make it even more challenging to implement efficient monitoring solutions. Therefore, in the absence of strong and immediate detection and response capabilities, cyber threats can remain undetected, which can result in significant risks to operational safety and efficiency. The Colonial Pipeline attack in 2021 highlighted the critical need for real-time monitoring in ICS networks. This ransomware attack led to a major fuel supply disruption in the U.S. and underscored challenges around latency and real-time response in critical infrastructures.
5.5. Insider Threats
Industrial and robotic systems are very vulnerable to insider attacks, whether deliberate or unintentional. Employees who compromise credentials or commit malicious acts can significantly harm an organization’s systems. It is still difficult to effectively identify and eliminate insider risks. In 2019, a former Tesla employee disclosed proprietary data and system credentials to outsiders, potentially endangering system integrity and safety. The incident reflects the difficulty of identifying insiders who have legitimate system access, as discussed in [56]. Identifying and managing insider threats in industrial and robotic systems pose significant challenges owing to multiple considerations. First, individuals with privileged access, such as employees, contractors, or partners, frequently possess real access to vital systems, which complicates the differentiation between regular and harmful activities. This access gives them the ability to skip security procedures intended to prevent external threats. Furthermore, insider attacks may manifest as either planned or accidental actions, thus complicating the process of identifying potential threats. Malicious insiders can take advantage of their understanding of system weaknesses, while well-intentioned staff may unintentionally cause harm due to negligence or human error. Moreover, insider threats may disguise themselves during normal activities, rendering the identification of abnormalities challenging without the use of sophisticated monitoring and analytic techniques. The implementation of intrusive monitoring technologies is made more complex by issues related to privacy and the necessity of establishing trust among employees. The complex and diverse structure of industrial networks, including outdated and contemporary technologies, contributes to the challenge of implementing consistent security protocols. The combination of these characteristics poses significant difficulties in accurately identifying and addressing insider dangers in industrial and robotic environments.
5.6. Legacy Systems and Upgrades
The complexity of upgrades and old systems makes it difficult to integrate network-based IDS in robotic and industrial settings. The lack of security considerations during their design makes many industrial control systems vulnerable to cyberattacks. When it comes to linked settings, legacy systems can be a real pain due to their antiquated design patterns and lack of modern security measures. Many SCADA systems still in use today lack encryption, making them liable to attacks such as the sandworm attack in 2014, which targeted Ukraine’s infrastructure and exploited SCADA system vulnerabilities. Similar challenges are discussed in [57]. Many industrial systems rely on outdated technology without considering modern cybersecurity concerns. Upgrades are disruptive and expensive, making it difficult to secure these systems. It is extremely difficult to guarantee the safety of older systems while minimizing operational interruptions. The lack of experts trained in outdated control systems coupled with outdated hardware and software makes upgrading these systems difficult [43]. To address these challenges, researchers are developing emerging techniques such as holistic intrusion detection ideas [58], machine learning-based detection methods [59], and last-line defense intrusion detection systems [60]. In addition, scientists are trying to figure out how to incorporate old systems into new IoT designs without destroying any working hardware [61].
5.7. Supply Chain Security
There is a significant security risk associated with integrating a network-based intrusion IDS into robotic and industrial settings. Various cyber dangers may penetrate supply chains owing to their growing complexity and interconnections. In 2020, the SolarWinds cyberattack compromised thousands of organizations globally by inserting malware through a widely-used IT monitoring product. This highlights the potential vulnerabilities across a supply chain reliant on third-party software. Refs. [51,62] explore supply chain threats that can be referenced. Researchers have developed and investigated modern intrusion detection system (IDS) frameworks based on reconfigurable hardware technology to reduce these threats and explore ways to secure geographically distributed industrial networks [63]. Industrial robots are CPSs; therefore, their security is particularly vulnerable to threats that could affect their physical operations. Deploying effective security measures is challenging because of issues related to knowledge, limited testbeds, proprietary systems, and limited resources. Studies have shown the importance of dealing with supply chain integrity in the ICS domain [64] and how important it is to use methods that consider both the physical and virtual parts of critical infrastructure [65]. Additionally, the safety of industrial systems is frequently dependent on security measures taken by vendors and providers outside organizations. Ensuring the security of the entire supply chain is crucial because industrial systems may be compromised by compromised components or software from vendors and suppliers [66,67].
5.8. Regulatory Compliance
When NIDS are used in robotics and factories, they create significant problems when it comes to following rules, finding cyber threats in industrial control systems, and making robots work together. However, company cultural issues, rapidly evolving regulations, and resource limitations complicate compliance management [60]. Regulatory compliance and cybersecurity interact in a complicated way; compliance usually drives security measures but may also leave weaknesses in the general security posture. The General Data Protection Regulation (GDPR) in the EU has introduced complexities for global companies integrating NIDS due to stringent data protection and monitoring requirements [68]. Cybersecurity policies and standards apply to industrial systems; however, they may differ greatly between sectors and locations. It can be especially difficult for global corporations operating in several regulatory ecosystems to meet these standards [69]. Researchers have suggested creative solutions to these difficulties, such as data streaming methods for industrial networks and distributed IDS for robotic systems. Furthermore, thorough risk assessment and mitigation rely on incorporating safety and security concerns into the industrial systems [43].
5.9. Resource Constraints
Resources severely limit the integration of industrial and robotic systems with network-based IDS. Given the constraints of limited processing capacity and energy resources, it is essential to have efficient scheduling of IDS jobs [70] together with lightweight detection techniques [71]. Researchers are currently exploring various methodologies to address these challenges. Some of these methods are developing decision tree-based solutions, deep learning with computational offloading, and the best way to spread IDS functions across network nodes [72]. For mobile CPS, integrating cyber and physical elements in an IDS design has shown the potential to enhance detection accuracy. Researchers have examined policy-based intrusion detection systems (IDS) for wireless sensor networks configured with IPv6 [73]. They also investigated the impact of the training set size on the use of resources for an IDS based on the IoT [74]. Despite significant advancements that have been made, there are still challenges in developing an appropriate IDS for environments with restricted resources [75,76].
5.10. Evolving Threat Lanscape
Industrial and robotic systems are vulnerable to developing threats such as APTs, zero-day vulnerabilities, and malware suited specifically for ICS protocols. Recent attacks, such as the Colonial Pipeline ransomware outbreak [77], demonstrate the widespread disruptions that these threats may create by targeting redundant or traditional security systems that struggle against sophisticated, covert approaches. Similarly, recent attacks on sensor integrity and control signal authenticity in robotic systems, such as the sensor spoofing attack on a pharmaceutical production robot in 2022 [78], which resulted in considerable financial losses owing to product faults, demonstrate the enormous physical hazards involved. The expansion of IoT and IIoT devices increases the attack surface, complicating security by offering more possible entry points. Traditional NIDS are frequently unprepared for such fast changes in attack vectors, making adaptive, learning-based techniques critical for future resilience.
