Industrial Control Systems (ICS), which include Supervisory Control and Data Acquisition (SCADA) systems, Distributed Control Systems (DCS), and Programmable Logic Controllers (PLC), play a crucial role in managing and regulating industrial processes. However, ensuring the security of these systems is of utmost importance due to the potentially severe consequences of cyber attacks. This article presents an overview of ICS security, covering its components, protocols, industrial applications, and performance aspects. It also highlights the typical threats and vulnerabilities faced by these systems. Moreover, the article identifies key factors that influence the design decisions concerning control, communication, reliability, and redundancy properties of ICS, as these are critical in determining the security needs of the system. The article outlines existing security countermeasures, including network segmentation, access control, patch management, and security monitoring. Furthermore, the article explores the integration of machine learning techniques to enhance the cybersecurity of ICS. Machine learning offers several advantages, such as anomaly detection, threat intelligence analysis, and predictive maintenance. However, combining machine learning with other security measures is essential to establish a comprehensive defense strategy for ICS. The article also addresses the challenges associated with existing measures and provides recommendations for improving ICS security. This paper becomes a valuable reference for researchers aiming to make meaningful contributions within the constantly evolving ICS domain by providing an in-depth examination of the present state, challenges, and potential future advancements. Industrial Control System (ICS) is an encompassing term that refers to various control systems and their associated instrumentation. It encompasses a diverse array of equipment, systems, networks, and mechanisms employed for the purpose of managing and automating industrial operations . VirtualA process consists of activities to achieve the desired output;A control loop utilizes sensors, actuators, and controllers or PLCs to adjust the output value to the desired set-point automatically;A sensor detects changes in its environment and sends information as controlled variables to the controller;A controller uses target set point and control algorithms to generate required output variables and transmit them to the actuators;Actuators or movers are elements within a machine designed for the manipulation or regulation of a mechanism, such as control valves, circuit breakers, switches, and motors;Human–Machine Interfaces (HMI) are utilities used to display process status information and monitor and configure controller parameters;Remote Diagnostics and Maintenance applications do real-time diagnosis and maintenance operations such as remotely identifying, preventing, and recovering from abnormal operations or failures;A Data Historian is a centralized database storing all process information within an ICS environment. The logged data is exported to the corporate Information Systems (IS) for process data analysis, control, and planning;A Communications Gateway device enables communication with a distant network, such as the internet or an autonomous system, which is not accessible to the host network nodes. This gateway can be realized using either hardware or software. It directs the network traffic and may block specific traffic to protect it from malicious attacks. It also grants or denies access to computers within the network to the outside world.An overview of an ICS contains several control loops, remote diagnostics, maintenance tools, and human interfaces built on layered network architectures using various network protocols. A summary of the basic components and process of an ICS is shown in In the forthcoming part of this article, ICS has different technologies such as SCADA, DCS, Industrial Automation and Control Systems (IACS), PLCs, Programmable Automation Controllers (PACs), HMI, RTUs, control servers, Intelligent Electronic Devices (IEDs), and sensors . The intElectricity generation, transmission, and distribution;Manufacturing industries or plants;Food and pharma productionsTelecom and IT-based systems;Traffic control;Lift and elevator control;Oil and gas systems;Mass transit and railway traction.SCADA is among the most widely utilized technologies in Industrial Control Systems . It funcSupervisory control: Supervisory control serves as the fundamental role of the HMI. HMI software serves as an interface responsible for overseeing industrial processes. On the other hand, a master terminal unit (MTU) functions as a central supervisory controller that communicates with lower field devices, such as RTUs, through the ICS network;Data acquisition: Data can be acquired from two primary sources in the context of SCADA system as PLCs and Remote Telemetry Units (RTUs). Both the PLCs and RTUs interface directly with actuators and sensors in the field. RTUs are specifically designed to interface with sensors and collect telemetry data, which they then transmit to a primary system for further action. On the other hand, PLCs interface with the actuators to maintain and control industrial processes based on the telemetry data collected by the RTUs . PLCs anData storage: The majority of SCADA systems employ a Structured Query Language (SQL) database for storing data with timestamps. A historian is a fully integrated SCADA software that collects real-time data from various SCADA devices and stores them in a database, such as mySQL;Data exchange: Communication protocols are used to exchange data between SCADA components.SCADA employs a central computer to store information related to local and remote devices, enabling the control of industrial processes and facilities. The typical components of SCADA can be classified based on their respective definitions, as depicted in (a)First generation-Monolithic: The first generation of SCADA systems was developed when networks were not yet in existence. These early systems were not designed to connect with other systems, and communication was typically limited to Wide Area Networks (WANs) interacting with remote terminal units (RTUs) . It defi(b)Distributed SCADA system: Control functions were distributed across multiple systems during second generation . Distrib(c)Internet of Things (IoT): IoT introduces a distinct approach to SCADA systems, substituting the requirement for PLCs with an emphasis on data modeling and advanced algorithms. This transition signifies a departure from the traditional reliance on mainframes or server in a facility, as data goes to cloud-based servers for sharing and storage . IoT SCA(d)Networked SCADA Architecture: During the third generation, the monitoring process heavily relied on the involvement of PLCs. They were integrated into the SCADA system, providing efficient and reliable data acquisition and control capabilities. This integration of PLCs enhanced the overall functionality and responsiveness of the SCADA system, enabling real-time monitoring and control of industrial processes across a distributed network. The third-generation SCADA architecture thus facilitated greater flexibility, scalability, and accessibility, making it more adaptable to modern industrial demands . It can This section describes the four generations of SCADA architecture in detail and summarizes the security strengths and vulnerabilities of each. Agriculture;Chemical plants;Petrochemical and refineries;Nuclear power plants;Water and sewage treatment plants;Food processing;Automobile manufacturing;Pharmaceutical manufacturing.Distributed Control Systems are comprised of controllers, sensors, and actuators that are distributed across different spatial locations . The entWithin the domain of DCS, automatic control revolves around the exchange of signals, facilitating bidirectional information flow, and the computation of control actions through decision-making processes . DCS is An engineering workstation: This is the supervisory controller for the DCS as a whole. The station comes with configuration tools that empower users to undertake activities such as generating new loops, establishing input/output (I/O) points, and configuring distributed devices ;An operator station: A station operator is a location where the user observes the ongoing process. At the station operator’s interface, the operator can access process variables, control parameters, and alarms, which are essential for retrieving the current operating status ;A process control unit: This control center acts as the brain of all process control by performing all the computation process algorithms and running all logical expressions. The control module takes an input variable that will be controlled, calculates it, and the results are compared with the set point, which is the value expected of the process. If the calculation results differ from the set point, the value must be manipulated and the results sent to the actuator . This coA communication system: This system facilitates the transfer of data from one station to another, a crucial function in distributed control systems. The network protocols employed encompass Ethernet, Profibus, and DeviceNet;Smart devices: These refer to intelligent devices or bus technologies employed to substitute older I/O systems.Components of DCS consist of the basic components, as listed below:Oil and Gas;Food and Beverage;Automotive;Pharmaceuticals;Transportation;Off Road Construction;Lifts and escalators;Medical applications;Automatic gate systems;Heating control systems.PLCs are industrial computer control systems designed to constantly monitor the status of input devices and make decisions according to a customized program in order to manage the status of output devices . Early PReal-Time Monitoring and Control: PLCs facilitate real-time monitoring and control of industrial processes. With their network connectivity, they can provide immediate data feedback, allowing for rapid decision-making and adjustments;Data Aggregation and Analysis: PLCs can collect and transmit data to centralized systems for analysis. This data is essential for process optimization, predictive maintenance, and quality control;Remote Accessibility: Connectivity enables remote accessibility to PLCs, allowing engineers and operators to manage and monitor processes from different locations, improving operational efficiency and reducing the need for onsite presence.PLCs have evolved significantly, with a version incorporating Ethernet protocol based network connectivity that enables them to share data with a variety of devices and systems such as other PCs, SCADA, and even cloud-based platforms . This enEnhanced Automation and Smart Manufacturing: PLCs contribute to the automation and intelligent control of industrial processes, aligning perfectly with the objectives of Industry 4.0 and industrial IoT, which aim to create smart and interconnected factories;Optimizing Resource Utilization: PLCs, as part of ICS, contribute to optimizing resource utilization, reducing energy consumption, and minimizing waste, which are central to sustainable and eco-friendly manufacturing practices;Data-Driven Decision Making: In Industry 4.0 and industrial IoT, data is a valuable asset. PLCs’ connectivity enables them to generate and share data, which is the foundation for data-driven decision-making, predictive maintenance, and process optimization.This version of the Ethernet protocol-based PLCs has several limitations despite its data sharing capability. These PLCs lacked standardization, leading to compatibility issues between devices from different manufacturers. They also present with data handling, processing, and storage limitations for more advanced applications. PLCs have become an integral part of the broader industrial landscape, especially within the frameworks of Industry 4.0 and the Industrial Internet of Things (IoT). A team of researchers proposed an IoT-PLC version that possesses regulatory control features, incorporates fog computing capabilities for tasks such as data filtering, field data storage, and supports various wireless interfaces that can be managed autonomously . Their iPower Supply Unit: The power requirements are contingent upon the particular type of PLC employed in the application. This unit converts AC to DC voltage