{'fraction_non_alphanumeric': 0.03793370963858645, 'fraction_numerical': 0.010312725716272973, 'mean_word_length': 4.870671378091873, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 7, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Deep Learning-Based Anomaly Detection in Cyber-Physical Systems: Progress and Opportunities

Anomaly detection is crucial to ensure the security of cyber-physical systems (CPS). However, due to the increasing complexity of CPSs and more sophisticated attacks, conventional anomaly detection methods cannot be directly applied to thwart such issues, which also need domain-specific knowledge and handle the growing volume of data. Deep learning-based anomaly detection (DLAD) methods have been proposed to achieve unsupervised detection in the era of CPS big data. In this paper, we review state-of-the-art DLAD methods in CPSs. We propose a taxonomy in terms of the type of anomalies, strategies, implementation and evaluation metrics to understand the essential properties of current methods. Further, we utilize this taxonomy to identify and highlight new characteristics and designs in each CPS domain. We summarise a list of publicly available datasets for training and evaluation. We also discuss our findings, the limitations of existing studies, and possible directions to improve DLAD methods.


INTRODUCTION
Cyber-physical systems (CPS) are increasingly being deployed in critical infrastructures. The CPS market is expected to expand by 9.7% each year, which will reach $9563 million by 2025 [78]. Prominent applications of CPS include industrial control systems (ICS), smart grid, intelligent transportation systems (ITS), and aerial systems. CPSs have evolved to be complex, heterogeneous, and integrated to provide rich functionalities. However, such characteristics also expose CPSs to broader threats. In H1 2019, 41.6% of ICS computers that installed Kaspersky products detected attacks [48]. According to FireEye's report, insiders, ransomware, market manipulation, etc are among the top attack types in ICS [32]. Recent incidents (e.g., Stuxnet [104], Ukraine power grid outage [102], auto-driving crashes [103], robot malfunction [3]) have shown that sophisticated and stealthy attacks (and faults) can result in catastrophic consequences to the economy, environment, and even human lives. Thus, it is paramount important to ensure the security of CPSs.
To detect attacks and unexpected errors in CPSs, anomaly detection methods are proposed to mitigate these threats. For example, rule, state estimation (e.g., Kalman filter), statistical model (e.g., Gaussian model, histogram-based model) based methods are utilized to learn normal status of CPSs [64]. However, these methods usually require expert knowledge (e.g., operators manually extract certain rules), or need to know the underlying distribution of normal data. Machine learning approaches do not rely on domain-specific knowledge [15]. But they usually require a large quantity of labeled data (e.g., classification-based methods). Also, they cannot capture the unique attributes of CPSs (e.g., spatial-temporal correlation) [87]. Intrusion detection methods are dedicated to ensuring network communication security [67,113]. Physical properties (e.g., the noise of engines) are captured to depict the immutable nature of CPSs [34]. Program execution semantics are characterized to protect control systems [16,88,108]. However, as CPSs become more complicated and attacks are more stealthy (e.g., APT attacks), these methods are hard to ensure the overall status of CPSs (e.g., protect multivariate physical measurement) and need more domain knowledge (e.g., more components and correlation). Anomaly detection systems need to adapt to capture new characteristics of CPSs.
To this end, deep learning-based anomaly detection (DLAD) methods have been proposed to identify anomalies in CPS. Current studies have explored different neural network architectures (e.g., ConvLSTM) to mitigate various threats (e.g., false data injection attacks) in different CPS domains (e.g., smart grid). However, since these studies are not introduced in a unified way, a systematic survey is needed to review existing methods and provide guidance for future solutions. Specifically, we need to answer three research questions: (1) What are the characteristics of existing approaches? Specifically, the threat model, detection strategies (i.e., input data, neural network design, and anomaly scores), implementation and evaluation metrics of DLAD methods are not categorized. (2) What are the takeaways and limitations of existing work? Are there publicly available datasets? (3) How can we improve DLAD methods? Answering these questions helps to understand the fundamentals of DLAD methods, evaluate proposed DLAD models, and explore new solutions. This motivates our work to summarize and identify progress, challenges, and future research directions of DLAD methods. Our contributions are as follows.
• We systematically review existing deep learning-based anomaly detection methods that target at detecting faults and attacks in CPS. To this end, we propose a new taxonomy that is based on i) type of anomalies (i.e., threat model), ii) detection strategies (i.e., input data, neural network designs, anomaly scores), and iii) implementation and evaluation metrics. Further, we explore and categorize peer-reviewed research papers from conferences and journals under the setting of this taxonomy. • We identify and highlight characteristics that are essential to building a DLAD method. First, we present characteristics of existing methods in representative CPS domains (i.e., ICSs, smart grid, ITSs, and aerial systems). Then, we report unique designs and trends in each domain. All these findings are summarized according to our taxonomy. As data is important for training and testing of deep learning models, we also discuss publicly available datasets that are used in existing CPS DLAD methods. • We discuss our findings and identify the limitations of existing work. To improve the design and evaluation of DLAD methods, we propose and discuss several promising research directions and open problems that can motivate future research efforts.