6. BenchMark Datasets
In this survey, we reviewed relevant datasets commonly utilized in the development and evaluation of network-based intrusion detection systems (NIDS) for industrial and robotic systems. These datasets vary from older ones such as NSL-KDD to SWaT and BATADAL, which are concerned with cybersecurity in Industrial Control Systems (ICS) and the Industrial Internet of Things. Researchers can use these open-source datasets for simulations in industrial and robotic systems. Below are the descriptions of the datasets.
6.1. NSL-KDD
The University of Brunswick developed this dataset in 2009 to address redundancies and inaccuracies [79], improving upon the KDD Cup 1999 data. It focused on Denial of Service (DoS), Remote-to-Local (R2L), User-to-Root, and Probes as the attack types. It contains 125,973 records with reduced redundancy, making it more manageable for researchers. Each record includes 41 features, such as the protocol type, service, and flag. Despite its limited representation of real-world attacks and lack of industrial-specific features, this dataset remains synthetic and can be applicable in certain industrial and robotic cybersecurity scenarios. This restricts its relevance in modern industrial environments, which demand context-specific data.
6.2. ISCX
The Canadian Institute of Cybersecurity created this dataset in 2012 with HTTP, SMTP, and SSH as the attack types [80]. They designed this well-balanced real-world network traffic dataset for anomaly detection. It includes 18 h of labeled traffic across a wide range of protocols with around 1 million records. Although the dataset imitates real-world traffic, it does not specifically incorporate ICS or IoT protocols. This makes it less relevant for NIDS research in robotic or ICS settings.
6.3. SWaT
Singapore University of Technology created this dataset in 2016 with a focus on the security of water treatment systems and ICS [81]. The attack types are ICS-specific, such as command injection and data manipulation. The data creation process involved six days of attack data against an operational water treatment plant. SWaT contains 946,722 data points and 51 unique attributes, such as sensor readings and actuator states. Despite being industry-specific, SWaT only represents a water treatment ICS and lacks diversity across different industrial environments, which limits its applicability to other robotic and industrial systems.
6.4. CICIDS 2017
The Canadian Institute for Cybersecurity developed this dataset in 2017 with the focus of emulating modern real-world attack scenarios in a controlled network [82]. It uses DoS, brute force, web attacks, and infiltration as the attack types. It has over 3.1 million instances, including 83 network flow features and labeled attack types. This dataset primarily targets enterprise networks lacking the attributes of ICS and IoT applications commonly found in some industrial systems.
6.5. UGR’16
The University of Granada developed this dataset in 2017 with a focus on long-term analysis of real network traffic for anomaly detection. DoS, brute force, and botnet were its attack types [83]. The team collected approximately 19 gigabytes of data, capturing daily network traffic for more than a year and including eight basic flow features. It can be applied in certain scenarios but lacks the industrial specificity and IoT-focused protocols needed for a wide range of robotics systems, limiting its applicability in manufacturing and robotic scenarios.
6.6. BETADAL
Different institutions developed this dataset, with Singapore University of Technology and Design (SUTD) and Cornell University being the prominent ones in 2018 [84]. The dataset includes water infrastructure attacks, such as sensor and command spoofing, and focuses on attack scenarios for water distribution ICS. It simulates multiple attacks on water distribution systems, capturing data for sensors and actuators for several weeks. Its scope is limited to water distribution and machinery and does not generalize to other ICS or robotic applications, leaving a gap for other sectors, such as manufacturing and power distribution.
6.7. WUSTL-IIOT
Washington University in St. Louis developed this dataset in 2018 with a focus on intrusion detection for smart manufacturing and IIoT environments [85]. The dataset includes IIoT network attacks such as DDoS and command injection, with approximately 2.5 million labeled packets focusing on IIoT protocols and smart manufacturing scenarios. It is limited in scope and lacks some robotic attack cases essential for testing NIDS in broader industrial systems.
6.8. TON IoT
The University of South Wales developed this dataset in 2020, focusing on the security of IIoT environments that encompass IoT, ICS, and network flows [86]. The dataset includes IoT-specific attacks such as DDoS and data manipulation. The data creation is from network traffic, IoT sensors, and ICS systems and includes 22 million entries across 29 features. Even though this dataset covers a lot of IIoT protocols, it might not cover all of the attack vectors that are unique to robotics. Table 3 summarizes the datasets, their properties, and the research publications where they were initially introduced or cited.
The limitations of existing datasets reveal the need for more comprehensive data to support effective NIDS research in industrial and robotic environments. Most datasets only cover specific sectors and lack the cross-sector applicability necessary to generalize NIDS for various industrial systems. Also, only a few datasets comprehensively cover the wide array of attacks faced by industrial and robotic systems, such as APTs, sensor spoofing, and ICS-specific malware. On the other hand, there are numerous cases of data imbalance, where many datasets contain limited instances of attack data. This can lead to biased models that are ineffective for real-time industrial NIDS applications. Solving these challenges will require holistic approaches, such as expanding datasets with simulated data from diverse environments. Simulation data from smart grids, automated factories, manufacturing assembly plants, and water treatment plants can improve generalizability and model performance in real-world applications. Combining real-world data with high-fidelity simulated attacks, such as from digital twins of industrial systems, can enhance dataset diversity without compromising data authenticity. Robotics-specific datasets that cover sensor spoofing, command injection, and other unique attack vectors can better support NIDS research for robotic applications. Integrating a broader range of cyber threats will enable researchers to train models that respond effectively to evolving threats in industrial and robotic environments. Researchers can also reduce the risks of model bias, which results in inaccurate and ineffective NIDS, by generating attack data to balance normal and malicious instances. Implementing these solutions will support the development of robust NIDS capable of protecting modern industrial and robotic systems from increasingly sophisticated cyber threats.
7. Future Directions
Researchers and innovators can infuse or combine NIDS with emerging technologies to ensure robust and effective security for industrial and robotic systems. We will elaborate on some of the best of these technologies.
7.1. Federated Learning
Federated learning (FL) enables decentralized model training, allowing devices to learn collaboratively without sharing raw data. In this approach, data remains localized, and only model updates are shared, ensuring data privacy and reducing communication overhead [87]. Studies demonstrate that FL-based IDS can achieve comparable or superior accuracy to traditional deep learning models while maintaining data confidentiality [88,89], and its applications in IDS span various domains, including IoT and industrial networks [90]. Due to its decentralized nature, federated learning holds promise for intrusion detection in industrial and robotic systems. By enabling local NIDS training across industrial endpoints, FL will ensure that sensitive factory data remains on-site, safeguarding proprietary processes and sensitive information while building robust, location-specific models. FL can also adaptively enhance NIDS by leveraging local threat intelligence without centralizing data, making it ideal for factories with high privacy demands. For example, automotive manufacturers are testing FL to improve security in connected vehicles by continuously adapting to regional threat profiles without sharing proprietary data externally [91,92].