suitable for PLC. This unit comprises short-circuit protection switches at all levels, control transformers, switching power supply, and other components ;Processor or CPU: This component includes a microprocessor, system memory, serial communication ports, and a LAN connection. A power supply may also be included in specific cases to deliver the necessary power to the CPU;Input/Out modules: Input and output modules serve as the connection points between the control environment’s field devices (comprising both input and output equipment) and the processor. The input devices encompass sensors, push buttons, limit switches, and similar items, while the output devices consist of motors, relays, solenoid valves, and the like. I/O devices can be broadly categorized into two groups: discrete or digital modules and analog modules;Programmable devices: As seen in Control Timing Requirements: Within ICS, a spectrum of time-related demands exists, encompassing the need for rapid responses, consistency, regularity, and synchronization. These requirements can present difficulties for humans in consistently and reliably meeting them, emphasizing the importance of implementing automated controllers. In certain specific situations, it becomes vital for computations to occur close to sensors and actuators to minimize communication delays and ensure the timely execution of essential control functions;Safety: The inclusion of safety requirements in the system’s design is of utmost importance. Systems must possess the ability to detect unsafe conditions and take measures to transform them into safe conditions. In numerous safety-critical operations, the presence of human oversight and control within potentially hazardous processes remains an indispensable element of the safety system;Geographic Distribution: The level of distribution in systems can exhibit a broad spectrum, ranging from compact systems such as local PLC-controlled processes to far-reaching, extensively distributed systems such as oil pipelines and the electric power grid. A higher degree of distribution often necessitates using wide-area communication methods such as leased lines, circuit switching, packet switching, and mobile communication solutions;Impact of Failures: Failures in control functions can lead to varying consequences in different domains. Systems with more significant impacts often necessitate the ability to sustain operations through redundant controls or the capacity to operate in a reduced-capability state. The design must specifically cater to these requirements;Hierarchy: To create a central hub that can gather data from diverse locations, supervisory control is utilized, enabling control decisions to be made based on the system’s current status. Hierarchical or centralized control is commonly employed to provide human operators with a holistic view of the entire system;Control Complexity: Simple controllers and predetermined algorithms are often sufficient for managing control functions. Nevertheless, in highly complex systems such as air traffic control, the presence of human operators becomes essential to ensure that all control actions align with the overarching objectives of the system;Availability: The system’s dependability, indicating its accessibility, remains critical during the design phase. Systems requiring exceptional availability or continuous operation might require heightened redundancy or alternative communication and control components strategies.While Protecting ICS environments from the most critical threats is an absolute necessity;It is vital to preserve operational resilience by addressing systemic weaknesses and fortifying the capacity of control systems to withstand cyber incidents with minimal adverse effects on critical infrastructure;We must provide critical infrastructure owners, operators, and cybersecurity defenders with the necessary technologies and tools to significantly increase the time, costs, and technical hurdles for adversaries;Identify and proactively counteract adversaries, preempting any potential harm. CISA and its partners will cooperate to improve visibility within OT environments, guaranteeing swift detection and elimination of malicious activity before it can cause widespread damage.In year 2020, the Cybersecurity and Infrastructure Security Agency detailed four primary priorities that served as the central focus of its endeavors to reduce cyber risks within control systems .ProtectIn 2021, the actual threats confronting ICS garnered increased attention. The number of vulnerabilities identified in operational technology (OT) devices and their corresponding management systems witnessed a growth of over 50%. Concurrently, ransomware groups continued to target manufacturing and critical infrastructure with persistence. The reported vulnerabilities in 2021 surged by 52%, reaching almost 1440, in contrast to the prior year . Cyber aThe cyberattack that occurred on 7 May 2021, targeting Colonial Pipeline, gained worldwide attention due to its far-reaching consequences, including a severe fuel shortage and skyrocketing prices. The breach transpired when hackers managed to access the company’s network by exploiting an inactive virtual private network (VPN) account that had remote access to their computer system. To regain control of their network, Colonial Pipeline ultimately had to pay USD 4.4 million to the DarkSide hacker group in exchange for the decryption tool required for network restoration .In May 2020, CPC Corp, Taiwan’s state-owned petroleum and natural gas company, encountered a ransomware incident that left its payment system unusable. The attackers used a USB flash drive to breach the company’s computer network. While it did not affect oil production, it did disrupt CPC Corp’s payment card system. This cyberattack was attributed to the Winnti Umbrella group, a China-linked entity known for its targeting of software companies and political organizations .During the incident in 2017, a Russian agency utilized Triton to specifically focus on a Schneider Electric Triconex safety instrumented system (SIS), which holds the responsibility of initiating safe shutdown protocols during emergencies. Following their initial access, the attackers then traversed through both IT and OT networks until they reached the safety system, where they introduced the Triton malware. This malicious software made alterations to the in-memory firmware, introducing harmful code. The FBI cautioned that this situation could have led to damage to the facility, system disruptions, or even potential loss of life if the SIS had failed to carry out the safe shutdown procedures ,49.On 23 December 2015, a power outage that impacted approximately 1.4 million residents of Ukraine was linked to the espionage Trojan called Black Energy. This incident appears to represent the first instance of malware being employed to facilitate a widespread power disruption.On 25 November 2016, a malware infection struck approximately 2000 of the San Francisco Municipal Transport Authority’s (SFMTA) 8000 computer systems. This malware also managed to compromise physical ticketing machines, leading to the SFMTA offering free rides to passengers over the Thanksgiving weekend. Additionally, Muni bus drivers were forced to create handwritten route assignments. The agency expected to incur a daily revenue loss of around USD 559,000 during the period when they were unable to collect fares .Architecture and Design Vulnerabilities: Deficiencies in the overarching system architecture and design can be leveraged by malicious actors to obtain unauthorized access or manipulate control processes;Configuration and Maintenance Vulnerabilities: Incorrect or inadequate system configurations and poor maintenance practices can create opportunities for attackers to compromise the system’s security;Physical Vulnerabilities: Physical access to industrial control systems can lead to potential exploits, such as unauthorized tampering with hardware or gaining direct access to critical components;Software Development Vulnerabilities: Errors or flaws in software development can introduce vulnerabilities that attackers may exploit to infiltrate and compromise the system;Communication and Network Configuration Vulnerabilities: Insecure communication protocols and improperly configured networks can provide attackers with entry points to intercept or manipulate data and control commands.Remote attacks often serve as the initial point of entry for targeting ecosystems of devices. Attackers take advantage of known vulnerabilities in specific protocol implementations, using readily available pre-written attack scripts, simplifying the attack process . By moni(a)Identification and Authorization of Users: Robust authentication mechanisms should be implemented to verify the identity of users accessing the ICS. Authorization procedures must guarantee that users are allocated appropriate privileges in accordance with their designated roles and responsibilities;Access Control Mechanism: Access control policies and mechanisms should be implemented to restrict and manage users’ access to critical components and functions within the ICS. This ensures that only authorized personnel can interact with specific system elements;Network Topology: The network architecture of the ICS should be designed with security in mind. Network segmentation, firewalls, and other security measures should be deployed to prevent unauthorized access and isolate critical components from less secure areas;System Configuration and Integrity Mechanisms: Implementing system configuration controls and integrity mechanisms ensures that the ICS operates within specified parameters and that any unauthorized changes or tampering are promptly detected and addressed.Inadequate incorporation of security into architecture and design: Incorporating security into the architecture and design of ICS should be considered from the outset, considering the budget and schedule constraints of the ICS project . The secBy proactively integrating these security considerations into the ICS architecture and design, organizations can build resilient and secure systems that protect against potential cyber threats and ensure the continuity and safety of critical industrial processes.(b)The insecure architectural design permitted to evolve: The network infrastructure of ICS has frequently evolved and adapted to meet business and operational needs, often without sufficient consideration of the potential security consequences of these alterations. As a result, security vulnerabilities may have unintentionally emerged in certain parts of the infrastructure. In the absence of corrective measures, these vulnerabilities could serve as potential points of unauthorized access into the ICS.(c)No security perimeter defined: Without a clearly defined security perimeter for the ICS, it becomes challenging to guarantee the proper deployment and configuration of essential security measures . This si(d)Inadequate collection of event data history: Investigative analysis relies on the gathering and preservation of an ample amount of data. In the absence of thorough and precise data collection, determining the cause of a security incident may become exceedingly difficult or even impossible . Securit(a)Operating system (OS) and application security patches are not maintained or vendor declines to patch vulnerability: Outdated operating systems and applications may house newly uncovered vulnerabilities that could be taken advantage of. It is of utmost importance to create documented guidelines for overseeing security patch management. In situations where unsupported ICS operating systems are utilized, access to security patch support may not be available. Consequently, these procedures should also incorporate backup plans for addressing vulnerabilities that may never receive prompt patch updates.(b)OS and vendor software patches may not be developed until a considerable time after security vulnerabilities are initially discovered: Due to the close integration between ICS software and the underlying ICS infrastructure, any modifications must undergo extensive and time-consuming regression testing, incurring significant costs. The duration required for this testing and the subsequent distribution of updated software can create a prolonged window of vulnerability.