Cyber Attack Identification in Industrial Control Systems: A Review of Dynamic Watermarking and Machine Learning Applications

Industrial control systems (ICS) are fundamental to critical infrastructures such as electrical grids, water processing plants, and manufacturing plant, where Programmable Logic Controllers (PLCs) and Supervisory Control and Data Acquisition (SCADA) systems regulate physical processes that cannot stop operating at ease. These formerly isolated systems acquire a greater variety of challenges as they become interconnected with IT networks, including command-injection, replay, and false-data injection attacks that may actually result in serious physical harm in addition to some data loss. Two defense methods that have been evolved are discussed in this review. By integrating a private random signal on the control command, dynamic watermarking (DW) takes on an active, physics-based approach resulting in any anomaly in the sensor-actuator feedback loop becoming statistically visible. In contrast, machine learning (ML) approaches try to learn what malicious behavior appears from data. We keep track of the innovations in both directions to distinguish their supplementing powers and blind spots, as well as look at the simple but growing set of work that attempts to bring them together. Also we employed the case studies from PLC-controlled water-tank testbeds, networked control systems, and power-system automatic generation control. The paper ends by discussing the barriers that prevent these research findings from being put into practice, including the ability to scale, adversarial robustness, and real-time deployment on legacy PLC hardware. Keywords: machine learning; Anomaly detection; Intrusion Detection; Cyber-Physical Systems; SCADA; Programmable Logic Controller; Dynamic Watermarking; Industrial Control System