7.2. Large Language Models
Large language models (LLMs) are advanced AI models designed to understand, generate, and manipulate human-like language based on large datasets. These models are trained on billions of words or tokens from sources like books, articles, websites, and technical documents, allowing them to understand context, semantics, and grammar at a high level. Recent research has explored the application of large language models (LLMs) in network intrusion detection systems and broader cybersecurity contexts. LLMs demonstrate potential in various tasks, including vulnerability detection, malware analysis, and DDoS attack identification [93,94]. Studies show that LLMs, particularly BERT-based models, can effectively extract features from network data and outperform traditional machine learning methods in intrusion detection [95]. Frameworks like HuntGPT integrate LLMs with explainable AI to enhance user understanding and interaction in threat detection [96]. LLMs have shown promising results in DDoS detection, achieving high accuracy rates through fine-tuning and few-shot learning [97]. In NIDS, LLMs can parse and analyze vast amounts of industrial communication data, identifying anomalies based on deviations in patterns. Their ability to understand contextual semantics enables them to detect unusual activities and generate explanations for identified threats. For instance, an LLM-powered NIDS could monitor machine-to-machine communications in factories and detect unusual command sequences that might indicate an intrusion. This functionality is increasingly relevant in smart factories, where real-time, language-based anomaly detection aids in quick response to potential threats, reducing downtime.
7.3. Quantum Computing
Quantum computing is a revolutionary computing paradigm based on the principles of quantum mechanics, which studies the behavior of matter and energy at extremely small scales, like atoms and subatomic particles. Unlike classical computers, which process information in binary bits (0s and 1s), quantum computers use quantum bits, or qubits. These qubits can exist in multiple states simultaneously due to a property called superposition, enabling quantum computers to handle complex calculations with immense efficiency and speed. Quantum machine learning (QML) approaches, including quantum support vector machines and quantum neural networks, have shown improved accuracy and reduced training time compared with classical methods in recent research [98]. Novel approaches like quantum-enhanced machine learning Security Systems [99] and Quantum Generative Adversarial Networks [100] have shown promise in enhancing network security. Quantum computing offers unprecedented processing power, which can enhance NIDS by facilitating the rapid analysis of vast data streams typical in industrial environments. Its potential for breaking classical encryption also pushes the need for quantum-resistant cybersecurity measures within NIDS frameworks. Currently, large manufacturers and logistics firms are researching quantum-based encryption to secure industrial networks, preparing for a future where quantum threats may become viable. Quantum-enhanced NIDS could analyze network traffic at speeds unattainable by classical systems, significantly advancing detection capabilities in time-sensitive environments like robotic assembly lines.
7.4. Blockchain
Blockchain is a decentralized, distributed ledger technology that records transactions in a way that is transparent, secure, and resistant to tampering. Originally developed to support cryptocurrencies like Bitcoin, blockchain is now applied across various industries due to its ability to create trust in environments without a central authority. Blockchain provides an immutable audit trail and fosters collaboration among stakeholders for faster threat detection [101]. The technology’s application extends to various domains, including IoT networks, where it strengthens security against emerging attacks [102]. Researchers have proposed frameworks for blockchain-based IDS, analyzing their effectiveness in decentralized environments [103]. Blockchain can be integrated with NIDS to enhance data transmission and logging trustworthiness. By using blockchain, NIDS can store records of detected threats and responses in an immutable ledger, ensuring traceability and preventing tampering. This is particularly valuable in industrial supply chains, where multiple vendors access factory networks. For instance, pharmaceutical manufacturers employ blockchain to verify the authenticity of equipment and software components, thereby mitigating risks from third-party suppliers. Blockchain-based NIDS can also validate data integrity across distributed industrial networks, improving trust and reducing vulnerabilities from insider threats.
7.5. Digital Twin
A digial twin is a virtual replica of a physical asset, system, or process that continuously updates in real-time based on data from its physical counterpart. This concept enables real-time monitoring, analysis, and simulation, offering a dynamic model that mirrors the physical entity’s behavior and conditions and can also facilitate data sharing and control of security-critical processes. Digital twins are commonly used in industrial applications, smart manufacturing, healthcare, and even urban planning, as they provide a comprehensive view of how a system operates under varying conditions. They can be equipped with intrusion detection algorithms to detect and classify attacks in real time [104]. A novel hybrid model combining deep learning and random forest for intrusion detection in digital twins has shown promising results [105]. Digital twins can empower NIDS by providing a mirrored environment to simulate attacks and assess the impact of intrusion without affecting actual operations. NIDS models trained on digial twins can proactively identify and counteract attacks based on simulated threat scenarios, offering a powerful preemptive security tool. For example, aerospace and automotive industries utilize digial twins to test and validate system robustness under simulated cyberattacks, minimizing risk before deployment. Industrial systems can continuously monitor and detect deviations by integrating real-time digial twin data with NIDS, strengthening cybersecurity within dynamic manufacturing processes.
These technologies, when integrated into NIDS, can significantly advance the capabilities of intrusion detection in industrial and robotic systems. Leveraging FL, LLMs, quantum computing, blockchain, and digial twins opens pathways for robust, efficient, and intelligent NIDS, addressing the unique cybersecurity challenges in the industrial and robotic sectors.
8. Conclusions
As cyber threats continue to escalate, this survey highlights the importance of advanced and specialized Network Intrusion Detection Systems (NIDS) tailored specifically to the needs of industrial and robotic environments. Current solutions, including machine learning and deep learning-based NIDS, show promise in achieving low false positive rates, high detection accuracy, and operational efficiency. However, these advancements face challenges related to legacy systems, complex network protocols, real-time monitoring needs, and resource limitations. To address these, emerging technologies such as federated learning, blockchain, quantum computing, and digital twins are poised to provide enhanced data security, privacy, and adaptability within NIDS. By integrating these technologies, future NIDS can evolve into more resilient, scalable, and intelligent systems, effectively protecting industrial and robotic systems against advanced cyber threats. This study emphasizes the ongoing need for robust, sector-specific NIDS solutions, offering a pathway for continued research and development to fortify industrial cybersecurity.
Conceptualization, S.Y., O.O. and K.R.; writing—original draft preparation, R.H.; writing—review and editing, S.Y., O.O. and K.R.; supervision, S.Y., O.O. and K.R. All authors have read and agreed to the published version of the manuscript.
No new data were created or analyzed in this study. Data sharing is not applicable to this article.
The authors declare no conflicts of interest.
The following abbreviations are used in this manuscript:
| NIDS | Network-based Intrusion Detection System |
| ICS | Industrial Control Systems |
| AI | Artificial Intelligence |
| IDS | Intrusion Detection Systems |
| DoS | Denial of Service |
| CNN | Convolutional Neural Networks |
| LSTM | Long Short-Term Memory |
| SVM | Support Vector Machine |
| IoT | Internet of Things |
| IIoT | Industrial Internet of Things |
| SHAP | Sharply Adaptive Explanations |
| MLP | Multi-Layer Perception |
| DNN | Deep Neural Networks |
| FFDNN | Feed-Forward Deep Neural Networks |
| RNN | Recurrent Neural Network |
| RBM | Restricted Boltzmann Machines |
| DBN | Deep Belief Networks |
| KNN | K-Nearest Neighbor |
| GNB | Gaussian Naive Bayes |
| DT | Decision Tree |
| RF | Random Forest |
| GBC | Gradient Boosting Classifier |
| DRL | Deep Reinforcement Learning |
| GANs | Generative Adversarial Networks |
| MES | Manufacturing Executive System |
| ANNs | Artificial Neural Networks |
| FFNN | Feedforward Neural Networks |
| RBNN | Radial Basis Neural Networks |
| PFCM | Probabilistic Fuzzy C-Means |
| IDE | Integrated Development Environment |
| IT | Information Technology |
| OT | Operational Technologies |
| PCA | Principal Component Analysis |
| PPO2 | Proximal Policy Optimization |
| APCs | Automate Process Control Systems |
| GNNs | Graph Neural Networks |
| DLDA | Direct Linear Discriminant Analysis |
| SSS | Small Sample Size |
| NN | Nearest-Neighbor |
| LDA | Linear Discriminant Analysis |
| CPS | Cyber–Physical System |
| APTs | Advanced Persistent Threats |
Footnotes
Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content.
