{"id":"https://openalex.org/W4416424431","doi":"https://doi.org/10.1007/s10207-025-01158-1","title":"Towards enhanced cybersecurity in industrial control systems: a systematic review of context-based modeling, digital twins, and machine learning approaches","display_name":"Towards enhanced cybersecurity in industrial control systems: a systematic review of context-based modeling, digital twins, and machine learning approaches","publication_year":2025,"publication_date":"2025-11-20","ids":{"openalex":"https://openalex.org/W4416424431","doi":"https://doi.org/10.1007/s10207-025-01158-1"},"language":"en","primary_location":{"id":"doi:10.1007/s10207-025-01158-1","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10207-025-01158-1","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10207-025-01158-1.pdf","source":{"id":"https://openalex.org/S164062316","display_name":"International Journal of Information Security","issn_l":"1615-5262","issn":["1615-5262","1615-5270"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Information Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://link.springer.com/content/pdf/10.1007/s10207-025-01158-1.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5058655666","display_name":"Doney Abraham","orcid":"https://orcid.org/0000-0002-5760-5241"},"institutions":[{"id":"https://openalex.org/I204778367","display_name":"Norwegian University of Science and Technology","ror":"https://ror.org/05xg72x27","country_code":"NO","type":"education","lineage":["https://openalex.org/I204778367"]}],"countries":["NO"],"is_corresponding":true,"raw_author_name":"Doney Abraham","raw_affiliation_strings":["Norwegian University of Science and Technology, Gj\u00f8vik, Norway"],"affiliations":[{"raw_affiliation_string":"Norwegian University of Science and Technology, Gj\u00f8vik, Norway","institution_ids":["https://openalex.org/I204778367"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5044303026","display_name":"Gizem Erceylan","orcid":"https://orcid.org/0000-0002-2745-9327"},"institutions":[{"id":"https://openalex.org/I204778367","display_name":"Norwegian University of Science and Technology","ror":"https://ror.org/05xg72x27","country_code":"NO","type":"education","lineage":["https://openalex.org/I204778367"]}],"countries":["NO"],"is_corresponding":false,"raw_author_name":"Gizem Erceylan","raw_affiliation_strings":["Norwegian University of Science and Technology, Gj\u00f8vik, Norway"],"affiliations":[{"raw_affiliation_string":"Norwegian University of Science and Technology, Gj\u00f8vik, Norway","institution_ids":["https://openalex.org/I204778367"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5071334624","display_name":"Vasileios Gkioulos","orcid":"https://orcid.org/0000-0001-7304-3835"},"institutions":[{"id":"https://openalex.org/I204778367","display_name":"Norwegian University of Science and Technology","ror":"https://ror.org/05xg72x27","country_code":"NO","type":"education","lineage":["https://openalex.org/I204778367"]}],"countries":["NO"],"is_corresponding":false,"raw_author_name":"Vasileios Gkioulos","raw_affiliation_strings":["Norwegian University of Science and Technology, Gj\u00f8vik, Norway"],"affiliations":[{"raw_affiliation_string":"Norwegian University of Science and Technology, Gj\u00f8vik, Norway","institution_ids":["https://openalex.org/I204778367"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5019231096","display_name":"Siv Hilde Houmb","orcid":"https://orcid.org/0000-0003-1897-5132"},"institutions":[{"id":"https://openalex.org/I204778367","display_name":"Norwegian University of Science and Technology","ror":"https://ror.org/05xg72x27","country_code":"NO","type":"education","lineage":["https://openalex.org/I204778367"]},{"id":"https://openalex.org/I2800643029","display_name":"Association for Symbolic Logic","ror":"https://ror.org/00baryp08","country_code":"US","type":"other","lineage":["https://openalex.org/I2800643029"]},{"id":"https://openalex.org/I4210121836","display_name":"Norwegian Defence University College","ror":"https://ror.org/02vfz9j23","country_code":"NO","type":"education","lineage":["https://openalex.org/I2802841409","https://openalex.org/I4210121836"]}],"countries":["NO","US"],"is_corresponding":false,"raw_author_name":"Siv Hilde Houmb","raw_affiliation_strings":["Houmb AS, Brumunddal, Norway","Norwegian Defence Cyber Academy, Lillehammer, Norway","Norwegian University of Science and Technology, Gj\u00f8vik, Norway"],"affiliations":[{"raw_affiliation_string":"Houmb AS, Brumunddal, Norway","institution_ids":["https://openalex.org/I2800643029"]},{"raw_affiliation_string":"Norwegian Defence Cyber Academy, Lillehammer, Norway","institution_ids":["https://openalex.org/I4210121836"]},{"raw_affiliation_string":"Norwegian University of Science and