Authors : Okafor, Chidozie Raymond Patrick; Otuonye, Anthony Ifeanyi; Nwanga, Emeka Mathew; Esomonu, Nkechi Faustina

Volume/Issue : Volume 11 - 2026, Issue 10 - October

Google Scholar : https://tinyurl.com/48pcdb7m

DOI : https://doi.org/10.38124/ijisrt/26Oct369

Note : A published paper may take 4-5 working days from the publication date to appear in PlumX Metrics, Semantic Scholar, and ResearchGate.

Abstract : Industrial control systems (ICS) increasingly operate within interconnected information and operational technology environments, where cyber incidents can propagate from communication networks to control functions and physical processes. Conventional incident response remains dependent on analyst judgement, predefined rules and sequential manual activities, potentially causing delays and inconsistency during numerous, rapid as well as technically complex incidents. Although recent research has advanced machine-learning-based detection, anomaly monitoring, security orchestration and automated containment, existing literature remains fragmented across individual stages of the incidentresponse lifecycle. This critical review examined automated cyberattack incident response in ICS through four (4) computational functions: attack detection, attack-vector classification, severity assessment and response selection. Evidence from ICS-security surveys, machine-learning studies, automated-response research, threat-evaluation frameworks, processaware monitoring and relevant standards were synthesized. The review revealed a principal research gap in effectively integrating detection outputs with appropriate and situation-specific response decisions. Hence, existing approaches frequently generated alerts and classifications without adequately incorporating asset criticality, physical-process consequences, response confidence, operational constraints and safety implications of autonomous actions. Accordingly, the review proposed an intelligent response pipeline that transforms heterogeneous security and process features into attack representations, classifies attacks, assigns sensitive severity levels as well as maps incident to appropriate response under explicit safety and human-oversight constraints. Priority research directions included: explainability, adaptive learning, data quality, benchmark limitations, response validation, adversarial robustness and safe autonomy. This synthesis, provided the foundation for developing intelligent computational models that progress from cyberattack detection, severityaware to sensitive incident-response selection in ICS environments.

Keywords : Industrial Control Systems; Cyber-Attack; Incident Response; Machine Learning; Severity Assessment; Automated Response; Explainable AI; Operational Technology; Security Orchestration.

References :