BACKGROUND
In this section, we introduce a generic architecture of cyber-physical systems and threats that are typically studied in existing DLAD methods (Section 2.1), the workflow of DLAD methods (Section 2.2). We discuss the key differences between our work and the existing survey papers in CPS (Section 2.3).

Cyber-physical systems and threats
The generic definition of CPS. As illustrated in Figure 1, CPSs typically consist of five components: The physical space contains physical components of CPSs, e.g., engines, tanks, wheels. Actuators receive control commands (denoted as A 2 ) from control systems and change the running parameters of physical devices (A 1 ). Sensors measure the running status of devices (S 1 ) and report to the control systems (S 2 ). Control systems obtain sensor measurement (S 2 ) and send control commands to actuators (A 2 ), which follows the predefined control logic. Supervisory control and data acquisition (SCADA) systems are used to gather data from control systems (D 1 ) and monitor the running status of CPSs for users. We define communication between sensors (actuators) and control systems as level 0 communication (denoted as C 0 ). The content of C 0 communication traffic is sensor measurement (S 2 ) and control commands (A 2 ). Similarly, communication between control systems and SCADA is defined as level 1 communication (C 1 ). The content of C 1 is D 1 . Specifically, our work focuses on four representative types of CPSs, i.e., Industrial Control Systems (ICSs), smart grid, Intelligent Transportation Systems (ITSs) and aerial systems. Actual devices may vary in these four CPSs (e.g., actuators can be pumps in ICS and brakes in ITS) but they share the same generic architecture.

Actuators
Sensors Physical space Threat model. We then present threats that are studied by DLAD methods in our work. Threats can be classified as attacks and faults. We observe that most existing studies usually do not obtain data directly from physical space. Namely, these two data sources are not adopted: i) running status data of physical components from physical devices to sensors (S 1 ), ii) control parameters from actuators to physical devices (A 1 ). Instead, S 2 (values sent to control systems) and A 2 (commands sent to actuators) are commonly utilized by existing work. We focus our investigation on: • Sensor and actuator anomalous values. Sensors and actuators either can be compromised under attacks or failed due to various reasons (e.g., lack of maintenance). Attackers may physically tamper with field sensors and actuators under this scenario. In Figure 1, S 2 and A 2 are affected under this threat model (S 2 S 1 , A 2 A 1 ).
• Manipulated level 0 and level 1 communication traffic. Attackers can manipulate two types of communication signals: i) network traffic between sensors (actuators) and control systems (C 0 ), ii) traffic data between control systems and SCADA (C 1 ). • Compromised control systems. Control systems are connected to field devices and central operating centers, which makes it prone to remote attacks. For example, attackers can plant malware and send false control signals. Also, internal faults (e.g., logic errors) can cause wrong control commands. A 2 and D 1 are affected in this scenario.  Fig. 2. The workflow of a typical DLAD method. The input data is used to train or test DLAD models. The anomaly score is used to optimize DLAD models. Trained DLAD models are applied to decide whether the input data is an anomaly at the online detection phase.

