{"id":"https://openalex.org/W4404652934","doi":"https://doi.org/10.1007/s10462-025-11292-w","title":"Adaptive anomaly detection for identifying attacks in cyber-physical systems: A systematic literature review","display_name":"Adaptive anomaly detection for identifying attacks in cyber-physical systems: A systematic literature review","publication_year":2025,"publication_date":"2025-06-23","ids":{"openalex":"https://openalex.org/W4404652934","doi":"https://doi.org/10.1007/s10462-025-11292-w"},"language":"en","primary_location":{"id":"doi:10.1007/s10462-025-11292-w","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10462-025-11292-w","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10462-025-11292-w.pdf","source":{"id":"https://openalex.org/S122814990","display_name":"Artificial Intelligence Review","issn_l":"0269-2821","issn":["0269-2821","1573-7462"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Artificial Intelligence Review","raw_type":"journal-article"},"type":"preprint","indexed_in":["arxiv","crossref","datacite"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://link.springer.com/content/pdf/10.1007/s10462-025-11292-w.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5025254339","display_name":"Pablo Moriano","orcid":"https://orcid.org/0000-0002-1822-8885"},"institutions":[{"id":"https://openalex.org/I1289243028","display_name":"Oak Ridge National Laboratory","ror":"https://ror.org/01qz5mb56","country_code":"US","type":"facility","lineage":["https://openalex.org/I1289243028","https://openalex.org/I1330989302","https://openalex.org/I39565521","https://openalex.org/I4210159294"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Pablo Moriano","raw_affiliation_strings":["Computer Science and Mathematics Division, Oak Ridge National Laboratory, Oak Ridge, 37830, TN, USA"],"affiliations":[{"raw_affiliation_string":"Computer Science and Mathematics Division, Oak Ridge National Laboratory, Oak Ridge, 37830, TN, USA","institution_ids":["https://openalex.org/I1289243028"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5078196531","display_name":"Steven C. Hespeler","orcid":"https://orcid.org/0000-0003-4983-9651"},"institutions":[{"id":"https://openalex.org/I1289243028","display_name":"Oak Ridge National Laboratory","ror":"https://ror.org/01qz5mb56","country_code":"US","type":"facility","lineage":["https://openalex.org/I1289243028","https://openalex.org/I1330989302","https://openalex.org/I39565521","https://openalex.org/I4210159294"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Steven C. Hespeler","raw_affiliation_strings":["Computer Science and Mathematics Division, Oak Ridge National Laboratory, Oak Ridge, 37830, TN, USA"],"affiliations":[{"raw_affiliation_string":"Computer Science and Mathematics Division, Oak Ridge National Laboratory, Oak Ridge, 37830, TN, USA","institution_ids":["https://openalex.org/I1289243028"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5110193535","display_name":"Mingyan Li","orcid":"https://orcid.org/0009-0004-0220-7360"},"institutions":[{"id":"https://openalex.org/I1289243028","display_name":"Oak Ridge National Laboratory","ror":"https://ror.org/01qz5mb56","country_code":"US","type":"facility","lineage":["https://openalex.org/I1289243028","https://openalex.org/I1330989302","https://openalex.org/I39565521","https://openalex.org/I4210159294"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Mingyan Li","raw_affiliation_strings":["Cyber Resilience and Intelligence Division, Oak Ridge National Laboratory, Oak Ridge, 37830, TN, USA"],"affiliations":[{"raw_affiliation_string":"Cyber Resilience and Intelligence Division, Oak Ridge National Laboratory, Oak Ridge, 37830, TN, USA","institution_ids":["https://openalex.org/I1289243028"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5063640628","display_name":"Maria Mahbub","orcid":"https://orcid.org/0000-0002-3422-9650"},"institutions":[{"id":"https://openalex.org/I1289243028","display_name":"Oak Ridge National Laboratory","ror":"https://ror.org/01qz5mb56","country_code":"US","type":"facility","lineage":["https://openalex.org/I1289243028","https://openalex.org/I1330989302","https://openalex.org/I39565521","https://openalex.org/I4210159294"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Maria