Comparison of survey papers.
| Research Papers | Published Year | Focus on Industrial and Robotic Systems | ICS and Robotics Specific Datasets | Integrates NIDS with Emerging Technologies |
|---|---|---|---|---|
| [ | 2023 | NO | NO | NO |
| [ | 2024 | NO | NO | NO |
| [ | 2023 | NO | NO | NO |
| [ | 2024 | NO | NO | NO |
| [ | 2023 | NO | NO | NO |
| [ | 2024 | NO | NO | NO |
| [ | 2023 | NO | NO | NO |
| [ | 2024 | NO | NO | NO |
| [ | 2024 | NO | NO | NO |
| [ | 2024 | NO | NO | NO |
| [ | 2023 | NO | NO | NO |
| Our Paper | 2024 | YES | YES | YES |
Comparative evaluation of intrusion detection methodologies for industrial applications.
| Methodology | Detection Accuracy | Adaptability to New Threats | Computational Efficiency | False Positive Rate | Suitability for Industrial Use |
|---|---|---|---|---|---|
| Signature-Based | High | Low | High | Low | Good for stable environments |
| Anomaly-Based | Moderate | High | Moderate | High | Excellent for dynamic environments |
| Machine Learning-Based | High | High | Varies | Moderate | Very effective for diverse threats |
| Deep Learning-Based | Very High | Very High | Low | Low | Best for complex data analysis |
| Hybrid Based | Very High | High | Moderate | Lower than anomaly-only | Optimal for comprehensive coverage |
Key datasets for network-based intrusion detection in industrial and robotics systems.
| Dataset | Developer | Year | Attack Types | Focus | Reference |
|---|---|---|---|---|---|
| NSL-KDD | University of New Brunswick | 2009 | DoS,R2L,U2L,Probe | Improved Version of KDD CUP 1999 | [ |
| ISCX | Canadian Institute for Cybersecurity | 2012 | HTTP,SMTP,SSH attacks | Well-balanced real-world network traffic | [ |
| SWaT | Singapore University of Technology | 2016 | ICS-specific attacks | Cybersecurity in Industrial Control | [ |
| CICIDS 2017 | Canadian Institute of Cybersecurity | 2017 | DoS,brute force | Real-world attack scenarios | [ |
| UGR’16 | University of Granada | 2017 | DoS,brute force | Long-term network traffic analysis | [ |
| BATADAL | Singapore University of Technology and Design (SUTD) and Cornell University | 2018 | Water Infrastructure | ICS attack on water distribution systems | [ |
| WUSTL-IIOT | Washington University in St.Louis | 2018 | IIoT network attacks | Intrusion detection in smart manufacturing | [ |
| TON IoT | University of New South Wales | 2020 | IoT-Specific attacks | Industrial IoT (IIoT) environment | [ |
References
1. Kheddar, H.; Himeur, Y.; Awad, A.I. Deep transfer learning for intrusion detection in industrial control networks: A comprehensive review. J. Netw. Comput. Appl.; 2023; 220, 103760. [DOI: https://dx.doi.org/10.1016/j.jnca.2023.103760]
2. Jin, K.; Zhang, L.; Zhang, Y.; Sun, D.; Zheng, X. A network traffic intrusion detection method for industrial control systems based on deep learning. Electronics; 2023; 12, 4329. [DOI: https://dx.doi.org/10.3390/electronics12204329]
3. Rajasa, M.C.; Rahma, F.; Rachmadi, R.F.; Pratomo, B.A.; Purnomo, M.H. A Review of Imbalanced Datasets and Resampling Techniques in Network Intrusion Detection System. Proceedings of the 2023 8th International Conference on Information Technology and Digital Applications (ICITDA); Yogyakarta, Indonesia, 4–5 October 2023; pp. 1-6.
4. Balla, A.; Habaebi, M.H.; Elsheikh, E.A.; Islam, M.R.; Suliman, F.E. The Effect of Dataset Imbalance on the Performance of SCADA Intrusion Detection Systems. Sensors; 2023; 23, 758. [DOI: https://dx.doi.org/10.3390/s23020758] [PubMed: https://www.ncbi.nlm.nih.gov/pubmed/36679553]
5. Keserwani, P.K.; Govil, M.C.; Pilli, E.S. An Effective NIDS Framework Based on a Comprehensive Survey of Feature Optimization and Classification Techniques. Neural Comput. Appl.; 2023; 35, pp. 4993-5013. [DOI: https://dx.doi.org/10.1007/s00521-021-06093-5]
6. Abdulganiyu, O.H.; Ait Tchakoucht, T.; Saheed, Y.K. A systematic literature review for network intrusion detection system (IDS). Int. J. Inf. Secur.; 2023; 22, pp. 1125-1162. [DOI: https://dx.doi.org/10.1007/s10207-023-00682-2]
7. Thakkar, A.; Lohiya, R. A review on challenges and future research directions for machine learning-based intrusion detection system. Arch. Comput. Methods Eng.; 2023; 30, pp. 4245-4269. [DOI: https://dx.doi.org/10.1007/s11831-023-09943-8]
8. Suleiman, F.; Iliyasu, U.; Abubakar, M. Review on the Network Intrusion Detection Systems (NIDS). BIMA J. Sci. Technol.; 2024; 8, pp. 141-155.
9. Abdulganiyu, O.H.; Tchakoucht, T.A.; Saheed, Y.K. Towards an efficient model for network intrusion detection system (IDS): Systematic literature review. Wirel. Netw.; 2024; 30, pp. 453-482. [DOI: https://dx.doi.org/10.1007/s11276-023-03495-2]
10. Gala, Y.; Vanjari, N.; Doshi, D.; Radhanpurwala, I. AI based techniques for network-based intrusion detection system: A review. Proceedings of the 2023 10th International Conference on Computing for Sustainable Global Development (INDIACom); New Delhi, India, 15–17 March 2023; pp. 1544-1551.
11. Panchal, R.K.; Snehkunj, R.; Panchal, V.V. A Survey on Network-based Intrusion Detection System using Learning Techniques. Proceedings of the 2024 5th International Conference on Image Processing and Capsule Networks (ICIPCN); Dhulikhel, Nepal, 3–4 July 2024; pp. 740-747.