The workflow of typical DLAD methods
Anomaly detection has developed for many different applications [15,109], e.g., intrusion detection, fraud detection. In this work, we focus on new research efforts that detect anomalies in CPS with the help of emerging deep learning methods. As illustrated in Figure 2, we characterize the generic workflow of DLAD methods. Typically, DLAD methods consist of training and testing phases. At the training phase, a large quantity of input data is first collected. Sensor and actuator data, level 0 and level 1 communication traffic, and control system logs are commonly used data sources. Various customized data processing approaches are applied to the input data, which is then fed to neural network models. Then, the main contribution of new methods lies in different DLAD models (e.g., RNN, autoencoders, CNN, and customized models) in different application scenarios. Further, DLAD models utilize loss functions to compute differences between output data from the output layer and ground truth data. We denote these differences as anomaly scores. There are three types of anomaly scores: (1) Prediction error (2) Reconstruction error, and (3) Predicted labels (details in Section 3.2). Anomaly scores are used to optimize and update DLAD models. At the testing phase, collected or real-time input data is fed to trained models and determine whether the input is an anomaly.

Related survey
There are a number of recent related surveys, which are different in focus and domain from our work. As illustrated in Table 1, we summarize these papers in terms of techniques, applications, and scope. Chandola et al. provided a comprehensive overview of anomaly detection methods [15]. Table 1. Summary of techniques, applications, and scope covered by related surveys. and means NO and YES respectively. means related but not fully covered. "DL" and "AD" denotes deep learning and anomaly detection respectively. As an early effort to review anomaly detection methods, they did not consider deep learningbased methods and did not include CPS. Commodity IoT systems have transformed the way people live. For example, emerging smart home applications allow users to interact with home appliances automatically. Program analysis methods are proposed to protect the privacy and discover vulnerabilities in these applications [13]. Meanwhile, Giraldo et al. reviewed anomaly detection methods that utilize the physical properties of CPSs (e.g., the noise of physical devices) [34]. Studies in terms of network security of SCADA systems are summarized with a focus on risk assessment techniques [17]. Mitchell et al. [67], Nazir et al. [73], Lun et al. [64] provided a review of anomaly detection approaches in CPS. But the techniques did not include deep learning methods and are conventional, e.g., state estimation, intrusion detection based methods. There is work that studied deep learning-based anomaly detection methods but did not focus on CPS [14]. While Veith et al. investigated applications of deep learning methods in CPS, it did not cover anomaly detection [97]. Heartfield et al. examined the taxonomy of threats in smart home IoT, which did not consider anomaly detection methods [41]. Finally, Mohammadi et al. studied data analysis approaches that use deep learning methods in IoT [68]. To the best of our knowledge, our work is the first work that studies deep learning-based anomaly detection methods in CPS, which differs from the above existing surveys.

TAXONOMY
In this section, we present our taxonomy to classify existing work. In particular, our taxonomy consists of three aspects: (1) Type of anomalies. DLAD methods first need to decide what type of anomalies they intend to detect. (2) Detection strategies. Based on different anomalies, different strategies (e.g., neural network design) are adopted. (3) Implementation and evaluation metrics. Once a strategy is decided, appropriate implementation and evaluation metrics are selected to assess the performance of methods. Our taxonomy is depicted in Figure 3 and we elaborate the details as follows.

