Industrial control systems (ICSs), supervisory control and data acquisition (SCADA) systems, and distributed control systems (DCSs) are fundamental components of critical infrastructure (CI). CI supports the operation of transportation and health systems, electric and thermal plants, and water treatment facilities, among others. These infrastructures are not insulated anymore, and their connection to fourth industrial revolution technologies has expanded the attack surface. Thus, their protection has become a priority for national security. Cyber-attacks have become more sophisticated and criminals are able to surpass conventional security systems; therefore, attack detection has become a challenging area. Defensive technologies such as intrusion detection systems (IDSs) are a fundamental part of security systems to protect CI. IDSs have incorporated machine learning (ML) techniques that can deal with broader kinds of threats. Nevertheless, the detection of zero-day attacks and having technological resources to implement purposed solutions in the real world are concerns for CI operators. This survey aims to provide a compilation of the state of the art of IDSs that have used ML algorithms to protect CI. It also analyzes the security dataset used to train ML models. Finally, it presents some of the most relevant pieces of research on these topics that have been developed in the last five years.

Traditional security detection methods face challenges in identifying zero-day attacks in critical infrastructures (CIs) integrated with the industrial internet of things (IIoT). These attacks exploit unknown vulnerabilities and are difficult to detect due to their connection to physical systems. The integration of legacy ICS networks with modern computing and networking technologies has significantly expanded the attack surface, making these systems more susceptible to cyber-attacks. Despite existing security measures, attackers continually find ways to breach these operating networks. Anomaly detection systems are critical in protecting these CIs from current cyber threats. This study investigates the effectiveness of unsupervised anomaly detection models in detecting operational anomalies that could lead to cyber-attacks, thereby disrupting and negatively impacting quality of life. We preprocess the data with a focus on cybersecurity and chose the SWAT dataset because it accurately represents the types of attack vectors that critical infrastructures commonly encounter. We evaluated the performance of isolation forest (IF), local outlier factor (LOF), one-class SVM (OCSVM), and Autoencoder algorithms—trained exclusively on normal data—in enhancing cybersecurity within IIoT environments. Our comprehensive analysis includes an assessment of each model’s detection capabilities. The findings highlight the VAE-LSTM model’s potential to identify cyber-attacks within seconds in a high-frequency dataset, suggesting near real-time detection capability. The final model combines the reconstruction ability of the variational autoencoder (VAE) with regularization using the Kullback–Leibler divergence, reflecting the non-Gaussian nature of industrial system data. Our model successfully detected 23 out of 26 attack scenarios in the SWAT dataset, demonstrating its effectiveness in improving the security of IIoT-based CIs.

In critical infrastructure, the convergence of physical systems with digital networks forms complex Cyber-Physical Systems (CPS), that are vulnerable to threats compromising both data and physical operations. Traditional security systems, often focused solely on network traffic, create a significant security gap by neglecting the rich contextual data provided by physical sensors. To address this issue, the paper introduces a novel unsupervised multimodal framework that synthesizes data from these dual sources for holistic anomaly detection. The proposed architecture combines pre-trained Variational Autoencoder-Long Short-Term Memory (VAE-LSTM) networks to model temporal dependencies with a dual cross-attention mechanism for deep fusion of latent representations. To enhance the detection of subtle, low-observability threats, the model is further regularized through adversarial training using a discriminator that distinguishes between original and reconstructed data. Evaluated on the comprehensive SWAT dataset, the model successfully identifies 24 out of 26 relevant attack scenarios using 10-second time sequences and achieves an Area Under the Curve (AUC) of 0.87, outperforming unimodal benchmarks. This work validates the critical importance of deep data fusion and presents a more resilient, context-aware defense mechanism for modern CPS.

The proliferation of Cyber-Physical Systems (CPS) across critical infrastructure has created an unprecedented attack surface where digital threats may precipitate catastrophic physical consequences. As conventional centralized security paradigms fail to address the scale and complexity of these environments, Federated Learning (FL) has emerged as a transformative approach, enabling collaborative, edge-native anomaly detection without centralizing sensitive data. This paper presents a comprehensive survey and critical analysis of the state-of-the-art in securing CPS through advanced FL. We introduce a novel multi-axis taxonomy that systematically categorizes the field by architecture, detection methodology, application domain, and privacy-preservation scheme. Building on this analysis, we synthesize these findings into a prescriptive framework to guide the selection of appropriate security archetypes for different CPS domains. Through this lens, we deconstruct the—the trade-off between accuracy, communication, and privacy- that governs every FL design. Our analysis synthesizes the dominant trends, including the convergence of deep learning with edge computing and the increasing sophistication of privacy-enhancing technologies. We further identify critical research gaps, including the scarcity of physical testbeds, limited resilience against advanced adversarial attacks, and underdeveloped explainability. The paper concludes by defining the critical frontiers for future research, emphasizing the need to resolve the inherent tension between FL’s privacy goals and the transparency requirements of Explainable AI (XAI) to build truly trustworthy systems.

Managing the lifecycle of cybersecurity policies from high-level governance documents to low-level technical implementation remains prone to human error and operational inefficiency. With the rapid evolution of Infrastructure as Code (IaC) and the increasing volume of regulatory standards, there is a critical need for automated methods to bridge the gap between "what is written" (Policy) and "what is executed" (Practice). This systematic literature review examines the state of the art in Artificial Intelligence (AI) and Natural Language Processing (NLP) techniques for automating cybersecurity knowledge management. This study was conducted in accordance with the PRISMA 2020 statement for reporting systematic reviews. We systematically identified and analyzed 55 peer-reviewed studies published between 2020 and 2025, selected from an initial corpus of 230 papers sourced from IEEE, ACM Digital Library, Scopus, ScienceDirect, and Springer Journals. Our analysis reveals a transition from discriminative information extraction to hybrid architectures integrating deep learning-driven extraction with symbolic logic formalisms for verified knowledge graph construction. We categorize existing approaches into four key themes: (1) Automated Policy Extraction, (2) Knowledge Graph Construction, (3) Policy-as-Code Compliance, and (4) Dynamic Threat Translation. The review identifies a significant gap in "neuro-symbolic" verification methods capable of mitigating stochastic failure modes and hallucination risks inherent in probabilistic LLM-driven compliance pipelines, outlining a roadmap for future research in automated security governance. Beyond a descriptive summary, this review provides a critical comparative analysis of extraction accuracy, reasoning scalability, and the risks inherent in Large Language Model (LLM) approaches.