(c)The installation of malicious software, known as malware, is a prevalent form of attack: Installation of malicious software, or malware, is a common attack. Malware protection software, such as antivirus software, must be kept current in a dynamic environment. Outdated malware protection software and definitions open the system to new malware threats.(d)Insufficient examination of security modifications: Introducing modifications to hardware, firmware, and software without conducting prior testing poses a risk to the smooth operation of the ICS. It is imperative to establish well-documented procedures for evaluating the security ramifications of any changes. It is vital to refrain from using operational systems in live environments for testing. Additionally, the testing of system modifications may necessitate collaboration and coordination with system vendors and integrators.(e)Inadequate remote access management: There are various reasons why remote access may be required for an ICS, such as system maintenance tasks performed by vendors and system integrator or ICS engineers accessing geographically distant system components. To safeguard against unauthorized access, it is essential to maintain robust control over remote access capabilities.(f)Critical configurations are neither stored nor subjected to backup procedures: Procedures for restoring ICS configuration settings should be easily accessible to address unintentional or malicious configuration alterations, ensuring system availability and data protection. It is imperative to establish thorough and meticulously documented procedures for maintaining ICS configuration settings.(g)Unsecured information stored on portable devices: The security of the system could be compromised if confidential information, such as passwords and dial-up numbers, is stored without encryption on portable devices such as laptops and mobile devices. To minimize this risk, it is essential to implement policies, procedures, and mechanisms to safeguard this data.(h)Passwords generated, utilized, and safeguarded in a manner inconsistent with established policies: The extensive knowledge about password management in IT is relevant to ICS. Maintaining effectiveness requires strict compliance with password policies and procedures. Departures from these guidelines can considerably increase vulnerabilities in ICS.(i)Insufficient access controls implemented: Access controls should align with how the organization assigns responsibilities and privileges to its personnel. Poorly defined access controls can grant an ICS user too many privileges or restrict them excessively.(j)The absence of configuration management for hardware, firmware, and software can give rise to significant challenges: The organization may lack visibility into its inventory, the versions in use, their locations, or their patch status, resulting in an inconsistent and ineffective security posture. To safeguard an ICS against inadequate or improper modifications at all stages, including before, during, and after system implementation, it is essential to establish a structured process for controlling changes to hardware, firmware, software, and documentation. Failing to institute configuration change management procedures can introduce security oversights, vulnerabilities, and risks. To comprehensively secure an ICS, maintaining an accurate inventory of system assets and their current configurations is imperative . These p(k)Improper data linking: Data storage systems within ICS can be connected to non-ICS data sources. One such example is database links, which facilitate the automatic replication of data from one database to others. However, incorrect configuration of data linkage can introduce vulnerabilities, potentially enabling unauthorized access to or manipulation of data.(l)Malware protection deployed without thorough testing: If malware protection software is deployed without adequate testing, it has the potential to disrupt the normal operation of the ICS and hinder the system’s ability to carry out essential control actions .(m)Denial of service (DoS): ICS software might be prone to DoS attacks, leading to the obstruction of authorized access to a system resource or the disruption of system operations and functions ,61.(n)Lack of installed intrusion detection/prevention software: Incidents can result in system availability and integrity loss, data capture, modification, and deletion, and incorrect execution of control commands. IDS/IPS software may stop or prevent various types of attacks, including DoS attacks, and also identify attacked internal hosts, such as those infected with worms. IDS/IPS software must be tested before deployment to determine that it does not compromise the normal operation of the ICS.(o)Lack of log maintenance: In the absence of accurate logs, pinpointing the cause of a security incident can become a challenging task.(p)Theft of data and hardware;Physical harm or destruction of data and hardware;Unauthorized alterations to the operational environment ;Disconnection of physical data links;Untraceable interception of data (including keystroke and other input logging).Unauthorized personnel have physical access to equipment: Limited physical access to ICS equipment should be exclusively granted to essential personnel, while considering safety prerequisites such as emergency shutdowns or restarts. Inappropriate access to ICS equipment can result in any of the following consequences:(q)Radio frequency, electromagnetic pulse (EMP), static discharge, brownouts, and voltage spikes: Control systems hardware is susceptible to various threats, including radio frequency interference,EMP, static discharges, brownouts, and voltage spikes . The con(r)Lack of backup power: In the absence of backup power for essential assets, a widespread power outage can result in the ICS shutdown, potentially creating a hazardous situation. Additionally, the loss of power could result in the activation of insecure default settings.(s)Physical ports lacking security measures: Unprotected USB and PS/2 ports could permit unauthorized connections, including thumb drives and keystroke loggers .(a)Inadequate data validation: ICS software might fail to effectively validate user inputs or incoming data for accuracy, potentially leading to various vulnerabilities. These vulnerabilities encompass issues like buffer overflows, command injections, cross-site scripting, and path traversals.(b)Installed security features remain inactive in their default settings: The security features bundled with the product become ineffectual unless they are actively activated or, at a minimum, acknowledged as disabled.(a)Unused data flows: Data flow controls are essential based on the attributes of the data, as they help regulate the permissible transfer of information between systems. These controls play a crucial role in preventing data exfiltration and unauthorized operations.(b)Inadequate firewall and router logs: In the absence of precise and comprehensive logs, identifying the root cause of a security incident might become an insurmountable challenge.(c)Standard, well-documented communication protocols are used in plain text: Adversaries with the ability to monitor ICS network activity can exploit the lack of encryption in certain protocols. Protocol analyzers and other utilities can be utilized to decode data transferred over protocols such as Telnet, File Transfer Protocol (FTP), Hypertext Transfer Protocol (HTTP), and Network File System (NFS). Since these protocols do not employ encryption, the data transmitted is easily readable by anyone monitoring the network. This exposes sensitive information, including login credentials and commands sent between devices, potentially leading to unauthorized access and manipulation of the ICS network. Adversaries can leverage this vulnerability to perform attacks against the ICS, such as eavesdropping, session hijacking, and man-in-the-middle attacks. By exploiting the lack of encryption, they can manipulate ICS network activity, disrupt operations, and potentially cause significant harm to industrial processes and critical infrastructure. To counter these threats, it is crucial to implement secure communication protocols, such as Secure Shell (SSH) and Secure Socket Layer/Transport Layer Security (SSL/TLS), that encrypt data transmissions and protect against unauthorized access and manipulation of ICS network activity. Employing robust authentication mechanisms and regular security assessments also enhances the overall security posture of the ICS environment.(d)Firewalls are either absent or configured incorrectly: Insufficiently configured firewalls can lead to unrestricted data flow between diverse networks, such as control and corporate networks. This situation can create openings for potential attacks and the spread of malware across networks, ultimately exposing sensitive data to potential monitoring, eavesdropping, and allowing unauthorized access to systems .(e)Authentication of users, data, or devices is either inadequate or entirely absent: Numerous ICS protocols lack authentication at any level. In the absence of authentication, there exists the possibility of data or device manipulation, replay attacks, and spoofing of elements like sensors and user identities.(f)Absence of communication integrity verification: Most industrial control protocols lack built-in integrity checks, potentially allowing adversaries to tamper with communications without detection. To ensure integrity, ICS systems can implement lower-layer protocols like IPsec, which provide data integrity protection.(g)Insufficient authentication measures between wireless clients and access points: It is essential to establish robust mutual authentication between wireless clients and access points to prevent clients from connecting to rogue access points deployed by adversaries. Additionally, this authentication ensures that adversaries cannot connect to any of the ICS’s wireless networks.(a)The Data Link layer: It is responsible for sending and receiving frames and contains header information such as source DNP3 address and destination DNP3 address. At the same time, it is also responsible for calculating errors through Cyclic Redundancy Check (CRC) and checking the link’s status;The Transport layer: The main purpose for this layer lies in the fragmentation of large packets received by the Application layer, while its header contains the information required to reassemble the fragments;The Application layer: This layer creates the message to be communicated; however, this layer’s header differs depending on whether the message creator is a master or a slave, as the latter’s header contains the Internal Indications field to better describe the node’s status.Distributed Network Protocol 3 (DNP3): DNP3 is an application layer protocol with a multi-tier structure, primarily utilized in smart grid applications . DNP3 is(b)Modbus: The Modbus protocol, initially created in 1979 by the American company Gould-Modicon, is an openly available communication standard designed for enabling the communication of programmable logic controllers. With Modbus, a master device can efficiently exchange data with multiple slave devices. While theoretically, every node on the network can transmit messages, it is most common for communication to be instigated by the master device . The ModWith the existing system integration, the primary function of ICS is to gather real-time data, realize device automation, and supervise the entire system . This is(a)Modbus RTU: Modbus RTU is a widely used communication protocol in industrial automation and control systems. It is part of the Modbus family of protocols and is designed for serial communication over RS-232 or RS-485 interfaces. Modbus RTU is known for its simplicity and efficiency in transmitting data between devices such as PLCs, HMIs, sensors, and other industrial equipment .Modbus RTU uses serial communication, which is well-suited for industrial environments. It can be transmitted over RS-232 or RS-485, allowing for long-distance communication and noise immunity;Modbus RTU follows a master–slave architecture, where a master device  initiates requests, and slave devices  respond to those requests. This architecture enables centralized control and data acquisition;Communication in Modbus RTU is based on frames or packets. Each frame includes a start bit, address, function code, data, and