Type of anomalies
We elaborate anomalies described in Section 2.1. Anomalies can be broadly categorized as: (1) attacks; (2) faults.  Attacks. Since CPSs usually manage critical infrastructure (e.g., ICS, medical devices, and power grid), they are always under the threat of various attacks. An attacker who has the motive (e.g., financial interest, privacy theft, and state operations) can conduct attacks. These attacks can target different parts of CPSs:

Type of anomalies
(1) Network communication layer. Field devices (e.g., sensors and actuators) rely on communication networks to cooperate with each other. Also, sensor values, device status are reported to data centers and control commands are sent by control systems through the network. In this case, level 0 communication (C 0 ) and level 1 communication (C 1 ) can both be targeted. Note that S 2 , A 2 , D 1 (contained in C 0 and C 1 traffic) can also be manipulated under these attacks. We identify three types of attacks: • Denial-of-service (DoS) attacks. DoS attacks bring a significant threat to the functionalities of real-time applications in CPSs. For example, it would cause a collision of aircraft or low traffic utilization if the ADS-B system is out of service. Meanwhile, the broadcast feature in some CPS communication protocols (e.g., the CAN protocol in smart car systems) makes the network prone to DoS attacks. • Man-in-the-middle (MITM) attacks. CPSs adopt many newly designed protocols, which may lack a well-designed authentication mechanism. Also, Ethernet used in CPS can be exploited to conduct MITM attacks. Packet content may be manipulated and sensitive information can be leaked through MITM attacks [30]. • Packet injection. If attackers gain access to the network, they are able to inject an arbitrary packet to send control command into the system. False control commands can cause severe damage to running devices and even place human lives under risk. For example, a false engine and brake control command could possibly induce a car crash [38]. (2) Control system. As the core of one CPS, control systems take sensor values as input and give control signals to actuators or field devices. Due to harsh working environments or limited hardware resources, the protection mechanism may not well-established in control systems. Once control systems are compromised, data sent to SCADA systems (D 1 ) and commands sent to actuators (A 2 ) can be altered. We find two types of attacks that target control systems: • Malware. For the long-term monitoring and information leakage, attackers would place malware in the control system. Moreover, malware can be used to launch a stealthy attack (e.g., APT attack) at a certain critical moment. Sensor readings can be manipulated by malware. Under certain circumstances, malware may also cause physical damage to devices [104]. • False control signals. Devices operate deviating from regular working status when receiving false control signals. Wrong operations shorten the working life of devices and can even damage devices directly. Attackers usually conceal their unauthorized access to the system and send false control commands at a critical time point.
Faults. The complexity of systems and heterogeneity of devices lead CPSs to generate unexpected faults. For example, industrial control systems typically consist of multiple stages and a lot of components in each stage. Many devices operate in a harsh environment (e.g., high humidity or temperature). Also, mechanical parts are vulnerable to abrasion and vibration. S 2 , A 2 , and D 1 can all be anomalous due to faults. We find that faults typically happen in two layers: (1) Sensor layer. False sensor value is a common fault in the sensor layer. First, physical damage or flaw lead sensors to report inaccurate and even wrong sensor values. Also, previously unseen circumstances may cause sensors to work beyond their abilities. For example, sensors on spacecraft may come across unexpected conditions [44,92]. (2) Control system. CPSs typically hold the dynamic running characteristic, which means there are always situations that may not be covered during the system design stage. For example, different orders and timings of events in the PLC code can cause object collisions of an assembly line in industrial plants [114].

