Advanced persistent threat detection in IT-OT converged industrial networks: A systematisation of knowledge

Pramadi, Yogha Restu, Spyridopoulos, Theodoros ORCID: https://orcid.org/0000-0001-7575-9909 and Belarbi, Othmane ORCID: https://orcid.org/0000-0002-6106-7669 2026. Advanced persistent threat detection in IT-OT converged industrial networks: A systematisation of knowledge. Presented at: CPSIoTSec '26, The Hague, Netherlands, 15-19 November 2026. Proceedings of the 2026 8th Joint Workshop on CPS&IoT Security and Privacy. New York, USA: ACM, pp. 68-81. 10.1145/3847353.3847502

Full text not available from this repository.

Abstract

Industrial networks have evolved into converged IT-OT-IIoT environments in which Advanced Persistent Threats (APTs) pivot across domains to disrupt physical processes. Despite growing research on APT detection, the literature remains fragmented, with limited structure for comparing approaches and identifying underexplored areas. This Systematisation of Knowledge (SoK) introduces a five-dimensional taxonomy of APT detection mechanisms in IT-OT-IIoT environments covering data source, detection scope, detection mechanism, detection objective, and evaluation basis, and maps 64 peer-reviewed studies to it. As an analytic tool, the taxonomy highlights underexplored combinations of taxonomy dimensions. Cross-dimensional analysis reveals three imbalances: (i) machine learning dominates (68.8% of papers) but concentrates on IT data, leaving the OT attack surface underexplored; (ii) detection ambition and validation rigour are inversely related, with no boundary-crossing detection validated in operational deployment; and (iii) no reviewed study addresses multi-site detection. Communities with operational data and researchers studying APT detection remain disconnected, discouraging investment in cross-domain datasets. From the classification matrix we derive seven research gaps covering cross-domain correlation, IT-OT temporal sequence modelling, multi-site attack detection, APT-informed physical-layer detection, threat-intelligence operationalisation, benchmark datasets, and deployment feasibility. Overall, current work lacks a detection configuration that is cross-domain, temporal, process-aware, and practically deployable.

Item Type:	Conference or Workshop Item - published (Paper)
Date Type:	Published Online
Status:	Published
Schools:	Schools > Computational & Mathematical Sciences Schools > Computer Science & Informatics
Publisher:	ACM
ISBN:	9798400730320
Last Modified:	12 Oct 2026 12:00
URI:	https://orca.cardiff.ac.uk/id/eprint/190154

Actions (repository staff only)

Edit Item