error-checking (CRC or LRC). The structure is designed for simplicity and ease of implementation;Modbus RTU supports various data types, including binary (coils), discrete inputs, input registers, and holding registers, allowing for the exchange of different types of data;The master device typically polls slave devices by sending requests for data. This polling mechanism allows the master to request specific information from each slave device;Modbus RTU is known for its efficiency and speed in data transmission. It is suitable for real-time control and monitoring applications in industrial settings.Key features and characteristics of Modbus RTU include:(b)Modbus ASCII: Modbus ASCII is another variant of the Modbus communication protocol used in industrial automation and control systems. Like Modbus RTU, it is designed for serial communication, but it employs a different encoding format .Modbus ASCII represents data using ASCII characters, making it more human-readable than Modbus RTU. Each 8-bit byte of data is converted to 2 ASCII characters;Modbus ASCII is character-oriented, and each character is transmitted as a single byte (8 bits). This makes it more suitable for systems where ASCII-based communication is preferred;Modbus ASCII devices can often communicate with Modbus RTU devices with proper configuration and protocol translation. This compatibility allows for flexibility when integrating different devices;The ASCII format of Modbus ASCII frames makes it human-readable, which can be advantageous for troubleshooting and debugging purposes;Modbus ASCII has a higher overhead compared to Modbus RTU due to the character-based encoding. This can result in slower data transfer rates, which may not be suitable for real-time applications.Key characteristics of Modbus ASCII include:(c)Modbus TCP operates over standard Ethernet networks, allowing for fast and efficient data transmission. It is well-suited for modern industrial environments and can be used alongside traditional office IT networks;Modbus TCP follows a client–server architecture. In this setup, client devices  request data from server devices (slave devices), and the server responds with the requested information. This architecture allows for distributed control and monitoring;Modbus TCP uses standard TCP/IP communication protocols. It relies on the widely used Transmission Control Protocol (TCP) to establish connections and ensure reliable data transfer;Unlike Modbus RTU and Modbus ASCII, which use character-based frames, Modbus TCP uses binary frames. Each frame consists of a transaction identifier, protocol identifier, length field, unit identifier, function code, and data. This binary format allows for efficient data transmission;Modbus TCP offers high-speed data transmission, making it suitable for real-time control and monitoring applications. Ethernet’s speed and efficiency contribute to the quick exchange of data;Modbus TCP is widely used in various industries and is considered a standard for Ethernet-based communication in industrial automation and control systems;Similar to other Modbus variants, Modbus TCP is an open and standardized protocol, allowing devices from various manufacturers to communicate as long as they adhere to the protocol specifications;Devices using Modbus TCP communicate based on IP addresses, making it possible to have devices distributed across a network or even connected over the internet.Modbus TCP: Modbus TCP uses the more modern Ethernet communication protocol and is frequently employed in industrial automation and control systems to establish network connections with devices such as PLCs, HMIs, and sensors . Below aA group of researchers proposed the Modbus/TCP Security protocol, which incorporates authentication and authorization mechanisms to ensure protection against deliberate unauthorized access as an enhancement for improved security in the ICS framework .(d)IEC 60870-5-104: It is an unencrypted protocol, meaning it transmits data in plain text without any authentication mechanism over TCP/IP.IEC-60870-5-104 is an international standard providing communication standards between the SCADA system and substations. In transmission, the application layer of this protocol conveys an application service data unit(ASDU).(e)IEC 61850: It is a collection of communication norms that outline protocols for designating devices, data, and communication systems linked to the automation of electric power substations .The IEC 61850 standard presents guidelines for establishing best practices in substation engineering, encompassing protection, monitoring, integration, metering, testing, and control. Within the domain of substation automation, the need for high-speed communication is imperative to meet the data transfer rates required by modern automatic control and monitoring systems (source: ).The IEC 61850 standard delivers services, protocols, and a structure engineered to streamline the modeling and communication of Intelligent Electronic Devices (IEDs) and supervisory equipment in power system automation .Process Layer: The process layer includes various primary equipment and intelligent electronics components, realizing the major functions of smart substations. The process layer within the substation involves gathering data from transformers and transducers that are interconnected with the primary power system process ;Interval Layer: This includes secondary devices like relay protection equipment and control devices and functions as a barrier between the other two layers, guaranteeing safe and dependable operations;Station Control Layer: This layer primarily handles the monitoring and management of the intelligent station, enabling comprehensive measurement and control capabilities for the entire station.The substation communication system is divided into three layers by IEC 61850: the process bus, the interval, and the station.(f)IEC 61400-25: This protocol is specially designed to communicate the wind farm supervisory system and is an extension of the IEC 61850 standard in wind power generation. The basic purpose of this protocol is to provide network communication standards between the wind farm supervisory system and other subsystems and to realize the equipment’s interoperability with different manufacturers. IEC 61400-25 interface uses MMS and web service for remote supervisory control at wind power plants .(g)IEEE C37.118: In substations, this protocol is commonly used to establish synchronization and define the standards for data transmission formats. It outlines four distinct message types: data, header, configuration, and command. In the typical transmission process, these messages are converted into frames, and the PMU exclusively transmits data frames to other devices.(h)Message Queuing Telemetry Transport(MQTT): MQTT is a lightweight publish-subscribe messaging protocol designed for low-bandwidth, high-latency, or unreliable networks . It is w(i)Open Platform Communications (OPC): OPC is a set of standards for industrial communication, and it plays a crucial role in Industry 4.0, which focuses on the automation and digitization of manufacturing processes . OPC enaThey are three primary variations of the Modbus protocol, as seen below:Confidentiality: Unauthorized individuals can exploit this vulnerability to access confidential information about the ICS for illicit purposes;Availability: In the event of availability loss, the system could forfeit its capacity to maintain control, resulting in substantial economic losses;Integrity: When a missing or corrupted data packet is received, it renders the entire transmission process ineffective, causing significant disruptions to normal operations;Authorization and Authentication: Malicious actors may exploit this vulnerability by manipulating the function code to send arbitrary data to others, ostensibly under the guise of seeking constructive feedback. Prominent protocols lack authentication mechanisms for verifying identity, making it easy for unauthorized parties to obtain privileges and forge protocol packets.Given that the ICS integrates both cyber and physical subsystems, it possesses inherent vulnerabilities that render the system susceptible to attacks from both internal and external sources . Every fThe known vulnerabilities in protocols are examined, and the corresponding weaknesses are identified and documented accordingly; see The Industrial Control system should not only be able to deal with known attacks but also be resilient against any possible evasion tactics . With thIdentify threats to the organization, which generally includes the steps of inventorying system elements, defining metrics (how to measure the level of risk), and the threats are taken into account;Maintain ICS asset inventory of all hardware, software, and supporting infrastructure technologies, which makes it possible to establish a list of the company’s critical assets and processes. The impact analysis is carried out by examining the consequences on each of the security objectives: availability, integrity, and confidentiality ;Develop cybersecurity policies, procedures, training, and educational materials that apply to the organization’s ICS available on Cybersecurity and Infrastructure Security Agency ;Organizations should embrace adaptive cybersecurity measures for critical infrastructure by evolving policies beyond mere tools for enforcing predefined security requirements. These policies should become adaptive entities capable of responding and evolving in the face of emerging threats and attacks ;Develop and practice incident response procedures that join IT and OT response processes.Implement network segmentation whenever feasible, categorizing systems into network zones according to their roles, significance to the business, risk profiles, or other criteria established by the organization. To accomplish this, employ a filtering device like a packet filtering or stateful inspection firewall at the entry point of each zone. Ensure that each zone adheres to a clearly defined baseline, consistently applied to all systems within that specific zone . A netwoDesign a network topology for ICS that incorporates multiple layers, prioritizing the most crucial communications within the most secure and dependable layer ;The cost of a total system failure can be catastrophic in ICS. The use of true data diodes utilize proprietary software to control data flow and allow one-way network traffic to be handled properly . Data diEstablish demilitarized zones (DMZs) to configure a physical and logical subnetwork that serves as an intermediary for connected security devices, preventing direct exposure .Configure firewalls to control traffic between the ICS and corporate IT networks. Firewalls are network devices created to monitor and inspect incoming and outgoing traffic. They provide a layer of defense between networks. A set of rules, or access control lists (ACLs), can be established to allow or block certain packets between those networks ;Utilize IP geo-blocking that enables blocking outgoing and incoming network connections based on a geographic location . This teUse jump servers as a central authorization location between ICS network security zones. These measures aid in achieving network isolation between segments with varying security levels. Jump servers are sometimes used in conjunction with additional security tools such as firewalls and Intrusion Detection Systems (IDS) to create an exceptionally secure environment in alignment with the Defense-In-Depth concept ;Prohibit remote and ongoing vendor or employee access to the control network, including the use of backdoor passwords and maintenance accounts. Manufacturers should disclose in written documentation if they employ any such accounts ;Catalog and monitor all remote connections to the network. While playing important roles in the ICS context, PLCs and RTUs lack adequate security mechanisms to overcome buffer overflow exploits or man-in-the-middle and a wider array of other cyber attacks ,107. TheMeasuring the baseline of normal operations and network traffic for ICS researchers have proposed a method using machine learning combined with passive monitoring and a priori knowledge of protocols used. It is important that no measuring device or monitoring system interferes with the ICS environment under scrutiny ;Configure Intrusion Detection Systems (IDS) to create alarms