Detection strategies
DLAD methods choose their detection strategies from three aspects: Input data. DLAD methods first need to decide what type of data to take as input, which depends on specific anomalies they tend to detect. Based on the layer and source where data is collected, we conclude four types of input data: (1) Sensor and actuator data. (2) Network traffic data. (3) System calls and logs. (4) Time-series data, which is preprocessed sensor, network, and log data in numeric time-series form. DLAD methods adopt semi-supervised and unsupervised learning to resolve the lack of labeled data (especially anomalous data). Neural network design. DLAD methods adopt different neural network designs based on input data and tasks. The deep network can be stacked models (e.g., LSTMs) or hybrid combinations of models (e.g., the combination of LSTM and CNN). Although neural network designs can be in various forms, we found several basic models used to build the neural network. (1) RNN. LSTM models (one type of RNN) are often used to capture characteristics of time-series data [44]. (2) Autoencoder. Autoencoders are applied to handle imbalanced data and achieve unsupervised learning [87]. (3) CNN. CNN models can capture correlations and context information of multivariate measurement data [11]. Anomaly scores. There exist three metrics to calculate the detection error: (1) Prediction error. DLAD methods take past data as input to predict future sensor or actuator values. Then, the error between predicted and real values is measured. Anomalous data usually deviate from predicted values.
(2) Reconstruction error. Input data is fed to the model and compressed to hidden layers, which represents low dimensional space. The data is then reconstructed to the size of the original dimension. Similarly, the error between reconstructed and origin values is calculated. A threshold of error is usually selected to identify anomalous data. (3) Predicted label or class. If labeled data is relatively sufficient in some domain (e.g., SWaT [46] testbed in ICS), DLAD models can be trained to predict labels of input data. The assumption is that latent features learned from neural networks can be used to identify anomalies. We observe very few methods to adopt this design since a large quantity of labeled data needs profound manual effort.

Implementation and evaluation metrics
We summarize the implementation of existing work with a focus on platforms where data is collected. Then, metrics that are used to evaluate the effectiveness and performance of DLAD methods are identified. Implementation. As data-driven techniques, DLAD methods consume a large quantity of data to train and test models. We summarize three types of environments where data is collected: (1) Data from real-world systems.
(2) Testbed. Researchers build scaled-down yet entirely functional testbeds, where experiments can be done without the risk of damaging real CPSs.
The advantage of data from real-world systems is that it reflects the intrinsic principle of real systems, although the data is hard to harvest and the number of systems is limited. Simulation is easy to operate but can not capture problems that only exist in real systems. A scaled-down testbed could balance the data distortion and operability. Similarly, anomalous data can be collected from real-world systems and manually created. There can be insufficient real-world anomalous data since anomalies are hard to harvest. For example, in smart cars and medical domain, anomalies in real devices may place human lives at risk. So existing studies tackle this problem by manually creating three kinds of anomalies: (1) Point anomaly. Through investigating anomalies that can possibly happen, several independent abnormal cases can be injected into the normal data series. For instance, Taylor et al. [94] and Russo et al. [84] injected several attack cases into the sequence of CAN bus packets. (2) Statistical anomaly. Anomalies that follow certain statistical patterns are injected into normal data as an abnormal period [112]. (3) Simulated attacks. Various attacks are simulated in the testbed, where sensor values and system logs can be easily collected. Zhang et al. [115] created cyber attacks in transactive energy systems. Evaluation metrics. Metrics are proposed to measure the effectiveness of DLAD methods. We conclude that the most commonly used metrics are precision, recall, and F 1 score. Given imbalanced datasets, these metrics consider false positives and false negatives, which are better than metrics such as accuracy. The precision is defined as T P/(T P + F P), where T P stands for True Positives and F P means False Positives. The recall is defined as T P/(T P + F N ), where F N denotes False Negatives. F 1 is defined as 2*Precision*Recall/(Precision+Recall). Also, the Receiver Operating Characteristic (ROC) curve is used to manage tradeoffs between F P and T P. Meanwhile, methods are often compared with baseline methods to examine the improvement. Some error-based metrics are also applied to measure the prediction and reconstruction performance such as Mean Absolute Error (MAE) and Relative Errors (ReErr) [117].