12. Yogesh,; Goyal, L.M. A Systematic Literature Review of Network Intrusion Detection System Models. Proceedings of the International Conference on Paradigms of Communication, Computing and Data Analytics; Delhi, India, 22–23 April 2023; Springer Nature: Singapore, 2023; pp. 453-468.
13. Schrötter, M.; Niemann, A.; Schnor, B. A Comparison of Neural-Network-Based Intrusion Detection against Signature-Based Detection in IoT Networks. Information; 2024; 15, 164. [DOI: https://dx.doi.org/10.3390/info15030164]
14. Abdulkareem, S.A.; Foh, C.H.; Shojafar, M.; Carrez, F.; Moessner, K. Network Intrusion Detection: An IoT and Non IoT-Related Survey. IEEE Access; 2024; 12, pp. 147167-147191. [DOI: https://dx.doi.org/10.1109/ACCESS.2024.3473289]
15. Idrissi, H.K.; Kartit, A. Network Intrusion Detection using Combined Deep Learning Models: Literature Survey and Future Research Directions. IAENG Int. J. Comput. Sci.; 2024; 51, pp. 998-1010.
16. Momand, A.; Jan, S.U.; Ramzan, N. A systematic and comprehensive survey of recent advances in intrusion detection systems using machine learning: Deep learning, datasets, and attack taxonomy. J. Sens.; 2023; 2023, 6048087. [DOI: https://dx.doi.org/10.1155/2023/6048087]
17. Kaouk, M.; Flaus, J.; Potet, M.; Groz, R. A review of intrusion detection systems for industrial control systems. Proceedings of the 2019 6th International Conference on Control, Decision and Information Technologies (CoDIT); Paris, France, 23–26 April 2019; pp. 1699-1704.
18. Ring, M.; Wunderlich, S.; Scheuring, D.; Landes, D.; Hotho, A. A survey of network-based intrusion detection data sets. Comput. Secur.; 2019; 86, pp. 147-167. [DOI: https://dx.doi.org/10.1016/j.cose.2019.06.005]
19. Gillen, R.E.; Carter, J.M.; Craig, C.; Johnson, J.A.; Scott, S.L. Assessing anomaly-based intrusion detection configurations for industrial control systems. Proceedings of the 2020 IEEE 21st International Symposium on “A World of Wireless, Mobile and Multimedia Networks” (WoWMoM); Cork, Ireland, 31 August–3 September 2020; pp. 360-366.
20. Kabore, R.; Kouassi, A.; N’goran, R.; Asseu, O.; Kermarrec, Y.; Lenca, P. Review of anomaly detection systems in industrial control systems using deep feature learning approach. Engineering; 2021; 13, pp. 30-44. [DOI: https://dx.doi.org/10.4236/eng.2021.131003]
21. Rosa, L.; Cruz, T.R.; Freitas, M.B.; Quitério, P.; Henriques, J.; Caldeira, F.; Monteiro, E.; Simões, P. Intrusion and anomaly detection for the next-generation of industrial automation and control systems. Future Gener. Comput. Syst.; 2021; 119, pp. 50-67. [DOI: https://dx.doi.org/10.1016/j.future.2021.01.033]
22. Ganeshan, R.; Daniya, T. A systematic review on anomaly-based intrusion detection system. IOP Conf. Ser. Mater. Sci. Eng.; 2020; 981, 022010. [DOI: https://dx.doi.org/10.1088/1757-899X/981/2/022010]
23. Alsoufi, M.A.; Razak, S.B.; Siraj, M.M.; Nafea, I.T.; Ghaleb, F.A.; Saeed, F.; Nasser, M. Anomaly-based intrusion detection systems in IoT using deep learning: A systematic literature review. Appl. Sci.; 2021; 11, 8383. [DOI: https://dx.doi.org/10.3390/app11188383]
24. Flaus, J.; Georgakis, J. Review of machine learning-based intrusion detection approaches for industrial control systems. Proceedings of the Computer & Electronics Security Applications Rendez-vous (C&ESAR) Conference; Rennes, France, 19–21 November 2018.
25. Haripriya, L.; Jabbar, M.A. Role of machine learning in intrusion detection system. Proceedings of the 2018 Second International Conference on Electronics, Communication and Aerospace Technology (ICECA); Coimbatore, India, 29–31 March 2018; pp. 925-929.
26. Chattopadhyay, M.; Sen, R.; Gupta, S. A comprehensive review and meta-analysis on applications of machine learning techniques in intrusion detection. Australas. J. Inf. Syst.; 2018; 22, [DOI: https://dx.doi.org/10.3127/ajis.v22i0.1667]
27. Mishra, N.; Mishra, S. A review of machine learning-based intrusion detection system. EAI Endorsed Trans. Internet Things; 2024; 10, [DOI: https://dx.doi.org/10.4108/eetiot.5332]
28. Alani, M.M.; Damiani, E.; Ghosh, U. DeepIIoT: An explainable deep learning-based intrusion detection system for industrial IoT. Proceedings of the 2022 IEEE 42nd International Conference on Distributed Computing Systems Workshops (ICDCSW); Bologna, Italy, 10 July 2022; pp. 169-174.
29. Yadav, S.; Kalpana, R. A survey on network intrusion detection using deep generative networks for cyber-physical systems. Artificial Intelligence Paradigms for Smart Cyber-Physical Systems; IGI Global: Hershey, PA, USA, 2021; pp. 137-159.
30. Abdel-Wahab, M.S.; Neil, A.M.; Atia, A. A comparative study of machine learning and deep learning in network anomaly-based intrusion detection systems. Proceedings of the 2020 15th International Conference on Computer Engineering and Systems (ICCES); Cairo, Egypt, 15–16 December 2020; pp. 1-6.
31. Lansky, J.; Ali, S.; Mohammadi, M.; Majeed, M.K.; Karim, S.H.T.; Rashidi, S.; Hosseinzadeh, M.; Rahmani, A.M. Deep learning-based intrusion detection systems: A systematic review. IEEE Access; 2021; 9, pp. 101574-101599. [DOI: https://dx.doi.org/10.1109/ACCESS.2021.3097247]
32. Aldweesh, A.; Derhab, A.; Emam, A.Z. Deep learning approaches for anomaly-based intrusion detection systems: A survey, taxonomy, and open issues. Knowl.-Based Syst.; 2020; 189, 105124. [DOI: https://dx.doi.org/10.1016/j.knosys.2019.105124]
33. Khacha, A.; Saadouni, R.; Harbi, Y.; Aliouat, Z. Hybrid deep learning-based intrusion detection system for industrial internet of things. Proceedings of the 2022 5th International Symposium on Informatics and its Applications (ISIA); M’sila, Algeria, 29–30 November 2022; pp. 1-6.
34. Maseno, E.M.; Wang, Z.; Xing, H. A systematic review on hybrid intrusion detection system. Secur. Commun. Netw.; 2022; 2022, 9663052. [DOI: https://dx.doi.org/10.1155/2022/9663052]
35. Zhang, L.; Zhang, J.; Chen, Y.; Lao, S. Hybrid intrusion detection based on data mining. Proceedings of the 2018 11th International Conference on Intelligent Computation Technology and Automation (ICICTA); Changsha, China, 22–23 September 2018; pp. 299-301.