for any ICS network traffic outside normal operations;Track and monitor audit trails on critical areas of ICS. Set up a Security Information and Event Management system (SIEM) to gather pertinent data from various origins, detect variances from established norms, and execute suitable responses ;Establish a SIEM system to oversee, analyze, and correlate event logs throughout the ICS network for the detection of intrusion attempts .Promote a culture of patching and vulnerability management. Patch management reduces cybersecurity risks and ensures production availability . Smart pTest all patches in off-line test environments before implementation;Implement application whitelisting on human–machine interfaces. Application whitelisting is a security technique that enhances security by allowing systems to run only those applications that have been explicitly approved and listed in a designated whitelist ;Harden field devices, including tablets and smartphones;Replace out-of-date software and hardware devices;After conducting thorough testing to confirm that it will not disrupt ICS operations, disable unused ports and services on ICS devices;Implement and test system backups and recovery processes;Configure encryption and security for ICS protocols.Machine learning, a branch of artificial intelligence (AI) and computer science, centers on utilizing data and algorithms to mimic the learning process of humans, with the aim of progressively enhancing its accuracy . ApplyinThis approach entails training a machine learning model on a dataset that represents normal behavior, enabling it to identify deviations or anomalies effectively . It can The strength of different machine learning anomaly detection techniques can vary depending on the specific use case, dataset, and goals of the anomaly detection task. (a)Support Vector Machines (SVM): SVM is a widely employed supervised learning algorithm for tasks involving classification . In anomRandom Forest: Random Forest is an ensemble learning technique that amalgamates numerous decision trees. In anomaly detection, each decision tree is trained on labeled data, and the final decision is made based on the majority vote of the trees. Random Forest can handle high-dimensional data and is effective at identifying anomalies. Random Forests are collections of Decision Trees, binary classifiers consisting of one root node, several internal split nodes, and leaf nodes that are used to classify events ;Neural Networks: Neural networks, such as feed-forward networks or recurrent neural networks (RNNs), can also be used for supervised anomaly detection. These models are trained using labeled data and have the capability to grasp intricate patterns and relationships within the data .RNNs are useful with ICS data. The employment of parallel multi-view neural networks to identify anomalies within an industrial control system has been studied recently. These networks achieve this by forecasting operational states. Integrating this predictive ability into the system enables semi-supervised monitoring of system operations, ensuring that the real-time system state aligns with a predefined region within the state space forecast earlier by the neural networks. Additionally, in cases where the two predictive models disagree in their assessment of the system’s state (leading to a lack of consensus), it is probable that the system’s operation has been compromised. This divergence could be attributed to issues such as faulty equipment, communication errors, or other sources of malfunction. To obtain distinct perspectives on the system, one of the predictive models is trained to analyze the data flow from system control packets, while the other model is trained to examine gyrometric signals collected from physical sensors within the control system ;Gradient Boosting: Gradient Boosting is an ensemble learning approach that blends several weak learners, such as decision trees, to construct a robust predictive model . It iterDeep Learning Autoencoders: Autoencoders are neural network structures that acquire the ability to encode input data into a reduced-dimensional representation and subsequently decode it to reconstruct the original input. By training an autoencoder on a large dataset of normal behavior, it learns to reconstruct the normal data accurately . AnomaliSupervised machine learning-based anomaly detection approaches: Supervised machine learning-based anomaly detection approaches can be applied to strengthen the cybersecurity of ICS . It invo(b)Isolation Forest: Isolation Forest is a tree-based algorithm that isolates anomalies by recursively partitioning data until each data point is isolated in its tree leaf. Anomalies are identified as instances that require fewer partitions to isolate. The algorithm can be categorized into two main stages: Forest construction and element evaluation. During the creation of individual trees, the sample element set is divided. More precisely, nodes for isolating trees are created by randomly selecting an attribute and its associated partition. Conversely, the evaluation function focuses on navigating the analyzed element through these trees ;Density-Based Clustering (like DBSCAN): Density-based clustering methods group data points based on their density. In ICS, these methods can help identify clusters of normal behavior and consider isolated points as anomalies . This apLocal Outlier Factor (LOF): LOF calculates the density of data points with respect to their neighbors. In ICS, LOF can identify points with significantly lower density as anomalies . LOF aimOne-Class Support Vector Machine (OCSVM): One-Class SVM is designed for novelty detection and can be used in ICS to learn the boundaries of normal behavior and classify instances. OCSVM can train anomaly detection model with only one class of samples. Furthermore, OCSVM can build a more accurate model and has robustness for noise samples. OCSVM has been proven to be an effective machine learning method for intrusion detection in industrial control systems ;Gaussian Mixture Models: GMM assumes that data points are generated from a mixture of several Gaussian distributions. Anomalies can be detected as instances with low probabilities under the fitted GMM. In their study, certain researchers employed a statistical traffic analysis approach that relies on the Gaussian mixture model. This method was utilized to discern the presence of anomalies, such as man-in-the-middle attacks, within a communication process by analyzing the timing of traffic communication. In modern network environments, the usual communication process tends to demonstrate a significant level of stability during normal conditions, resulting in the convergence of its communication timings to a relatively consistent range of values. Nevertheless, if there is a departure in the time elapsed for traffic generated by a particular communication compared to the pattern observed in historical data, it is a reasonable indication that anomalies, like potential man-in-the-middle attacks, might be occurring in this process .Unsupervised machine learning-based anomaly detection approaches: These play a crucial role in enhancing the cybersecurity of ICS by identifying abnormal behavior or potential cyber threats without needing labeled data. Here are some common unsupervised anomaly detection approaches used in ICS: (c)Random Forest (RF): In response to these challenges, a power industrial control system intrusion detection model based on Random Forest was introduced. Additionally, the same study introduced an enhanced grid search algorithm (IGSA) designed to optimize the hyperparameters of the RF intrusion detection model, thus enhancing its efficiency and effectiveness. The proposed IGSA significantly accelerates computation speed, reducing it from O(nm) to O(n × m). Following the hyperparameter optimization process, the suggested model was evaluated using a publicly available power industrial control system dataset. The experimental findings illustrate that our approach attains outstanding detection performance, achieving an impressive accuracy rate of 98%. Moreover, it surpasses comparable efforts within the same category . The ens–Autoencoders: Autoencoders are neural network architectures that learn to reconstruct the input data. They can be used for anomaly detection by identifying instances with high reconstruction error . These a–Isolation Forest: The Isolation Forest algorithm is rooted in the Decision Tree algorithm. It identifies outliers by randomly selecting a feature from the available feature set and then randomly choosing a split value within the range of that feature’s maximum and minimum values. This random partitioning of features leads to shorter paths in trees for anomalous data points, effectively distinguishing them from the majority of the data ;–Density-Based Clustering: The hypothesis is that if two packets belong to the same attack type, they are more likely to fall into the same cluster when any clustering algorithm is applied with any hyperparameters. In other words, when several clustering algorithms are applied, the more two samples fall into the same cluster, the more likely they belong to the same attack type .Unsupervised Learning: Unsupervised learning does not necessitate labeled data and proves beneficial when obtaining labeled data is scarce or challenging. Common unsupervised learning algorithms for IDS in ICS include:–Reinforcement Learning: Reinforcement learning can be used in IDS for dynamic decision-making in response to evolving cyber threats. However, it might be less commonly used due to the need for careful tuning and potential risks in real-world environments . A team –Deep Learning: Deep learning models, including recurrent neural networks (RNNs) and convolutional neural networks (CNNs), can be utilized in IDS to capture intricate patterns and temporal dependencies within ICS data .Semi-Supervised Learning: Semi-supervised Learning combines labeled and unlabeled data during training. This can be useful in scenarios where obtaining labeled data is costly or time-consuming:Secure Authentication and Authorization: Machine learning can enhance authentication and authorization processes, making it more difficult for attackers to bypass access controls. Reinforcement learning methods, like Q-learning, can be utilized for IoT device authentication and the identification of jamming and malware attacks. These techniques acquire knowledge from the environment, whether on the cloud or high-computational edge devices, without relying on a pre-established training dataset ;Leveraging Machine Learning for Predictive Maintenance in ICS: A group of researchers introduced a Predictive Maintenance approach that enables the adoption of dynamic decision rules for maintenance management, even in scenarios involving high-dimensional and censored data challenges. This is accomplished by training multiple classification modules with varying prediction horizons, offering diverse performance trade-offs concerning the frequency of unforeseen failures and unused equipment lifespan. Subsequently, this information is integrated into an operational cost-driven maintenance decision system to minimize anticipated expenses. The efficacy of this methodology is showcased through both a simulated illustration and a benchmark maintenance problem in semiconductor manufacturing .Intrusion Detection Systems (IDS): Machine learning, when integrated into IDSs, has yielded favorable outcomes by leveraging various learning approaches, encompassing supervised, unsupervised, and reinforcement learning ,169. MacThe above mentioned machine learning techniques for anomaly detection are powerful tools for identifying outliers and unusual patterns in data, but they come with limitations and challenges. Data Quality and Quantity: ML models require large amounts of high-quality, labeled data for training. In cybersecurity, obtaining such data can be difficult due to the scarcity of certain types of cyber attack data or the potential risks associated with using real-world attack data . AnotherImbalanced Data: In cybersecurity, the number of normal instances (benign data) often outweighs the number of malicious instances (attack data), resulting in imbalanced datasets. This can lead to biased models and poorer performance in detecting rare cyber threats ;Adversarial Attacks: Adversaries can attempt to