REVIEW OF DEEP LEARNING-BASED ANOMALY DETECTION METHODS
In this section, we present novel ideas and our findings in each domain of CPSs. We identified that current research efforts mainly focus on four types of systems: (1) industrial control systems (ICSs); (2) smart grid; (3) intelligent transportation systems (ITSs); and (4) aerial systems. Also, we investigate general-purpose methods that analyze time-series data. We have summarized existing work under our taxonomy in Table 2. The metrics of the taxonomy are listed in the column while current methods that target different CPSs are presented in each row.
hand, much of the research effort in ICS is on detecting faults, which have been less studied in other applications of CPSs. The complexity of infrastructures and the harsh working conditions of field devices can cause unexpected faults. The majority of existing work detects anomalies from sensor and actuator values, which are easy to be obtained. Only several studies handle network traffic data since there are inadequate real-world traffic data and proprietary communication protocols. Very few studies target control systems (e.g., system logs) and thus we did not find such a dataset in ICS. For neural network architectures, LSTMs and autoencoders (and their variations) are the most commonly used. Typically, LSTMs are used to capture the temporal relation of sensor values and unsupervised learning is achieved through autoencoders. Most solutions adopt the prediction error to measure the deviation of an anomaly. Testbeds are usually used to evaluate proposed methods and the SWaT testbed [35] is a popular platform to conduct the evaluation. Precision, recall, F 1 , and ROC are de facto evaluation metrics. In addition to the above characteristics, we also find some Input data

Data filter
Feng et al. [30] Feature representation Li et al. [60] Schneider et al. [87] CNN layer to capture context Canizo et al. [11] Kravchik et al. [54] Wu et al. [105] GAN-based methods Li et al. [59] Multi-branch Deep Network Zohrevand et al. [117] Neural network design Ensemble learning Statistical method Data processing new techniques and explorations used by DLAD methods in ICS. As illustrated in Figure 4, in what follows, we discuss representative new techniques in ICS. Note that these methods can also be applied to other domains.