36. Hasan, M. A Hybrid Real-Time Intrusion Detection System for an Internet of Things Environment with Signature and Anomaly-Based Intrusion Detection. Ph.D. Thesis; National College of Ireland: Dublin, Ireland, 2019.
37. Sverko, M.; Grbac, T.G. Complex systems - network component security of SCADA systems. Proceedings of the 2021 44th International Convention on Information, Communication and Electronic Technology (MIPRO); Opatija, Croatia, 24–28 May 2021; pp. 1630-1635.
38. Duo, W.; Zhou, M.; Abusorrah, A. A survey of cyber attacks on cyber physical systems: Recent advances and challenges. IEEE/CAA J. Autom. Sin.; 2022; 9, pp. 784-800. [DOI: https://dx.doi.org/10.1109/JAS.2022.105548]
39. Hotellier, E.; Sicard, F.; Francq, J.; Mocanu, S. Standard specification-based intrusion detection for hierarchical industrial control systems. Inf. Sci.; 2024; 659, 120102. [DOI: https://dx.doi.org/10.1016/j.ins.2024.120102]
40. Ayodeji, A.; Liu, Y.; Chao, N.; Yang, L. A new perspective towards the development of robust data-driven intrusion detection for industrial control systems. Nucl. Eng. Technol.; 2020; 52, pp. 2687-2698. [DOI: https://dx.doi.org/10.1016/j.net.2020.05.012]
41. Hu, Y.; Yang, A.; Li, H.; Sun, Y.; Sun, L. A survey of intrusion detection on industrial control systems. Int. J. Distrib. Sens. Netw.; 2018; 14, 1550147718794615. [DOI: https://dx.doi.org/10.1177/1550147718794615]
42. Pu, H.; He, L.; Cheng, P.; Sun, M.; Chen, J. Security of Industrial Robots: Vulnerabilities, Attacks, and Mitigations. IEEE Netw.; 2023; 37, pp. 111-117. [DOI: https://dx.doi.org/10.1109/MNET.116.2200034]
43. Bonagura, V.; Foglietta, C.; Panzieri, S.; Pascucci, F. Advanced Intrusion Detection System for Industrial Cyber-Physical Systems. IFAC-PapersOnLine; 2022; 55, pp. 265-270. [DOI: https://dx.doi.org/10.1016/j.ifacol.2023.01.083]
44. Ali, J. Intrusion Detection Systems Trends to Counteract Growing Cyber-Attacks on Cyber-Physical Systems. Proceedings of the 2021 22nd International Arab Conference on Information Technology (ACIT); Muscat, Oman, 21–23 December 2021; pp. 1-6.
45. Umer, M.; Sadiq, S.; Karamti, H.; Alhebshi, R.M.; Alnowaiser, K.; Eshmawi, A.A.; Song, H.; Ashraf, I. Deep Learning-Based Intrusion Detection Methods in Cyber-Physical Systems: Challenges and Future Trends. Electronics; 2022; 11, 3326. [DOI: https://dx.doi.org/10.3390/electronics11203326]
46. Ding, D.; Han, Q.-L.; Xiang, Y.; Ge, X.; Zhang, X.-M. A survey on security control and attack detection for industrial cyber-physical systems. Neurocomputing; 2018; 275, pp. 1674-1683. [DOI: https://dx.doi.org/10.1016/j.neucom.2017.10.009]
47. Jeffrey, N.; Tan, Q.; Villar, J.R. A Review of Anomaly Detection Strategies to Detect Threats to Cyber-Physical Systems. Electronics; 2023; 12, 3283. [DOI: https://dx.doi.org/10.3390/electronics12153283]
48. Khalid, A.; Zainal, A.; Maarof, M.A.; Ghaleb, F.A. Advanced Persistent Threat Detection: A Survey. Proceedings of the 2021 3rd International Cyber Resilience Conference (CRC); Virtual, 29–31 January 2021; pp. 1-6.
49. Eke, H.N.; Petrovski, A. Advanced Persistent Threats Detection based on Deep Learning Approach. Proceedings of the 2023 IEEE 6th International Conference on Industrial Cyber-Physical Systems (ICPS); Wuhan, China, 8–11 May 2023; pp. 1-10.
50. Collins, S.; McCombie, S. Stuxnet: The emergence of a new cyber weapon and its implications. J. Polic. Intell. Count. Terror.; 2012; 7, pp. 80-91. [DOI: https://dx.doi.org/10.1080/18335330.2012.653198]
51. Farooq, M.J.; Zhu, Q. IoT Supply Chain Security: Overview, Challenges, and the Road Ahead. arXiv; 2019; arXiv: 1908.07828
52. Eke, H.N.; Petrovski, A.; Ahriz, H. The use of machine learning algorithms for detecting advanced persistent threats. Proceedings of the 2019 International Conference on Computational Science and Computational Intelligence (CSCI); Las Vegas, NV, USA, 5–7 December 2019.
53. Gan, C.; Lin, J.; Huang, D.-W.; Zhu, Q.; Tian, L. Advanced Persistent Threats and Their Defense Methods in Industrial Internet of Things: A Survey. Mathematics; 2023; 11, 3115. [DOI: https://dx.doi.org/10.3390/math11143115]
54. Ghafir, I.; Prenosil, V. Proposed Approach for Targeted Attacks Detection. Advanced Computer and Communication Engineering Technology; Springer: Berlin/Heidelberg, Germany, 2016; pp. 73-80.
55. Gan, C.; Lin, J.; Huang, D.-W.; Zhu, Q.; Tian, L. Robotics cyber security: Vulnerabilities, attacks, countermeasures, and recommendations. Int. J. Inf. Secur.; 2022; 21, pp. 1-14.
56. Dudek, W.; Szynkiewicz, W. Cyber-security for mobile service robots–challenges for cyber-physical system safety. J. Telecommun. Inf. Technol.; 2019; 2, pp. 29-36. [DOI: https://dx.doi.org/10.26636/jtit.2019.131019]
57. Marali, M.; Sudarsan, S.D. Graceful Reincarnation of Legacy Industrial Control Systems. Proceedings of the 2018 IEEE 3rd International Conference on Computing, Communication and Security (ICCCS); Kathmandu, Nepal, 25–27 October 2018; pp. 224-229.
58. Duque Antón, S.D.; Schotten, H.D. Putting Together the Pieces: A Concept for Holistic Industrial Intrusion Detection. arXiv; 2019; arXiv: 1905.11701
59. Rakas, S.V.B.; Stojanović, M.D.; Marković-Petrović, J.D. A Review of Research Work on Network-Based SCADA Intrusion Detection Systems. IEEE Access; 2020; 8, pp. 93083-93108. [DOI: https://dx.doi.org/10.1109/ACCESS.2020.2994961]
60. Abdullah, N.S.; Sadiq, S.; Indulska, M. Information systems research: Aligning to industry challenges in management of regulatory compliance. Proceedings of the Pacific Asia Conference on Information Systems (PACIS); Taipei, Taiwan, 9–12 July 2010; 36.