Mahbub","raw_affiliation_strings":["Cyber Resilience and Intelligence Division, Oak Ridge National Laboratory, Oak Ridge, 37830, TN, USA"],"affiliations":[{"raw_affiliation_string":"Cyber Resilience and Intelligence Division, Oak Ridge National Laboratory, Oak Ridge, 37830, TN, USA","institution_ids":["https://openalex.org/I1289243028"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5025254339"],"corresponding_institution_ids":["https://openalex.org/I1289243028"],"apc_list":{"value":2490,"currency":"EUR","value_usd":3090},"apc_paid":{"value":2490,"currency":"EUR","value_usd":3090},"fwci":24.0738,"has_fulltext":true,"cited_by_count":17,"citation_normalized_percentile":{"value":0.99457605,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":99,"max":100},"biblio":{"volume":"58","issue":"9","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9983000159263611,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9983000159263611,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9883999824523926,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9855999946594238,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6725761890411377},{"id":"https://openalex.org/keywords/cyber-physical-system","display_name":"Cyber-physical system","score":0.6026472449302673},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.473166286945343},{"id":"https://openalex.org/keywords/systematic-review","display_name":"Systematic review","score":0.45877230167388916},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.44218480587005615},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3902788460254669},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.3462241291999817},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.2707059383392334},{"id":"https://openalex.org/keywords/political-science","display_name":"Political science","score":0.09997695684432983},{"id":"https://openalex.org/keywords/physics","display_name":"Physics","score":0.09526929259300232},{"id":"https://openalex.org/keywords/medline","display_name":"MEDLINE","score":0.07971802353858948}],"concepts":[{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6725761890411377},{"id":"https://openalex.org/C179768478","wikidata":"https://www.wikidata.org/wiki/Q1120057","display_name":"Cyber-physical system","level":2,"score":0.6026472449302673},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.473166286945343},{"id":"https://openalex.org/C189708586","wikidata":"https://www.wikidata.org/wiki/Q1504425","display_name":"Systematic review","level":3,"score":0.45877230167388916},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.44218480587005615},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3902788460254669},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.3462241291999817},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2707059383392334},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.09997695684432983},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.09526929259300232},{"id":"https://openalex.org/C2779473830","wikidata":"https://www.wikidata.org/wiki/Q1540899","display_name":"MEDLINE","level":2,"score":0.07971802353858948},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C26873012","wikidata":"https://www.wikidata.org/wiki/Q214781","display_name":"Condensed matter physics","level":1,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1007/s10462-025-11292-w","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10462-025-11292-w","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10462-025-11292-w.pdf","source":{"id":"https://openalex.org/S122814990","display_name":"Artificial Intelligence Review","issn_l":"0269-2821","issn":["0269-2821","1573-7462"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Artificial Intelligence Review","raw_type":"journal-article"},{"id":"pmh:oai:arXiv.org:2411.14278","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2411.14278","pdf_url":"https://arxiv.org/pdf/2411.14278","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2411.14278","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2411.14278","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"article"}],"best_oa_location":{"id":"doi:10.1007/s10462-025-11292-w","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10462-025-11292-w","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10462-025-11292-w.pdf","source":{"id":"https://openalex.org/S122814990","display_name":"Artificial