Technology, Gj\u00f8vik, Norway","institution_ids":["https://openalex.org/I204778367"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5058655666"],"corresponding_institution_ids":["https://openalex.org/I204778367"],"apc_list":{"value":2590,"currency":"EUR","value_usd":3190},"apc_paid":{"value":2590,"currency":"EUR","value_usd":3190},"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.43370551,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"24","issue":"6","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.9247000217437744,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.9247000217437744,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10763","display_name":"Digital Transformation in Industry","score":0.024299999698996544,"subfield":{"id":"https://openalex.org/subfields/2209","display_name":"Industrial and Manufacturing Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11807","display_name":"Infrastructure Resilience and Vulnerability Analysis","score":0.008299999870359898,"subfield":{"id":"https://openalex.org/subfields/2205","display_name":"Civil and Structural Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/industrial-control-system","display_name":"Industrial control system","score":0.6097000241279602},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.5834000110626221},{"id":"https://openalex.org/keywords/situation-awareness","display_name":"Situation awareness","score":0.5181999802589417},{"id":"https://openalex.org/keywords/control","display_name":"Control (management)","score":0.41620001196861267},{"id":"https://openalex.org/keywords/critical-infrastructure","display_name":"Critical infrastructure","score":0.4101000130176544},{"id":"https://openalex.org/keywords/industrial-internet","display_name":"Industrial Internet","score":0.40849998593330383},{"id":"https://openalex.org/keywords/cyber-physical-system","display_name":"Cyber-physical system","score":0.3553999960422516}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7452999949455261},{"id":"https://openalex.org/C40071531","wikidata":"https://www.wikidata.org/wiki/Q2513962","display_name":"Industrial control system","level":3,"score":0.6097000241279602},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.5834000110626221},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5530999898910522},{"id":"https://openalex.org/C145804949","wikidata":"https://www.wikidata.org/wiki/Q478123","display_name":"Situation awareness","level":2,"score":0.5181999802589417},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.41620001196861267},{"id":"https://openalex.org/C29852176","wikidata":"https://www.wikidata.org/wiki/Q373338","display_name":"Critical infrastructure","level":2,"score":0.4101000130176544},{"id":"https://openalex.org/C202839342","wikidata":"https://www.wikidata.org/wiki/Q60740481","display_name":"Industrial Internet","level":3,"score":0.40849998593330383},{"id":"https://openalex.org/C179768478","wikidata":"https://www.wikidata.org/wiki/Q1120057","display_name":"Cyber-physical system","level":2,"score":0.3553999960422516},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.3513000011444092},{"id":"https://openalex.org/C81860439","wikidata":"https://www.wikidata.org/wiki/Q251212","display_name":"Internet of Things","level":2,"score":0.3434000015258789},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.33820000290870667},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.33230000734329224},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.33169999718666077},{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.3248000144958496},{"id":"https://openalex.org/C84418412","wikidata":"https://www.wikidata.org/wiki/Q3246940","display_name":"Digital forensics","level":2,"score":0.29510000348091125},{"id":"https://openalex.org/C126082660","wikidata":"https://www.wikidata.org/wiki/Q4252370","display_name":"Digital transformation","level":2,"score":0.2750999927520752},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.2721000015735626},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.26829999685287476},{"id":"https://openalex.org/C201307755","wikidata":"https://www.wikidata.org/wiki/Q4071928","display_name":"Cyber-attack","level":2,"score":0.25540000200271606},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.2506999969482422}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1007/s10207-025-01158-1","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10207-025-01158-1","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10207-025-01158-1.pdf","source":{"id":"https://openalex.org/S164062316","display_name":"International Journal of Information Security","issn_l":"1615-5262","issn":["1615-5262","1615-5270"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Information Security","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1007/s10207-025-01158-1","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10207-025-01158-1","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10207-025-01158-1.pdf","source":{"id":"https://openalex.org/S164062316","display_name":"International Journal of Information Security","issn_l":"1615-5262","issn":["1615-5262","1615-5270"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Information Security","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G3748656914","display_name":null,"funder_award_id":"Norway","funder_id":"https://openalex.org/F4320323299","funder_display_name":"Norges