61. Cunha, J.; Batista, N.; Cardeira, C.; Melicio, R. Upgrading a Legacy Manufacturing Cell to IoT. J. Sens. Actuator Netw.; 2021; 10, 65. [DOI: https://dx.doi.org/10.3390/jsan10040065]
62. Papadogiannaki, E.; Chrysos, G.; Georgopoulos, K.; Ioannidis, S. A Reconfigurable IDS Framework for Encrypted and Non-Encrypted Network Data in Supply Chains. Proceedings of the 2023 International Conference on Engineering and Emerging Technologies (ICEET); Istanbul, Turkiye, 27–28 October 2023; pp. 1-6.
63. de Moura, R.L.; Gonzalez, A.; Franqueira, V.N.L.; Maia Neto, A.L. A Cyber-Security Strategy for Internationally-dispersed Industrial Networks. Proceedings of the 2020 International Conference on Computational Science and Computational Intelligence (CSCI); Las Vegas, NV, USA, 16–18 December 2020; pp. 62-68.
64. Nygård, A.R.; Katsikas, S. SoK: Combating Threats in the Digital Supply Chain; Association for Computing Machinery: New York, NY, USA, 2022; 128.
65. Ciocarlie, G.F.; Zhou, J. Securing Critical Infrastructure Across Cyber and Physical Dimensions. IEEE Secur. Priv.; 2023; 21, 9. [DOI: https://dx.doi.org/10.1109/MSEC.2023.3282424]
66. Nuaimi, M.; Chaari, L.; Hamed, B.B. Intelligent approaches toward intrusion detection systems for Industrial Internet of Things: A systematic comprehensive review. J. Netw. Comput. Appl.; 2023; 215, 103637. [DOI: https://dx.doi.org/10.1016/j.jnca.2023.103637]
67. Mayoral-Vilches, V. Robot Cybersecurity, a Review. Int. J. Cyber Forensics Adv. Threat. Investig.; 2022; 3, 41.
68. Marotta, A.; Madnick, S. Analyzing the Interplay Between Regulatory Compliance and Cybersecurity (Revised); MIT Sloan School of Management, Cybersecurity Interdisciplinary Systems Laboratory (CISL): Cambridge, MA, USA, 2020.
69. Santoso, F.; Finn, A. An In-Depth Examination of Artificial Intelligence-Enhanced Cybersecurity in Robotics, Autonomous Systems, and Critical Infrastructures. IEEE Trans. Serv. Comput.; 2024; 17, pp. 1293-1310. [DOI: https://dx.doi.org/10.1109/TSC.2023.3331083]
70. Abbas, W.; Laszka, A.; Vorobeychik, Y.; Koutsoukos, X. Scheduling Intrusion Detection Systems in Resource-Bounded Cyber-Physical Systems. Proceedings of the First ACM Workshop on Cyber-Physical Systems-Security and/or Privacy; Denver, CO, USA, 16 October 2015; pp. 55-66.
71. Vuong, T.P.; Loukas, G.; Gan, D.; Bezemskij, A. Decision tree-based detection of denial of service and command injection attacks on robotic vehicles. Proceedings of the 2015 IEEE International Workshop on Information Forensics and Security (WIFS); Rome, Italy, 16–19 November 2015; pp. 1-6.
72. Hassanzadeh, A.; Xu, Z.; Stoleru, R.; Gu, G.; Polychronakis, M. PRIDE: Practical Intrusion Detection in Resource Constrained Wireless Mesh Networks. Information and Communications Security; Springer: Berlin/Heidelberg, Germany, 2013; pp. 213-228.
73. Asulba, B.A.; Schumacher, N.; Souto, P.F.; Almeida, L.; Santos, P.M.; Martins, N.; Sousa, J. Impact of Training Set Size on Resource Usage of Machine Learning Models for IoT Network Intrusion Detection. Proceedings of the 2023 19th International Conference on Distributed Computing in Smart Systems and the Internet of Things (DCOSS-IoT); Pafos, Cyprus, 19–21 June 2023; pp. 330-337.
74. Amaral, J.P.; Oliveira, L.M.; Rodrigues, J.J.P.C.; Han, G.; Shu, L. Policy and network-based intrusion detection system for IPv6-enabled wireless sensor networks. Proceedings of the 2014 IEEE International Conference on Communications (ICC); Sydney, Australia, 10–14 June 2014; pp. 1796-1801.
75. Hamouda, D.; Ferrag, M.A.; Benhamida, N.; Seridi, H. Intrusion Detection Systems for Industrial Internet of Things: A Survey. Proceedings of the 2021 International Conference on Theoretical and Applicative Aspects of Computer Science (ICTAACS); Skikda, Algeria, 15–16 December 2021; pp. 1-8.
76. Arnaboldi, L.; Morisset, C. A review of intrusion detection systems and their evaluation in the IoT. arXiv; 2021; arXiv: 2105.08096
77. Kang, Q.; Gu, Y. A Survey on Ransomware Threats: Contrasting Static and Dynamic Analysis Methods. J. Cybersecur. Res.; 2023; 2023110798. [DOI: https://dx.doi.org/10.20944/preprints202311.0798.v1]
78. Abed, M.S.; Al-Doori, Q.F.; Abdullah, A.T.; Abdallah, A.A. Security Vulnerabilities and Threats in Robotic Systems: A Comprehensive Review. Int. J. Saf. Secur. Eng.; 2023; 13, 3. [DOI: https://dx.doi.org/10.18280/ijsse.130318]
79. Tavallaee, M.; Bagheri, E.; Lu, W.; Ghorbani, A.A. A detailed analysis of the KDD CUP 99 data set. Proceedings of the 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications (CISDA); Ottawa, ON, Canada, 8–10 July 2009; pp. 1-6.
80. Shiravi, A.; Shiravi, H.; Tavallaee, M.; Ghorbani, A.A. Toward developing a systematic approach to generate benchmark datasets for intrusion detection. Comput. Secur.; 2012; 31, pp. 357-374. [DOI: https://dx.doi.org/10.1016/j.cose.2011.12.012]
81. Mathur, A.P.; Tippenhauer, N.O. SWaT: A water treatment testbed for research and training on ICS security. Proceedings of the 2016 International Workshop on Cyber-Physical Systems for Smart Water Networks (CySWater); Vienna, Austria, 11 April 2016; pp. 31-36.
82. Sharafaldin, I.; Lashkari, A.H.; Ghorbani, A.A. Toward generating a new intrusion detection dataset and intrusion traffic characterization. Proceedings of the 2018 International Conference on Information Systems Security and Privacy (ICISSp); Funchal, Portugal, 22–24 January 2018; pp. 108-116.