Intelligence Review","issn_l":"0269-2821","issn":["0269-2821","1573-7462"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Artificial Intelligence Review","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1114202872","display_name":null,"funder_award_id":"LDRD","funder_id":"https://openalex.org/F4320338287","funder_display_name":"Oak Ridge National Laboratory"}],"funders":[{"id":"https://openalex.org/F4320306084","display_name":"U.S. Department of Energy","ror":"https://ror.org/01bj3aw27"},{"id":"https://openalex.org/F4320338287","display_name":"Oak Ridge National Laboratory","ror":"https://ror.org/01qz5mb56"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4404652934.pdf","grobid_xml":"https://content.openalex.org/works/W4404652934.grobid-xml"},"referenced_works_count":127,"referenced_works":["https://openalex.org/W2955815373","https://openalex.org/W3001336289","https://openalex.org/W2570832985","https://openalex.org/W2620661538","https://openalex.org/W3181836960","https://openalex.org/W4306168742","https://openalex.org/W3126663487","https://openalex.org/W4210277846","https://openalex.org/W4402811831","https://openalex.org/W4309196558","https://openalex.org/W4390012802","https://openalex.org/W3201481350","https://openalex.org/W2520634815","https://openalex.org/W4312673899","https://openalex.org/W2964180302","https://openalex.org/W2400544547","https://openalex.org/W2942292460","https://openalex.org/W3157481002","https://openalex.org/W4312655287","https://openalex.org/W4403759756","https://openalex.org/W3164964481","https://openalex.org/W2342408547","https://openalex.org/W4320015848","https://openalex.org/W2126010636","https://openalex.org/W3135970545","https://openalex.org/W2122646361","https://openalex.org/W2999309192","https://openalex.org/W2664781091","https://openalex.org/W4386833170","https://openalex.org/W3167461903","https://openalex.org/W3178437172","https://openalex.org/W6600340491","https://openalex.org/W4320016096","https://openalex.org/W4221128026","https://openalex.org/W2872013922","https://openalex.org/W2994954803","https://openalex.org/W2099419573","https://openalex.org/W2803355698","https://openalex.org/W3035630868","https://openalex.org/W3094584458","https://openalex.org/W3185305249","https://openalex.org/W4386249450","https://openalex.org/W4285138763","https://openalex.org/W2081770709","https://openalex.org/W4312419687","https://openalex.org/W2951270751","https://openalex.org/W3177669185","https://openalex.org/W2155926039","https://openalex.org/W4249736682","https://openalex.org/W2579603034","https://openalex.org/W2756396702","https://openalex.org/W4382710036","https://openalex.org/W2207856858","https://openalex.org/W3178115352","https://openalex.org/W3188788925","https://openalex.org/W4319791240","https://openalex.org/W2400995703","https://openalex.org/W2998523344","https://openalex.org/W3119687955","https://openalex.org/W3135368824","https://openalex.org/W4285122460","https://openalex.org/W4312083476","https://openalex.org/W4304587309","https://openalex.org/W1992084525","https://openalex.org/W3187985969","https://openalex.org/W2169239645","https://openalex.org/W2417282157","https://openalex.org/W2911921818","https://openalex.org/W4289950852","https://openalex.org/W4383199515","https://openalex.org/W3164160032","https://openalex.org/W2905091764","https://openalex.org/W3022960042","https://openalex.org/W3012972431","https://openalex.org/W2964937598","https://openalex.org/W2963197901","https://openalex.org/W1986352215","https://openalex.org/W3121470398","https://openalex.org/W4221052500","https://openalex.org/W2182092823","https://openalex.org/W2296509296","https://openalex.org/W3043527956","https://openalex.org/W2906498146","https://openalex.org/W2955785376","https://openalex.org/W3007302352","https://openalex.org/W2952298682","https://openalex.org/W2975416010","https://openalex.org/W3112733201","https://openalex.org/W2165698076","https://openalex.org/W2953526560","https://openalex.org/W2003530067","https://openalex.org/W4367857342","https://openalex.org/W2523522678","https://openalex.org/W6776849695","https://openalex.org/W3167778