Forskningsr\u00e5d"},{"id":"https://openalex.org/G3950952312","display_name":null,"funder_award_id":"344244","funder_id":"https://openalex.org/F4320323299","funder_display_name":"Norges Forskningsr\u00e5d"}],"funders":[{"id":"https://openalex.org/F4320311040","display_name":"Norges Teknisk-Naturvitenskapelige Universitet","ror":"https://ror.org/05xg72x27"},{"id":"https://openalex.org/F4320323299","display_name":"Norges Forskningsr\u00e5d","ror":"https://ror.org/00epmv149"},{"id":"https://openalex.org/F4320327267","display_name":"St. Olavs Hospital Universitetssykehuset i Trondheim","ror":"https://ror.org/01a4hbq44"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4416424431.pdf","grobid_xml":"https://content.openalex.org/works/W4416424431.grobid-xml"},"referenced_works_count":50,"referenced_works":["https://openalex.org/W1997453220","https://openalex.org/W2036962960","https://openalex.org/W2049299805","https://openalex.org/W2066696450","https://openalex.org/W2149713648","https://openalex.org/W2163419627","https://openalex.org/W2398128966","https://openalex.org/W2533518312","https://openalex.org/W2560044530","https://openalex.org/W2793792646","https://openalex.org/W2896558251","https://openalex.org/W2899290191","https://openalex.org/W2966249670","https://openalex.org/W2977414522","https://openalex.org/W3024906992","https://openalex.org/W3081093222","https://openalex.org/W3081263171","https://openalex.org/W3082435965","https://openalex.org/W3086579950","https://openalex.org/W3088475148","https://openalex.org/W3090907514","https://openalex.org/W3095319230","https://openalex.org/W3119687955","https://openalex.org/W3127039706","https://openalex.org/W3132985895","https://openalex.org/W3160611354","https://openalex.org/W3174063337","https://openalex.org/W4226256344","https://openalex.org/W4281293626","https://openalex.org/W4281609751","https://openalex.org/W4281746745","https://openalex.org/W4283753393","https://openalex.org/W4285400608","https://openalex.org/W4292055417","https://openalex.org/W4312420926","https://openalex.org/W4312878571","https://openalex.org/W4319037055","https://openalex.org/W4321484089","https://openalex.org/W4380148395","https://openalex.org/W4385423342","https://openalex.org/W4387824443","https://openalex.org/W4388757755","https://openalex.org/W4390576566","https://openalex.org/W4392082637","https://openalex.org/W4392284516","https://openalex.org/W4392988374","https://openalex.org/W4399783570","https://openalex.org/W4399970829","https://openalex.org/W4401314842","https://openalex.org/W4402192818"],"related_works":[],"abstract_inverted_index":{"Abstract":[0],"The":[1,103,138],"increasing":[2],"integration":[3,56],"of":[4,16,46,57,122,144],"Industrial":[5],"Control":[6],"Systems":[7,11],"(ICS)":[8],"and":[9,48,65,74,90,92,96,100,125,130,155,165,185,193],"Cyber-Physical":[10],"(CPS)":[12],"with":[13],"the":[14,43,55,141],"Internet":[15],"Things":[17],"(IoT)":[18],"has":[19],"significantly":[20],"enhanced":[21],"their":[22],"operational":[23],"efficiency":[24],"but":[25],"also":[26],"exposed":[27],"them":[28],"to":[29,69,110],"advanced":[30],"cyber":[31,136],"threats.":[32],"Traditional":[33],"cybersecurity":[34,71,187],"approaches,":[35],"often":[36],"tailored":[37],"for":[38,72,88,134,181],"IT":[39],"systems,":[40],"must":[41],"address":[42],"unique":[44],"complexities":[45,167],"ICS":[47,73,192],"CPS":[49,194],"environments.":[50,195],"This":[51,174],"paper":[52],"systematically":[53],"reviews":[54],"three":[58],"critical":[59,183],"areas:":[60],"context-based":[61,119],"modeling,":[62,120],"digital":[63,82,123],"twins,":[64],"machine":[66],"learning":[67],"(ML),":[68],"enhance":[70],"CPS.":[75],"Context-based":[76],"modeling":[77],"provides":[78],"dynamic,":[79],"situational":[80],"awareness;":[81],"twins":[83,124],"offer":[84],"real-time":[85,149],"system":[86],"replicas":[87],"monitoring":[89],"simulation;":[91],"ML":[93,126],"delivers":[94],"predictive":[95,152],"adaptive":[97,156],"threat":[98,153],"detection":[99],"response":[101,157],"capabilities.":[102],"review":[104],"synthesizes":[105],"findings":[106],"from":[107],"recent":[108],"literature":[109],"answer":[111],"four":[112],"research":[113],"questions":[114],"focusing":[115],"on":[116],"methodologies":[117],"in":[118,127,189],"applications":[121],"attack":[128],"detection,":[129,151],"integrating":[131],"these":[132,146],"approaches":[133],"improved":[135],"resilience.":[137],"results":[139],"demonstrate":[140],"synergistic":[142],"potential":[143],"combining":[145],"technologies,":[147],"enabling":[148],"anomaly":[150],"analysis,":[154],"mechanisms.":[158],"Challenges":[159],"such":[160],"as":[161],"data":[162],"limitations,":[163],"scalability,":[164],"verification":[166],"are":[168],"vital":[169],"areas":[170],"requiring":[171],"further":[172],"research.":[173],"integrated":[175],"framework":[176],"offers":[177],"a":[178],"robust":[179],"pathway":[180],"securing":[182],"infrastructure":[184],"advancing":[186],"practices":[188],"increasingly":[190],"interconnected":[191]},"counts_by_year":[],"updated_date":"2026-04-10T15:06:20.359241","created_date":"2025-11-20T00:00:00"}