Towards enhanced cybersecurity in industrial control systems: a systematic review of context-based modeling, digital twins, and machine learning approaches

Abstract The increasing integration of Industrial Control Systems (ICS) and Cyber-Physical Systems (CPS) with the Internet of Things (IoT) has significantly enhanced their operational efficiency but also exposed them to advanced cyber threats. Traditional cybersecurity approaches, often tailored for IT systems, must address the unique complexities of ICS and CPS environments. This paper systematically reviews the integration of three critical areas: context-based modeling, digital twins, and machine learning (ML), to enhance cybersecurity for ICS and CPS. Context-based modeling provides dynamic, situational awareness; digital twins offer real-time system replicas for monitoring and simulation; and ML delivers predictive and adaptive threat detection and response capabilities. The review synthesizes findings from recent literature to answer four research questions focusing on methodologies in context-based modeling, applications of digital twins and ML in attack detection, and integrating these approaches for improved cyber resilience. The results demonstrate the synergistic potential of combining these technologies, enabling real-time anomaly detection, predictive threat analysis, and adaptive response mechanisms. Challenges such as data limitations, scalability, and verification complexities are vital areas requiring further research. This integrated framework offers a robust pathway for securing critical infrastructure and advancing cybersecurity practices in increasingly interconnected ICS and CPS environments.