834","https://openalex.org/W2970196113","https://openalex.org/W3163963286","https://openalex.org/W2990962077","https://openalex.org/W2982837328","https://openalex.org/W2897104255","https://openalex.org/W2810579294","https://openalex.org/W2098010707","https://openalex.org/W4385656664","https://openalex.org/W4206553219","https://openalex.org/W2785440235","https://openalex.org/W185142374","https://openalex.org/W2999472659","https://openalex.org/W4285187556","https://openalex.org/W4229008871","https://openalex.org/W2535751405","https://openalex.org/W2945434604","https://openalex.org/W3165857918","https://openalex.org/W4391097714","https://openalex.org/W3004324458","https://openalex.org/W1975675278","https://openalex.org/W2945012921","https://openalex.org/W4210971508","https://openalex.org/W4387092329","https://openalex.org/W2596142952","https://openalex.org/W1980500163","https://openalex.org/W3112352665","https://openalex.org/W4308529607","https://openalex.org/W4297329009","https://openalex.org/W6602254124","https://openalex.org/W6606433420","https://openalex.org/W2989842210","https://openalex.org/W2977367995"],"related_works":["https://openalex.org/W2806741695","https://openalex.org/W4290647774","https://openalex.org/W3189286258","https://openalex.org/W3207797160","https://openalex.org/W3210364259","https://openalex.org/W4300558037","https://openalex.org/W2667207928","https://openalex.org/W2912112202","https://openalex.org/W4377864969","https://openalex.org/W3120251014"],"abstract_inverted_index":{"Modern":[0],"cyberattacks":[1],"in":[2,71,97,142,182,206],"cyber-physical":[3],"systems":[4],"(CPS)":[5],"rapidly":[6],"evolve":[7],"and":[8,44,83,91,118,151,154,157,167,172,179,199,203],"cannot":[9],"be":[10],"deterred":[11],"effectively":[12],"with":[13,37],"most":[14,30,124],"current":[15,69,183],"methods,":[16],"which":[17],"focus":[18],"on":[19,40,68,95],"characterizing":[20],"past":[21],"threats.":[22],"Adaptive":[23],"anomaly":[24],"detection":[25],"(AAD)":[26],"is":[27,61],"among":[28],"the":[29,54,62,160,193],"promising":[31],"techniques":[32],"to":[33,53,101],"detect":[34],"evolving":[35],"cyberattacks,":[36],"an":[38],"emphasis":[39],"fast":[41],"data":[42,116,131],"processing":[43,198],"model":[45,128],"adaptation.":[46],"AAD":[47,96,207],"has":[48],"been":[49],"researched":[50],"extensively;":[51],"however,":[52],"best":[55],"of":[56,87],"our":[57,59],"knowledge,":[58],"work":[60],"first":[63],"systematic":[64],"literature":[65],"review":[66,163],"(SLR)":[67],"research":[70,90,140,190],"this":[72],"field.":[73],"We":[74,104,146],"present":[75],"a":[76,106,139,165],"comprehensive":[77],"SLR,":[78],"gathering":[79],"397":[80],"relevant":[81],"papers":[82],"systematically":[84],"analyzing":[85],"65":[86],"them":[88],"(47":[89],"18":[92],"survey":[93],"papers)":[94],"CPS":[98,112],"from":[99],"2013":[100],"November":[102],"2023.":[103],"introduce":[105],"novel":[107],"taxonomy":[108],"considering":[109],"attack":[110,152],"types,":[111],"application,":[113],"learning":[114],"paradigm,":[115],"management,":[117],"algorithms.":[119],"Our":[120,162],"findings":[121],"show":[122],"that":[123],"studies":[125],"addressed":[126],"either":[127],"adaptation":[129],"or":[130],"processing,":[132],"but":[133],"rarely":[134],"both":[135],"simultaneously.":[136],"This":[137],"indicates":[138],"gap":[141],"fully":[143],"adaptive":[144,200],"solutions.":[145],"also":[147],"categorize":[148],"algorithms,":[149],"datasets,":[150],"characteristics,":[153],"summarize":[155],"strengths":[156],"weaknesses":[158],"across":[159],"literature.":[161],"provides":[164],"structured":[166],"accessible":[168],"reference":[169],"for":[170,195,208],"researchers":[171],"practitioners,":[173],"offering":[174],"insights":[175],"into":[176],"key":[177],"trends":[178],"highlighting":[180],"limitations":[181],"approaches.":[184],"Finally,":[185],"we":[186],"outline":[187],"several":[188],"future":[189],"directions,":[191],"including":[192],"need":[194],"integrated":[196],"real-time":[197],"learning,":[201],"explainability,":[202],"uncertainty":[204],"quantification":[205],"CPS.":[209]},"counts_by_year":[{"year":2026,"cited_by_count":10},{"year":2025,"cited_by_count":7}],"updated_date":"2026-04-10T15:06:20.359241","created_date":"2024-11-24T00:00:00"}