Machine learning for resilience analysis: a review of systems under cyberattacks

Intelligent cyber-physical systems (CPS) are increasingly exposed to sophisticated cyberattacks, yet existing machine learning (ML)-focused surveys provide only fragmented coverage of the resilience lifecycle. They often separate attack modelling from defence strategies, overlook cross-sector insights, and lack clear evaluation benchmarks, limiting practical applicability. This review offers the first lifecycle-oriented synthesis of ML-enabled CPS resilience, covering detection, defence, recovery, and adaptation. It integrates diverse ML-based attack techniques with corresponding resilience mechanisms and provides a comparative analysis across two critical CPS sectors—power and water—to highlight shared vulnerabilities and sector-specific behaviours. The review further distils key limitations in current ML approaches, including data scarcity, interpretability challenges, and limited real-world validation. Finally, it proposes five actionable research directions and resilience quantification considerations to guide future development of robust and transferable ML-based CPS resilience frameworks.