Replication Package for "Graph Neural Networks for Cyber-Physical Intrusion and Anomaly Detection in Industrial Control Systems: A Systematic Review"

Abstract

This replication package supports the systematic review “Graph Neural Networks for Cyber-Physical Intrusion and Anomaly Detection in Industrial Control Systems: A Systematic Review” (manuscript reference: COMPELECENG-D-26-07913). The final evidence base comprises 346 eligible primary studies, including 317 Direct and 29 Proxy evidence records. Evaluation rigour is appraised separately from eligibility, with 3 High-, 65 Moderate-, and 278 Low-rigour studies. The package contains the complete study-level evidence and audit trail underlying the review, including: • executed search strategies, database/export logs, deduplication, screening registers, citation searching, update-control checks, and PRISMA 2020 flow records;• the complete N=346 study-level taxonomy and coding matrix;• evaluation-rigour criteria, operational scoring rules, study-level ratings, sensitivity analyses, and inter-rater agreement records;• 5,850 source-located quantitative performance-metric records from 333 studies, with descriptive coverage retained for the full corpus;• GNN architecture and task classifications;• hardware, timing, resource, online-operation, and field/HIL evidence;• comparative-validity matrices, graph-component controls, temporal/window/transform checks, and timing audits;• source-verified explainability cases and interpretation limits;• publication-cutoff, first-online-date, Q2/Q4, graph-access, and consistency audits; and• a master evidence map linking the principal coding, appraisal, performance, deployment, and audit records by persistent study identifier. The consolidated PRISMA flow comprises 12,798 identified records, 3,293 duplicates removed, 9,505 unique records screened, 667 reports sought, 44 reports not retrieved, 623 reports assessed, 277 full-text exclusions, and 346 included primary studies. Eligibility and evaluation rigour are treated as separate dimensions. Direct/Proxy denotes evaluation directness rather than study quality. Frequencies are descriptive and are not interpreted as evidence of model superiority. Missing reporting is not treated as evidence that a methodological safeguard was absent. Search and update cutoff: 13 October 2026. Publication-date eligibility is based on verified first-online publication dates. Repository DOI: 10.5281/zenodo.23374641