manipulate ML models by crafting adversarial examples, which are carefully designed inputs to cause misclassification. Adversarial attacks can reduce the reliability and robustness of ML-based cybersecurity solutions . As per Logic manipulation: In this instance, a malicious actor targets the machine learning model by manipulating the model’s logic in order to interfere with the learning outcomes. This is regarded as one of the most significant threats to the machine learning process . A singlMachine learning models impose stringent demands regarding the dimensions, configurations, and formats of input data: Despite the vast amounts of data that Cyber-Physical Systems (CPS) collect, there is no assurance of data quality, particularly as the lifespan of newly introduced IoT hardware may remain unverified. To prepare input data for machine learning, it must undergo transformation from its raw state into a specific data format. This transformation process can result in substantial computational expenses. Alternatively, machine learning systems must possess the capability to inherently manage and adapt to the raw data and associated noise.ML methods have demonstrated significant potential in improving cybersecurity but encounter various challenges. Some of the key challenges of using machine learning in cybersecurity include:Threat Modeling and Risk Assessments: Conduct thorough threat modeling and risk assessments to identify critical assets, vulnerabilities, and potential attack vectors. Use this information to prioritize security measures based on risk levels . Since aSecurity-by-Design: Incorporate cybersecurity considerations from the early stages of ICS development and implementation. Security-by-design principles can help minimize vulnerabilities and reduce the cost of retroactively implementing security measures;Remote Continuous Monitoring and Incident Response: Implement real-time monitoring of ICS networks and establish efficient incident response plans to quickly detect and mitigate cyber threats with less human intervention;Intelligent Hardware Security: Develop and adopt hardware security measures, such as secure boot, cryptographic processors, and physical tamper detection, to enhance the overall security posture of ICS components;Develop diverse machine learning models: Machine learning models should be trained to manage diverse tasks to make it possible to address more than one security situation. Machine learning models trained for a specific problem, or can at most be retrained to another similar task;Automation and Response: Artificial Intelligence can automate the response to certain security incidents. For example, AI-driven security orchestration can isolate compromised systems, block malicious traffic, and initiate incident response processes;Collaborative Threat Intelligence: Artificial Intelligence can facilitate the sharing of threat intelligence among organizations, enabling them to collectively defend against emerging threats that target ICS environments;Robustness Testing and Simulation: AI can assist in simulating potential attack scenarios to identify vulnerabilities and weaknesses in ICS systems, helping organizations proactively strengthen their security posture;Continuous Monitoring and Updating: Cyber threats evolve, so it is crucial to continuously monitor the system’s performance and update the machine learning models accordingly. Regularly retraining the models with new data and adapting to emerging attack patterns is necessary.This article has comprehensively examined the intricate facets of ICS security. Its primary goal has been to provide novel insights and foster the growth of knowledge within the ICS security domain. Throughout the article, considerable attention has been dedicated to the exploration of the fundamental elements influencing decision-making in ICS design. A broad spectrum of established security measures has been meticulously evaluated, alongside an in-depth analysis of the integration of cutting-edge methodologies such as machine learning to fortify security measures. The holistic approach taken within the article ensures a profound comprehension of the complexities inherent to ICS security, thereby proposing the integration of machine learning, particularly in the context of training models for diverse tasks, as a potential solution to address a myriad of security scenarios. Additionally, it analyses the necessity of incorporating cybersecurity considerations right from the outset of ICS development. Regular retraining of machine learning models with up-to-date data to effectively adapt to evolving attack patterns has been recommended in this article. The article’s emphasis on both the identification of challenges and the formulation of practical recommendations not only communicates the current findings but also lays a solid foundation for future research endeavors and improvements in the realm of ICS security.The insights presented in this article serve to advance the field of ICS security and provide valuable guidance for enhancing the security of critical infrastructure. By considering the recommended strategies we shall continue the research and support organizations to better protect their ICS environments against evolving cyber threats and contribute to the overall resilience and reliability of Industrial systems.Furthermore, it is essential for future research to maintain a dynamic approach to ICS security. The landscape of threats is in a constant state of flux, with adversaries continuously refining their tactics. Consequently, upcoming investigations should prioritize the development of adaptable security strategies capable of responding to emerging threats. This entails the establishment of self-learning security systems with the ability to dynamically adjust their defensive mechanisms, making effective use of artificial intelligence and machine learning for real-time threat intelligence and preemptive threat mitigation. Additionally, fostering interdisciplinary cooperation between experts in cybersecurity, control systems engineering, and data science is crucial for crafting holistic security solutions that encompass both the technical and operational dimensions. In an era marked by the proliferation of digitalization and increased connectivity in industrial contexts, proactively outmaneuvering adversaries and preemptively countering nascent risks holds paramount importance in preserving the integrity of critical infrastructure and upholding the dependability of industrial systems.


Social support (SS) is important in diabetes self-management; however, little is known about how different types of SS influence diabetes outcomes in men and women with type 2 diabetes mellitus (T2DM). Therefore, the aims of this study were to investigate the relationships between types of SS and glycemic control and self-care behaviors and assess whether the relationships differ by gender.Cross-sectional study of 615 adults from two primary care clinics in the southeastern U.S. Outcomes were hemoglobin A1c (HbA1c) extracted from the medical records, and self-management behaviors  measured using the Summary of Diabetes Self-Care Activities (SDSCA). Independent variable was SS  measured using the Medical Outcomes Study (MOS) SS Scale. Structural equation modeling (SEM) was used to understand pathways between SS and glycemic control based on a theoretical model.Tangible support was significantly associated with self-care  and affectionate support was marginally associated with glycemic control  for both men and women. Using SEM to test gender invariance, there was no statistically significant difference in the meaning of SS between men and women. However, unique invariances in responses occurred, including a stronger relationship between tangible support and self-care for women .Of the four components of SS, tangible and affectionate support had the strongest influence on glycemic control. While affectionate support will improve glycemic control in both men and women, tangible support will improve self-care management, particularly in women. Affecting more than 34 million adults in the United States , diabeteAchieving glycemic control requires a comprehensive approach to diabetes management that includes routine visits to providers along with adequate self-care such as eating a healthy diet, being physically active, adhering to prescribed medication plans, and monitoring blood glucose levels . Daily sEvidence proposes different mechanisms for the relationship between social support and diabetes that are facilitated through the exchange of knowledge and information and assistance with access to resources ; howeverFrom the Medical University of South Carolina and the Ralph H. Johnson VA Medical Center, two primary care clinics in the Southeast United States, 615 adults were recruited Eligibility included age of 18 years and older, a diagnosis of diabetes documented in the medical record, and the ability to communicate in English. Ineligibility included a determination by the research coordinator that the participant had dementia, cognitive impairment, or active psychoses, such that they could not complete the survey. Based on a review of the medical records, potentially eligible patients were sent letters of invitation and approached in the waiting room during medical visits, where they were provided a detailed explanation of the study. After a detailed explanation of the study procedures, each patient who was eligible and expressed interest provided written consent to participate in this one-time research study and were administered validated questionnaires capturing social determinants of health and diabetes self-care information. Surveys included in the questionnaire were based on the conceptual framework developed by Brown et al. regarding the influence of social determinants of health on diabetes outcomes . After cPreviously validated questionnaires from the National Health Interview Survey (NHIS) were used to collect demographic information including age, race/ethnicity, gender, marital status, annual household income, educational level, employment status, diabetes duration, and comorbidity status . In addiSocial support was assessed using the Medical Outcomes Study (MOS) Social Support survey, a 19-item scale measuring multiple dimensions of functional social support: (1) emotional/informational support—the expression of positivity, understanding, and encouragement of feelings/the provision of advice, information, guidance, and feedback; (2) tangible support—the provision of materials and assistance with behaviors; (3) affectionate support—the expression of love and affection; and (4) positive social interaction—the companionship of others to do fun things with . IndividParticipants self-reported gender, which was used in stratified models to investigate gender differences.The 11-item Summary of Diabetes Self-Care Activities (SDSCA) scale was used to assess diabetes self-care . ManagemHbA1c levels were abstracted from the electronic medical record for values within the 6 months prior to survey administration; this timepoint was used to increase the likelihood of identifying individuals who recently received care.Structural equation modeling (SEM) was used to understand pathways between social support and glycemic control based on a theoretical model, that components of social support would have an influence on diabetes self-care behaviors and glycemic control . SEM allA sample size of 615 adults was sufficient to ensure a 20:1 ratio (subject: variables) recommended to maintain 80% power in structural equation modeling , 28. ThiFirst, a series of descriptive statistics were performed to describe the population, and investigate the normality of variables, and correlations between constructs. Data met multivariate normal and linearity assumptions . Second,Tables Of the four components of social support, tangible and affectionate support had the strongest influences on glycemic control. While men and women have the same structural representation and meaning for each of the four components of social support, there were gender differences in the relationship between these components and diabetes self-care and outcomes. Based on these results, attention to affectionate support will help improve glycemic control in both men and women, whereas, providing tangible support may help improve self-care management, particularly