In critical infrastructure, the convergence of physical systems with digital networks forms complex Cyber-Physical Systems (CPS), that are vulnerable to threats compromising both data and physical operations. Traditional security systems, often focused solely on network traffic, create a significant security gap by neglecting the rich contextual data provided by physical sensors. To address this issue, the paper introduces a novel unsupervised multimodal framework that synthesizes data from these dual sources for holistic anomaly detection. The proposed architecture combines pre-trained Variational Autoencoder-Long Short-Term Memory (VAE-LSTM) networks to model temporal dependencies with a dual cross-attention mechanism for deep fusion of latent representations. To enhance the detection of subtle, low-observability threats, the model is further regularized through adversarial training using a discriminator that distinguishes between original and reconstructed data. Evaluated on the comprehensive SWAT dataset, the model successfully identifies 24 out of 26 relevant attack scenarios using 10-second time sequences and achieves an Area Under the Curve (AUC) of 0.87, outperforming unimodal benchmarks. This work validates the critical importance of deep data fusion and presents a more resilient, context-aware defense mechanism for modern CPS.

Managing the lifecycle of cybersecurity policies from high-level governance documents to low-level technical implementation remains prone to human error and operational inefficiency. With the rapid evolution of Infrastructure as Code (IaC) and the increasing volume of regulatory standards, there is a critical need for automated methods to bridge the gap between "what is written" (Policy) and "what is executed" (Practice). This systematic literature review examines the state of the art in Artificial Intelligence (AI) and Natural Language Processing (NLP) techniques for automating cybersecurity knowledge management. This study was conducted in accordance with the PRISMA 2020 statement for reporting systematic reviews. We systematically identified and analyzed 55 peer-reviewed studies published between 2020 and 2025, selected from an initial corpus of 230 papers sourced from IEEE, ACM Digital Library, Scopus, ScienceDirect, and Springer Journals. Our analysis reveals a transition from discriminative information extraction to hybrid architectures integrating deep learning-driven extraction with symbolic logic formalisms for verified knowledge graph construction. We categorize existing approaches into four key themes: (1) Automated Policy Extraction, (2) Knowledge Graph Construction, (3) Policy-as-Code Compliance, and (4) Dynamic Threat Translation. The review identifies a significant gap in "neuro-symbolic" verification methods capable of mitigating stochastic failure modes and hallucination risks inherent in probabilistic LLM-driven compliance pipelines, outlining a roadmap for future research in automated security governance. Beyond a descriptive summary, this review provides a critical comparative analysis of extraction accuracy, reasoning scalability, and the risks inherent in Large Language Model (LLM) approaches.

Critical infrastructures (CI) are essential to modern society, providing vital services such as energy, water, and transportation. However, these systems are increasingly targeted by sophisticated cyberattacks, exploiting vulnerabilities in both IT (Information Technology) and OT (Operational Technology) environments, posing significant risks to safety, economic stability, and national security. Despite advancements, current anomaly detection models for CI often cannot effectively integrate diverse data sources or provide detailed attack classifications. To address these challenges, we propose a novel Graph Convolutional Network (GCN) model integrated with Long Short-Term Memory (LSTM) layers for effective anomaly detection and attack classification in CI. The model leverages Cyber Threat Intelligence (CTI) and MITRE ATT&CK techniques, integrating network traffic and physical device data to enhance detection of sophisticated threats. Unlike approaches using binary classification, our model performs multiclass classification to recognize specific attack types, bridging the gap in understanding complex attack patterns within CI. By incorporating Indicators of Compromise (IoCs) from MISP (Malware Information Sharing Platform) with the SWAT (Secure Water Treatment) dataset, we developed a graph-based data structure where nodes represent entities like SCADA tags and IP addresses. The model processes this dynamic graph using convolutional layers for spatial feature extraction and LSTM layers for temporal dependencies. Results indicate a significant improvement over existing solutions, achieving a test accuracy of 99.04% and a macro F1-score of 0.9151. The integration of multiple data sources enhances the model’s capacity to handle evolving cyber threats, making it well-suited for protecting CI.