Machine Learning based Cyber Threat Intelligence in Industrial Control Systems: A Comprehensive Systematic Literature Review

This research presents a Systematic Literature Review (SLR) focusing on the integration of Cyber Threat Intelligence (CTI) and Machine Learning (ML) for securing Industrial Control Systems (ICS) against sophisticated, multi-stage cyber attacks. As the convergence of Information Technology (IT) and Operational Technology (OT) continues to reshape industrial environments, traditional security approaches based on isolation and static defenses have become inadequate. The study systematically analyzes 34 academic papers published between 2020 and 2025 to identify existing challenges, advancements, and research gaps in building adaptive and cross-layer CTI mechanisms. The findings highlight the growing complexity of modern ICS environments and the urgent need for intelligent, interoperable, and performance-efficient defense systems. While various ML-based CTI frameworks exist, none provide a fully unified and adaptive cross-layer defense model. The review identifies Deep Reinforcement Learning as a promising technique for autonomous threat response, emphasizes the value of lightweight ML models for edge computing, and underscores the necessity of standardization (e.g., STIX/TAXII) to enhance interoperability. Moreover, the research outlines persistent challenges such as data scarcity, trust deficits, and the simulation-to-reality gap, which hinder real-world deployment. To address these, a conceptual multi-tier architectural model is proposed as a roadmap for future development of adaptive, resilient, and intelligent ICS defense systems. Ultimately, this study contributes a comprehensive foundation for researchers and practitioners to design next-generation cross-layer CTI systems capable of protecting critical infrastructure while ensuring operational continuity and efficiency.