among women. In summary, these findings suggest the development of future interventions that include components of social support, specifically affectionate support targeted at improving glycemic control in both men and women with T2DM, and tangible support tailored to improve self-care behaviors in women with T2DM.In our study, we found men and women with diabetes to share the same meaning of social support, and tangible and affectionate support to be the components of social support most associated with diabetes-related outcomes. Specifically, tangible support was associated with improved self-care for both men and women, but more so for women. In a study to determine the types of social support predictive of daily activities among older adults without diabetes, Hand et al found greater perceived tangible support as a type of support strongly associated with participation in daily activities . SimilarWhile the various mechanisms directly and indirectly influencing the relationship between social support and glycemic control remain indeterminate, positive and constructive social interactions can reasonably be considered as facilitators underlying the process. Evidence suggests illness-specific support often results in more favorable outcomes and predictive health behaviors compared to general or global support . In diabThis study has limitations that are worth mentioning, First, the data are cross-sectional, which limits the ability to infer causality or direction of effect. While the methodology used to analyze data in this study is useful for elucidating pathways, additional research using longitudinal data is warranted to identify direction of effect. Second, this study was conducted in adults residing in the southeastern United States; therefore, the generalizability of these findings to adults living in other geographic locations may be limited. Future research elsewhere is needed to validate these study findings. Third, one questionnaire was identified and used to assess diabetes self-care activities in this sample; the same was done to assess social support. Alternative tools for assessing these variables could have yielded different results. Fourth, the research assistants determined whether individuals were able to complete the survey instruments, which could have introduced selection bias. Future research should include projects where study participants are randomized into groups to allow for comparison between individuals with similar characteristics. Finally, additional factors can influence the latent and measured variables assessed in the study and may further explain relationships and underlying mechanisms. Additional studies should account for these confounding factors.The results of our study are important and provide new information about gender differences in the relationship between social support and diabetes-related outcomes. Components of social support, specifically affectionate and tangible support, were found to influence glycemic control and self-care by gender. Specifically, in this sample of adults with T2DM, the meaning of social support did not differ between men and women; however, affectionate support was associated with improved glycemic control in both men and women, and tangible support was associated with improved self-care behaviors in women. These findings point to the need for tailored interventions utilizing affectionate and tangible support to improve clinical and behavioral outcomes in adults with T2DM.S1 File(DOCX)Click here for additional data file.S2 File(DOCX)Click here for additional data file.


Attempts to use computers to aid in the detection of breast malignancies date back more than 20 years. Despite significant interest and investment, this has historically led to minimal or no significant improvement in performance and outcomes with traditional computer-aided detection. However, recent advances in artificial intelligence and machine learning are now starting to deliver on the promise of improved performance. There are at present more than 20 FDA-approved AI applications for breast imaging, but adoption and utilization are widely variable and low overall. Breast imaging is unique and has aspects that create both opportunities and challenges for AI development and implementation. Breast cancer screening programs worldwide rely on screening mammography to reduce the morbidity and mortality of breast cancer, and many of the most exciting research projects and available AI applications focus on cancer detection for mammography. There are, however, multiple additional potential applications for AI in breast imaging, including decision support, risk assessment, breast density quantitation, workflow and triage, quality evaluation, response to neoadjuvant chemotherapy assessment, and image enhancement. In this review the current status, availability, and future directions of investigation of these applications are discussed, as well as the opportunities and barriers to more widespread utilization. Breast cancer is the most common cancer in women of the United States, excluding skin cancers, and represents nearly 1 in 3 new female cancers each year. According to the American Cancer Society, there will be nearly 300,000 new cases of invasive breast cancer and over 50,000 cases of ductal carcinoma in situ diagnosed in 2023, with over 43,000 deaths attributable to breast cancer in the United States alone [Population based screening efforts have led to a large number of mammograms being performed annually, with nearly 40 million mammograms performed every year in the United State alone . The impThe convergence of screening mammography as a widespread population health tool with opportunities to improve performance to reduce breast cancer mortality has generated significant interest and research. Using computers in an attempt to improve performance is not new and has a long history in breast imaging in the form of computer-aided detection (CAD). The FDA first approved CAD for use in mammography in 1998, and by 2002, this technology was reimbursable by the Center for Medicare and Medicaid Services. This approval led to its rapid adoption in breast imaging, with 74% of mammograms in 2008 performed with CAD [The initial excitement and enthusiasm for the benefits of CAD in breast imaging have given way to the realization that traditional CAD may yield limited or no increases in diagnostic performance . MultiplAI is a large field that includes many diverse technologies and applications with the shared characteristics of using computer-based algorithms and data to solve problems or perform tasks that would typically require human intelligence. In the past 10–15 years, there have been tremendous advances in the availability and accessibility of more powerful computational hardware for processing and storing data needed for AI applications. At the same time, and perhaps even more critically, there has been an exponential increase in the amount and availability of data for training AI algorithms. These changes have allowed for revolutionary developments in AI during the past 10 years, with particular focus on machine learning (ML). ML is a subset of AI in which computers are trained and perform functions without being explicitly programmed by humans on how to complete those tasks. ML commonly uses features and input from human programmers as the basis of learning. Further along the continuum of ML is representation learning, which does not require human feature engineering, but rather involves a system learning the features itself. Deep learning (DL) is a step further, where the features are extracted in a hierarchical fashion and with many simple features making up more complex features . These cDL utilizing convolutional neural networks has seen an explosion of possibilities and practical uses for image analysis for non-medical images in the past 10 years. This includes many non-medical imaging related tasks such as image classification or detection, which are already deeply ingrained in daily workflows. These successes have led to interest for applications within radiology that could apply the success of AI algorithms in image analysis to perform clinically meaningful tasks such as classification (presence or absence of disease), segmentation , and detection (determining the presence or absence of a lesion or nodule) amongst many other diverse applications for AI in radiology .®) from the American College of Radiology facilitates the development and implementation of AI. BI-RADS® provides a standardized and structured system of lexicon and terminology, reporting, classification, communication and medical auditing for mammography, breast ultrasound, and breast MRI [Breast imaging has many unique features and characteristics that create opportunities for meaningful AI applications . Specifieast MRI . This syeast MRI . MoreoveThis standardization and established methodology for determining and tracking results has facilitated the creation of multiple large data sets which are a prerequisite for the development of high-performing AI algorithms. There are currently multiple large mammography data sets, some of which contain more than 1 million mammograms with associated patient factors and known clinical outcomes ,12,13,14There are several unique aspects of breast imaging that make the development and implementation of high-performing AI algorithms more challenging . For exaThere are also significant variations in the appearance of DBT images between various vendors, with the differences being significantly greater than when comparing traditional FFDM mammographic images. Further compounding these challenges are the recent but variable use of synthetic mammographic images to replace traditional FFDM images. These synthetic images are generated from tomosynthesis imaging data, a method which has the advantage of eliminating the need for standalone FFDM images and thus significantly reduces the radiation dose for patients. The utilization of synthetic mammography is highly variable . MoreoveAn additional significant challenge for the development of high-performing AI algorithms is the manner in which breast images are interpreted. Frequently, breast imaging studies are interpreted with the utilization of multiple prior comparison imaging exams, allowing radiologists to identify new, subtle, meaningful changes and dismiss stable, benign variations. This is an additional process that must be either built into AI algorithms or otherwise accounted for in their application. Additionally, the interpretation of breast imaging is commonly a multimodal process, particularly outside of the screening mammography environment. Often, mammography is used in conjunction with breast ultrasound, breast MRI, or other adjunctive imaging modalities to evaluate and work up breast problems. These tasks are also performed against a complex background in which the radiologist aggregates information in real time about patients’ clinical and medical history, including risk scores amongst other factors, referring providers, and technologists, which can influence the most efficacious workup and diagnosis. These different, disparate data sources and factors represent challenges for the development of high-performing AI algorithms.Breast cancer screening programs rely on screening mammography to reduce the morbidity and mortality of breast cancer. Much of the published literature and available AI applications focus on cancer detection for mammography. However, in addition to cancer detection, there are several potential interpretive and non-interpretive applications for AI in breast imaging including decision support, risk assessment, breast density quantitation, workflow and triage, quality evaluation, response to neoadjuvant chemotherapy assessment, and image enhancement .Much of the research, development, and excitement surrounding AI applications in breast imaging have been focused on cancer detection, notably cancer detection in screening mammography . The widThere have been many published examples of AI algorithms which demonstrate excellent performance in cancer detection for screening mammography. These include a number of algorithms trained and evaluated on single-institution or homogenous internal data sets. However, there have also been multiple, more recent examples of AI algorithms trained on larger, more heterogenous or representative