A false sense of security? Revisiting the state of machine learning-based industrial intrusion detection

The researchers propose an evaluation methodology and examine multiple machine learning-based industrial intrusion detection schemes from the literature, finding that their detection rate drops to 3.2%–14.7% on some attack types not involved in training. Such schemes can reach detection rates above 99% after adding attack traffic to training, but the evaluation reuses the attack types used in training, and their true performance on unknown attacks was previously unclear. The paper accordingly warns that near-perfect detection rates may create a false sense of security, and offers suggestions for future research.