83. Maciá-Fernández, G.; Camacho, J.; Magán-Carrión, R.; García-Teodoro, P.; Therón, R. UGR ‘16: A new dataset for the evaluation of cyclostationarity-based network IDSs. Comput. Secur.; 2018; 73, pp. 411-424. [DOI: https://dx.doi.org/10.1016/j.cose.2017.11.004]
84. Taormina, R.; Galelli, S. Deep-learning approach to the detection and localization of cyber-physical attacks on water distribution systems. J. Water Resour. Plan. Manag.; 2018; 144, 04018065. [DOI: https://dx.doi.org/10.1061/(ASCE)WR.1943-5452.0000983]
85. Zolanvari, M.; Teixeira, M.A.; Gupta, L.; Khan, K.M.; Jain, R. Machine learning-based network vulnerability analysis of industrial Internet of Things. IEEE Internet Things J.; 2019; 6, pp. 6822-6834. [DOI: https://dx.doi.org/10.1109/JIOT.2019.2912022]
86. Alsaedi, A.; Moustafa, N.; Tari, Z.; Mahmood, A.; Anwar, A. TON_IoT telemetry dataset: A new generation dataset of IoT and IIoT for data-driven intrusion detection systems. IEEE Access; 2020; 8, pp. 165130-165150. [DOI: https://dx.doi.org/10.1109/ACCESS.2020.3022862]
87. Belenguer, A.; Navaridas, J.; Pascual, J.A. A review of Federated Learning in Intrusion Detection Systems for IoT. arXiv; 2022; arXiv: 2204.12443
88. Alazab, A.; Khraisat, A.; Singh, S.; Jan, T.; Alazab, M. Enhancing Privacy-Preserving Intrusion Detection through Federated Learning. Electronics; 2023; 12, 3382. [DOI: https://dx.doi.org/10.3390/electronics12163382]
89. Rashid, M.M.; Khan, S.U.; Eusufzai, F.; Redwan, M.A.; Sabuj, S.R.; Elsharief, M. A Federated Learning-Based Approach for Improving Intrusion Detection in Industrial Internet of Things Networks. Network; 2023; 3, pp. 158-179. [DOI: https://dx.doi.org/10.3390/network3010008]
90. Fedorchenko, E.; Novikova, E.; Shulepov, A. Comparative Review of the Intrusion Detection Systems Based on Federated Learning: Advantages and Open Challenges. Algorithms; 2022; 15, 247. [DOI: https://dx.doi.org/10.3390/a15070247]
91. Shibly, K.H.; Hossain, M.D.; Inoue, H.; Taenaka, Y.; Kadobayashi, Y. Personalized Federated Learning for Automotive Intrusion Detection Systems. Proceedings of the 2022 IEEE Future Networks World Forum (FNWF); Montreal, QC, Canada, 12–14 October 2022; pp. 544-549.
92. Han, W.; Peng, J.; Yu, J.; Kang, J.; Lu, J.; Niyato, D. Heterogeneous Data-Aware Federated Learning for Intrusion Detection Systems via Meta-sampling in Artificial Intelligence of Things. IEEE Internet Things J.; 2023; 11, pp. 13340-13354. [DOI: https://dx.doi.org/10.1109/JIOT.2023.3337755]
93. Xu, H.; Wang, S.; Li, N.; Wang, K.; Zhao, Y.; Chen, K.; Yu, T.; Liu, Y.; Wang, H. Large Language Models for Cyber Security: A Systematic Literature Review. arXiv; 2024; arXiv: 2405.04760
94. Lira, O.G.; Marroquin, A.; To, M.A. Harnessing the Advanced Capabilities of LLM for Adaptive Intrusion Detection Systems. Proceedings of the International Conference on Advanced Information Networking and Applications; Fukuoka, Japan, 25–28 March 2024.
95. Lai, H. Intrusion Detection Technology Based on Large Language Models. Proceedings of the 2023 International Conference on Evolutionary Algorithms and Soft Computing Techniques (EASCT); Wuhan, China, 15–17 May 2023; pp. 1-5.
96. Ali, T.; Kostakos, P. HuntGPT: Integrating Machine Learning-Based Anomaly Detection and Explainable AI with Large Language Models (LLMs). arXiv; 2023; arXiv: 2309.16021
97. Guastalla, M.; Li, Y.; Hekmati, A.; Krishnamachari, B. Application of Large Language Models to DDoS Attack Detection. Proceedings of the SmartSP Conference; Paris, France, 6–8 June 2023.
98. Nicesio, O.K.; Leal, A.G.; Gava, V.L. Quantum Machine Learning for Network Intrusion Detection Systems, a Systematic Literature Review. Proceedings of the 2023 IEEE 2nd International Conference on AI in Cybersecurity (ICAIC); Los Angeles, CA, USA, 14–16 March 2023; pp. 1-6.
99. Shaik, N.; Harichandana, D.B.; Chitralingappa, D.P. Quantum Computing and Machine Learning: Transforming Network Security. Int. J. Adv. Res. Sci. Commun. Technol.; 2024; pp. 500-509. [DOI: https://dx.doi.org/10.48175/IJARSCT-18679]
100. Rahman, M.A.; Shahriar, H.; Clincy, V.A.; Hossain, M.F.; Rahman, M.A. A Quantum Generative Adversarial Network-based Intrusion Detection System. Proceedings of the 2023 IEEE 47th Annual Computers, Software, and Applications Conference (COMPSAC); Turin, Italy, 20–24 June 2023; pp. 1810-1815.
101. Issac K Varghese, E.A. Blockchain Technology in the Intrusion Detection Domain. Int. J. Recent Innov. Trends Comput. Commun.; 2023; 11, pp. 1731-1740. [DOI: https://dx.doi.org/10.17762/ijritcc.v11i10.8748]
102. Shalabi, K.; Al-Haija, Q.A.; Al-Fayoumi, M. A Blockchain-based Intrusion Detection/Prevention Systems in IoT Network: A Systematic Review. Procedia Computer Science; Elsevier: Amsterdam, The Netherlands, 2024.
103. Kaur, A.; Pawar, S.; Jore, N.; Chavan, V.; Mule, N. Intrusion Detection System using Blockchain. Int. J. Res. Appl. Sci. Eng. Technol.; 2024; [DOI: https://dx.doi.org/10.22214/ijraset.2024.58361]
104. Varghese, S.A.; Dehlaghi Ghadim, A.; Balador, A.; Alimadadi, Z.; Papadimitratos, P. Digital Twin-based Intrusion Detection for Industrial Control Systems. Proceedings of the 2022 IEEE International Conference on Pervasive Computing and Communications Workshops and Other Affiliated Events (PerCom Workshops); Pisa, Italy, 21–25 March 2022; pp. 611-617.
105. Lipsa, S.; Dash, R.K. A novel intrusion detection system based on deep learning and random forest for digital twin on IoT platform. Int. J. Sch. Res. Eng. Technol.; 2023; 2, pp. 51-64.
© 2024 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/). Notwithstanding the ProQuest Terms and Conditions, you may use this content in accordance with the terms of the License.
Details
; Odeyomi, Olusola 1
; Sun, Yi 2
; Kaushik, Roy 1 1 Department of Computer Science, North Carolina Agricultural and Technical State University, Greensboro, NC 27411, USA;
2 Department of Mechanical Engineering, North Carolina Agricultural and Technical State University, Greensboro, NC 27411, USA