data sets. These includes an AI-based cancer detection system trained on United Kingdom (U.K.) and United States (U.S.) data comparing AI performance vs. radiologist performance in a reader study finding absolute reductions of 5.7% and 1.2% in false positives and 9.4% and 2.7% in false negatives  . The AI Such investigations have generated tremendous excitement for using AI applications for breast cancer detection, with multiple commercially available products already available for use on the market, in addition to other investigational or open-source AI algorithms. However, there is currently a significant gap in the understanding of how these AI applications will perform in the real world when used in clinical practice by radiologists. A recent review article found no prospective studies testing accuracy of AI in screening practice . The revExternal attempts to evaluate the performance of AI algorithms have resulted in variable observed performance. For example, a high-performing AI model demonstrated significantly inferior performance when used at an external site in its native form . This saDBT represents an additional challenge when interpreting the available literature and evaluating AI performance for clinical use. Many of the large available data sets for training and previously published AI algorithms were created and validated entirely or predominantly using FFDM data sets. As DBT has gained widespread adoption and a high level of utilization, this creates more uncertainty when attempting to generalize the expected performance of commercially available or investigational AI algorithms into clinical practice. A recent, large study evaluating a well-known commercially available AI algorithm’s performance on FFDM versus DBT found significantly diminished levels of performance for the AI algorithm with the DBT data . The AI The high level of interest and focus on developing improved AI algorithms for screening mammography has led to the RSNA Screening Mammography Breast Cancer Detection Competition of 2023 . This coThe development and evaluation of AI tools for cancer detection in breast imaging have overwhelmingly been focused on mammography. This is intuitive given the immense number of mammography exams that are performed worldwide and the relatively standardized nature of mammography. There have however been additional investigations regarding AI to increase cancer detection with breast ultrasound, breast MRI, and contrast-enhanced mammography. A recent retrospective reader study evaluating hybrid AI and radiologists’ performance in the interpretation of screening and diagnostic breast ultrasounds found preserved sensitivity for breast cancer detection with the hybrid AI workflow, with the advantage of reducing false positives by 37.3% and decreasing benign biopsies by 27.8% for screening ultrasounds . ScreeniImproving the efficacy of breast imaging interpretations is not restricted to cancer detection on screening exams. There is also a need to improve radiologists’ diagnostic performance when a lesion or area of interest is identified. Many opportunities for improvement are available in the realm of decision support, including limiting benign biopsy recommendations and minimizing false-negative interpretations. Applications of decision support have been studied in several different scenarios across various breast imaging modalities. A study evaluating an AI-based clinical decision support application for DBT found that radiologists using the decision support system were able to increase sensitivity while preserving specificity, thus reducing the likelihood of false-negative interpretations without increasing benign biopsy recommendations . A separDecision support opportunities in breast imaging extend beyond mammography. A common diagnostic problem encountered is appropriately stratifying breast masses identified on an ultrasound as either benign, needing short-term follow-up, or requiring biopsy for tissue diagnosis. A multicenter retrospective review of a commercially available AI breast ultrasound decision support application found that radiologist reader performance increased significantly when using the AI decision support system, with the AUC increasing from 0.83 without decision support to 0.87 with decision support . InteresBreast density reflects the mammographic amount of fibroglandular tissue in the breast, designated into four categories by BI-RADS: (a) almost entirely fatty, (b) scattered areas of fibroglandular density, (c) heterogeneously dense, which may obscure small masses, and (d) extremely dense, which lowers the sensitivity of mammography. Approximately 40% of women in the United States have dense breasts, designated as category c or d . Breast The accuracy of breast density reporting can be subject to interpersonal and intrapersonal variability amongst radiologists, highlighting the value of computer-based assessment in the standardization of breast density reporting. Early iterations required manual input to outline and define breast tissue density . NumerouIdentifying women at increased risk of breast cancer is as an important assessment when determining the need for additional screening and preventative intervention. Current risk assessment models estimate the average risk of breast cancer for women with similar risk factors, as opposed to individual breast cancer risk. These models include the Gail model (BCRAT), Tyrer–Cuzick model (IBIS), Breast and Ovarian Analysis of Disease Incidence and Carrier Estimation Algorithm model (BOADICEA), BRCAPRO, and Breast Cancer Surveillance Consortium model (BCSC). Each of these models accounts for different factors such as age, age of menarche, obstetric history, first-degree and multi-generational relatives with breast cancer, genetic information, number of previous biopsies, race and ethnicity, and body mass index, amongst other factors. The models calculate 5-year, 10-year, or lifetime risk of breast cancer and are used to identify women who may benefit from supplemental high-risk screening for breast cancer, chemoprevention, or lifestyle modifications. As the different models rely on unique combinations of risk factors, including some factors while excluding others, there are several limitations to a sole model being used to independently predict cancer risk. For example, the Gail model can underestimate the risk of breast cancer in women with familial history of breast cancer or a personal history of atypia, as well as in non-American and non-European populations . In a stNew developments in AI image-based risk models demonstrate promising results in cancer risk assessment, in some instances outperforming traditional cancer risk assessment models. A case-cohort study of an AI image-based mammography risk model assessed the short-term and long-term performance of its model compared to the Tyrer–Cuzick version 8 model over a period of 10 years . The imaMirai, a DL mammography-based risk model, incorporates digital mammographic features along with clinical factor inputs to provide breast cancer risk prediction within 5 years and was recently validated across a broad, diverse international data set . ApproxiAI-based triage tools can be used to prioritize patients and improve overall workflow for radiologists interpreting breast imaging studies. This has been most well-studied with screening mammography. Using AI-based triage algorithms, a retrospective simulation study in which AI-based screening  was compared to radiologist screening found non-inferior sensitivity and higher specificity  . The finAnother study evaluating an AI system used in the detection of lesions on DBT found that when the algorithm was concurrently incorporated into the interpretation of the mammograms, it reduced reading times by approximately half while still improving accuracy with a statistically significant 0.057 average improvement in AUC . As readThe importance of maintaining high-quality positioning and technique has long been a focus for mammography. MQSA includes a significant focus on ensuring standardization and quality for mammography in the United States. Poor positioning is often identified as a leading cause of clinical imaging deficiencies and misdiagnosis . This haAI may also be used to assess treatment response to neoadjuvant chemotherapy for breast cancer. Neoadjuvant chemotherapy (chemotherapy given prior to surgery) can reduce tumor size, allowing for less-invasive surgical procedures. It also enables in vivo evaluation of treatment response, allowing therapeutic treatment plans to be modified based on each patient’s individual response . Despiteinitiation of neoadjuvant chemotherapy. A proof-of-concept study by Skarping et al. demonstrated the effectiveness of a DL-based model using baseline digital mammograms to predict patient responses to neoadjuvant therapy, with an AUC of 0.71 [AI applied to imaging may predict tumor response to treatment prior to the  of 0.71 . Their m of 0.71 . These fThere have been several recent novel investigations and developments using AI algorithms to enhance the appearance of images in breast imaging. One creative example is the use of an AI-based process that first involved collapsing or merging suspicious regions of interest from DBT into ‘maximum suspicion projections’ that emphasize the suspicious findings, making them more conspicuous . These nAdditional investigations have evaluated using AI applications to reduce the amount of intravenous contrast dose needed for breast MRI examinations . This isThere are at least 20 available FDA-approved AI-based applications available today for breast imaging . Beyond However, there are significant barriers to the implementation of AI applications in breast imaging, including inconsistent performance, significant cost, and IT requirements, along with the lack of radiologist, patient, and referring provider familiarity and trust . AdditioDuring the first few months of 2023, there has been tremendous excitement and focus on a handful of AI natural language processing models, specifically large language models, that seem poised to generate evolutionary and disruptive change throughout many different fields and industries. ChatGPT, a conversation large language model, is perhaps the most well-known and discussed of these models and is extremely successful at automatically summarizing large inputs of information and answering questions in a conversational manner. Potential applications within breast imaging may include imaging appropriateness and clinical decision support, preauthorization needs, generating reports, summarizing information from electronic medical records, and creating interactive computer-aided detection applications . Given tWith the expanding use of AI in breast imaging, it will be necessary in the future to define the roles of radiologists and AI applications in clinical care to maximize the clinical benefit. These roles may change over time but in the near future may include tasks that are best served by AI alone, radiologists alone, or AI and radiologists together .In addition to defining the roles that AI and radiologists will play in patient care, it will be essential to build and shape the trust and perceptions of patients and referring providers towards AI in breast imaging. Patient attitudes and perceptions regarding AI in radiology are complex and include matters of distrust and accountability, concerns about procedural knowledge, a preference for preserving personal interaction, efficiency, and remaining informed about use . More geThe rapid evolution and expansion of the use of AI in breast imaging presents a tremendous opportunity to improve the quality of breast imaging provided for patients. Historically, the biggest challenges were the availability of sufficient computational power and data sets for creating and training AI applications. Today, some of the most significant challenges are validating AI performance across diverse data sets and patient populations and overcoming implementation barriers. In the future, the key challenges will likely include better defining the roles that AI should play in patient care and then communicating these decisions effectively to referring clinicians and patients. The value and opportunity of AI in breast imaging are clear, and as these challenges are met in the future, the full potential of AI to transform breast imaging can be realized.