Towards Deployable Anomaly Detection in industrial CPS/ICS: A Survey and Deployability Assessment

Abstract

Anomaly detection is widely used as an early-warning mechanism in CPS/ICS environments, yet detection accuracy alone does not determine whether a detector can be trusted, deployed, and operated under realistic conditions. This survey examines how recent anomaly detection approaches address these practical deployment requirements in CPS/ICS, where detectors face unique operational challenges. Following the PRISMA guidelines, a structured search and multi-stage screening across four academic databases (ACM Digital Library, IEEE Xplore, Scopus, and ScienceDirect) yielded a corpus of 26 peer-reviewed, implementation-based studies. From each study, information on method family, data modality, and datasets was extracted. Furthermore, a set of nine deployability criteria was derived from safety, security, and AI-governance standards and frameworks. Each study was then systematically assessed against these criteria using an evidence-based labeling scheme, with each criterion classified as fully, partially, or not considered based on the evidence reported in the study. The analysis shows that while detection accuracy is consistently reported, evidence for the remaining criteria is often limited or absent. These findings highlight significant gaps between reported performance and deployment readiness.