Industrial Control Systems (ICS) and Cyber–Physical Systems (CPS) are critical infrastructures supporting national sectors, where cyberattacks can directly cause physical process disruptions and safety incidents. Following PRISMA 2020 guidelines, we systematically searched Web of Science, Scopus, IEEE Xplore, and the ACM Digital Library for studies published between 1 January 2021 and 31 October 2025, and finally included 89 primary studies. The literature is categorized into five data modalities—network traffic, operational data, simulation data, hybrid data, and other auxiliary data—and compared in terms of detection objectives, learning paradigms, model families, attack types, and datasets. The analysis shows that network data are effective for detecting cyber-layer attacks such as reconnaissance, DoS, and MITM, while operational data are suited for physical-layer anomalies including process disturbances, FDI, and stealth deviations. Simulation and hybrid data further support rare-scenario generation and cyber–physical consistency checking. However, limitations remain, including reliance on few benchmarks, lack of realistic multi-domain datasets, label sparsity, concept drift, and insufficient consideration of real-time and resource-constrained OT environments. Based on these findings, this review highlights future directions such as multi-domain dataset development, physics- and control-informed model design, hybrid-data-driven integrated detection, and lightweight edge deployment.

The growing demand for communication technology capable of providing high transmission rates in maritime environments has led to the exploration of the very high frequency (VHF) data exchange system (VDES) as a promising solution. The VDES, the integration of an automatic identification system (AIS), application-specific messaging (ASM), and VHF data exchange (VDE), offers improved transmission rates and stable connections compared with existing technologies. Although the VDES supports high transmission rates through various modulation and coding scheme (MCS) technologies, it lacks a standardized mechanism for controlling MCS parameters and relies on user algorithms for operation. In this paper, we introduce the maritime auto-rate fall-back (mARF) technology, designed to effectively address the challenges of maritime communication scenarios using the MCS framework provided by the VDES. mARF technology incorporates fast drop-out and recovery mechanisms to swiftly adapt to changing MCS types in the presence of deep nulls, a common occurrence in maritime communication environments. These adaptive thresholds for fast drop-out and recovery operations are dynamically learned using historical communication data. Through extensive simulations, we demonstrate the effectiveness of mARF in enhancing the MCS control capabilities of the VDES. Our results show a significant performance improvement of 18% compared to the existing model, validating the potential of mARF in optimizing maritime communication channels and supporting a high transmission rate.

KSII Transactions on Internet and Information Systems TIIS Paper Details

The maritime industry is undergoing a paradigm shift driven by rapid advancements in wireless communication and an increase in maritime traffic data. However, the existing automatic identification system (AIS) struggles to accommodate the increasing maritime traffic data, leading to the introduction of the very-high-frequency (VHF) data exchange system (VDES). While the VDES increases bandwidth and data rates, ensuring the stable transmission of maritime IoT (MIoT) application data in congested coastal areas remains a challenge due to frequent collisions of AIS messages. This paper presents a slot occupancy-based collision avoidance algorithm (SOCA) for a VDES network in the MIoT. SOCA is designed to mitigate the impact of interference caused by transmissions of AIS messages on transmissions of VDE-Terrestrial (VDE-TER) data in coastal areas. To this end, SOCA provides four steps: (1) construction of the neighbor information table (NIT) and VDES frame maps, (2) construction of the candidate slot list, (3) TDMA channel selection, and (4) slot selection for collision avoidance. SOCA operates by constructing the NIT based on AIS messages to estimate the transmission intervals of AIS messages and updating VDES frame maps upon receiving VDES messages to monitor slot usage dynamically. After that, it generates a candidate slot list for VDE-TER channels, classifying the slots into interference and non-interference categories. SOCA then selects a TDMA channel that minimizes AIS interference and allocates slots with low expected occupancy probabilities to avoid collisions. To evaluate the performance of SOCA, we conducted experimental simulations under static and dynamic ship scenarios. In the static ship scenario, SOCA outperforms the existing VDES, achieving improvements of 13.58% in aggregate throughput, 11.50% in average latency, 33.60% in collision ratio, and 22.64% in packet delivery ratio. Similarly, in the dynamic ship scenario, SOCA demonstrates improvements of 7.30%, 11.99%, 39.27%, and 11.82% in the same metrics, respectively.