1. Alladi, T., Chamola, V., & Zeadally, S. (2020). Industrial Control Systems: Cyberattack trends and countermeasures. Computer Communications, 155, 1–8. https://doi.org/10.1016/j.comcom.2020.03.007
2. Aslam, M. M., Tufail, A., & Gul, H. (2025). Artificial intelligence for secure and sustainable industrial control systems: A survey of challenges and solutions. Artificial Intelligence Review, 58, 349. https://doi.org/10.1007/s10462-025-11320-9
3. Ding, D., Han, Q.-L., Xiang, Y., Ge, X., & Zhang, X.-M. (2018). A survey on security control and attack detection for industrial cyber-physical systems. Neurocomputing, 275, 1674–1683. https://doi.org/10.1016/j.neucom.2017.10.009
4. Ferdous, J., Islam, R., Mahboubi, A., & Islam, M. Z. (2023). A review of state-of-the-art malware attack trends and defense mechanisms. IEEE Access, 11. https://doi.org/10.1109/ACCESS.2023.3328351
5. Firoozjaei, M. D., Mahmoudyar, N., Baseri, Y., & Ghorbani, A. A. (2022). An evaluation framework for industrial control system cyber incidents. International Journal of Critical Infrastructure Protection, 36, 100487. https://doi.org/10.1016/j.ijcip.2021.100487
6. Goncharov, E., Kruglov, K., & Dashchenko, Y. (2019). Five ICS cybersecurity myths based on Kaspersky Lab ICS CERT experience. at-Automatisierungstechnik, 67(5). https://doi.org/10.1515/auto-2019-0016
7. Guembe, B., Azeta, A., Misra, S., Osamor, V. C., Fernandez-Sanz, L., & Pospelova, V. (2022). The emerging threat of AI-driven cyber attacks: A review. Applied Artificial Intelligence, 36(1), 2037254. https://doi.org/10.1080/08839514.2022.2037254
8. Jalalvand, F., Baruwal Chhetri, M., Nepal, S., & Paris, C. (2025). Alert prioritization in security operations centers: A systematic survey on criteria and methods. ACM Computing Surveys, 57(2). https://doi.org/10.1145/3695462
9. Karlzén, H., & Sommestad, T. (2023). Automatic incident response solutions: A review of proposed solutions' input and output. Proceedings of the 18th International Conference on Availability, Reliability and Security (ARES 2023), 37:1–37:9. https://doi.org/10.1145/3600160.3605066
10. Kim, H. M., & Lee, K. H. (2022). IIoT malware detection using edge computing and deep learning for cybersecurity in smart factories. Applied Sciences, 12(15), 7679. https://doi.org/10.3390/app12157679
11. Krombholz, K., Hobel, H., Huber, M., & Weippl, E. (2015). Advanced social engineering attacks. Journal of Information Security and Applications, 22, 113–122. https://doi.org/10.1016/j.jisa.2014.09.005
12. Mazini, M., Shirazi, B., & Mahdavi, I. (2019). Anomaly network-based intrusion detection system using a reliable hybrid artificial bee colony and AdaBoost algorithms. Journal of King Saud University – Computer and Information Sciences, 31(4), 477–484. https://doi.org/10.1016/j.jksuci.2018.03.011
13. McLaughlin, S., Konstantinou, C., Wang, X., Davi, L., Sadeghi, A.-R., Maniatakos, M., & Karri, R. (2016). The cybersecurity landscape in industrial control systems. Proceedings of the IEEE, 104(5), 1039–1057. https://doi.org/10.1109/JPROC.2015.2512235
14. Nelson, A., Rekhi, S., Souppaya, M., & Scarfone, K. (2025). Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile. NIST Special Publication 800-61 Rev. 3. National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-61r3
15. Ni, C., & Li, S. C. (2024). Machine learning enabled Industrial IoT Security: Challenges, Trends and Solutions. Journal of Industrial Information Integration, 38, 100549. https://doi.org/10.1016/j.jii.2023.100549
16. Page, M. J., McKenzie, J. E., Bossuyt, P. M., Boutron, I., Hoffmann, T. C., Mulrow, C. D., et al. (2021). The PRISMA 2020 statement: An updated guideline for reporting systematic reviews. BMJ, 372, n71. https://doi.org/10.1136/bmj.n71
17. Rehman, M. ur, & Bahşi, H. (2024). Process-aware security monitoring in industrial control systems: A systematic review and future directions. International Journal of Critical Infrastructure Protection, 47, 100719. https://doi.org/10.1016/j.ijcip.2024.100719
18. Salahdine, F., & Kaabouch, N. (2019). Social engineering attacks: A survey. Future Internet, 11(4), 89. https://doi.org/10.3390/fi11040089
19. Stouffer, K., Pease, M., Tang, C., Zimmerman, T., Pillitteri, V., Lightman, S., Hahn, A., Saravia, S., Sherule, A., & Thompson, M. (2023). Guide to Operational Technology (OT) Security. NIST Special Publication 800-82 Rev. 3. National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-82r3
20. Stouffer, K., Pillitteri, V., Lightman, S., Abrams, M., & Hahn, A. (2015). Guide to Industrial Control Systems (ICS) Security. NIST Special Publication 800-82 Rev. 2. National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-82r2
21. Umer, M. A., Junejo, K. N., Jilani, M. T., & Mathur, A. P. (2022). Machine learning for intrusion detection in industrial control systems: Applications, challenges, and recommendations. International Journal of Critical Infrastructure Protection, 38, 100516. https://doi.org/10.1016/j.ijcip.2022.100516
22. Wang, Z., Sun, L., & Zhu, H. (2020). Defining social engineering in cybersecurity. IEEE Access, 8, 85069–85078. https://doi.org/10.1109/ACCESS.2020.2992807