Representative new techniques.
Applying filters before DLAD methods to improve efficiency. Applying DLAD methods in ICS, where running environments are usually resourceconstrained, must consider the efficiency factor. A lightweight and efficient conventional detecting method could be utilized before DLAD methods to decrease data to be checked significantly. Feng et al. [30] proposed a combined anomaly detection framework. The main idea is to first apply a Bloom filter to traffic data and then pick suspicious packets to the follow-up LSTM-based detector. The fast and lightweight filter reduces the burden of the LSTM detector, which enhances the detection efficiency. This method aims to identify cyber attacks in the communication layer of a SCADA system. The attack types include injecting malicious commands (e.g., state, parameter, and function code) and DoS attacks. Also, the LSTM detector stacks two LSTM layers using signatures of previous packets to predict the signature of the next packet. Then, the predicted signature is checked to examine whether it is in the normal signature database. The method is evaluated on a gas pipeline system in a laboratory environment, which outperforms baseline methods (e.g., Bayesian Network, Isolation Forest) in the recall, accuracy, and F 1 score.
Deep learning-based feature representation. We identify three types of feature representation in DLAD methods: (1) raw data (directly fed to models) (2) data processing (e.g., inner products of two sensor time series) (3) deep learning-based embedding. Data processing helps to identify discriminative characteristics of data, which is also used in conventional detection methods. We find that deep learning methods are utilized to integrate features and reduce dimensions of feature space. For example, Li et al. [60] and Schneider et al. [87] proposed deep autoencoders to automatically compress raw input to lower-dimension hidden layer representation, which further is utilized as the input of the follow-up neural network. Despite both works [60,87] utilizing the hidden layer to represent features, the actual neural network detecting anomalies can be different. One [60] takes sensor value and uses LSTM to generate prediction errors, while the other [87] takes traffic data and uses autoencoder to generate reconstruction errors. Both methods are evaluated on data from testbeds. When expert knowledge is limited (e.g., face a new network protocol), this can be very useful.
Capturing temporal and spatial relationships with different architectures. The value of one sensor or actuator is one-dimension data (e.g., time-series), many LSTM-based DLAD methods are proposed to learn temporal behaviors of the data. However, there exist correlations among several different sensors and actuators, which reflect logical relations in the control system. In other words, there are interdependent relationships among sensors and actuators. Hence one challenge is to capture context (temporal, spatial, and logical) features in multi-dimensional (time-series of multiple sensors and actuators) data. To this end, CNN can extract features of multi-dimensional data jointly via convolution operations. Several approaches [11,54,105] adopt a convolutional layer as the first layer of the neural network to obtain correlations of multiple sensors in a sliding time window. Further, the extracted features are fed to subsequent layers to generate output scores. These methods can be employed to detect both attacks and faults. All methods take sensor and actuator value as input and generate prediction error or predicted labels. Meanwhile, Canizo et al. [11] and Wu et al. [105] utilized RNN to take the output of the CNN layer and form the prediction layer. Moreover, both methods use datasets from real industrial plants. Precision, recall, F 1 , and ROC are evaluation metrics.
Exploration of GAN-based methods. Li et al. [59] proposed a GAN-based framework to capture the spatial-temporal correlation in the multi-dimension data. Both the generator and discriminator are utilized to detect anomalies by reconstruction and discrimination errors. Also, LSTM models are used to build the generator and discriminator. The framework takes sensor and actuator values as input and aims to detect false control signals. Compared to a GAN-based anomaly detection method [111] that is not focused on ICS, this method finds that capturing temporal correlation is the key to improve performance. The method outperforms baseline methods (e.g., Principal component analysis, One-Class SVM, K-Nearest Neighbour, Feature Bagging) in precision, recall, and F 1 . This is an interesting attempt to utilize GAN-based models. Also, a well-tuned generator can be used to produce training data.
Applying conventional and DLAD methods parallelly through ensemble learning. We have introduced that conventional methods can be used as filters before applying DLAD methods. However, to increase the accuracy, these two kinds of methods can be placed parallelly to learn the characteristics of input data. Zohrevand et al. [117] proposed a framework named MBPF that ensembles two components: (1) a statistical method named TBATS (Trigonometric Box-Cox transform, ARMA errors, Trend, and Seasonal components) [22], and (2) Multi-branch Deep Network Component. First, seasonality evaluation and outlier elimination are applied to remove noise. Then, pre-processed data is fed to TBATS and deep learning models simultaneously to capture linear and sequential relations. Finally, a Multi-Layer Perceptron (MLP) takes the output of TBATS and deep learning models, which will vote between the two methods and predict the next value. The MBPF framework can analyze any time-series data. The Mean Absolute Error (MAE) and Root Mean Square (RMSE) are utilized to measure prediction errors. Evaluated on a real-world SCADA water supply system, the method outperforms baseline methods (e.g., Multilayer Perceptron, Stacked LSTM, Regularized LSTM) when measured by MAE, RMSE, Absolute deviation (AbsDev) and Relative Errors (ReErr).

DLAD methods in smart grid
Characteristics of DLAD methods in smart grid. False data injection (FDI) attacks [63] usually inject malicious packets (e.g., traffic of C 0 , C 1 ) to create small measurement errors (e.g., alter S 2 , D 1 ) to compromise the state estimation component of a smart grid. FDI attacks are stealthy and difficult to detect, which have attracted most of the research efforts [6,23,74,98,99,101]. Meanwhile, few studies detect faults [29] and injected anomalies [93]. Although FDI attacks are accomplished via network packet injection, the majority of current work focuses on analyzing sensor data (e.g., voltage magnitude, power flow, electricity consumption). We find one work [74] to analyze network packet data. We did not find work protecting control systems and datasets about system logs or traces in the smart grid published by DLAD methods. This is may partly because real control systems are hard to obtain. Autoencoders and RNNs (and their variations) are almost equally adopted architectures, which have been proven effective by existing works. So reconstruction and prediction errors are both used to detect anomalies. Simulations are mainly utilized to evaluate the performance of methods. Specifically, the IEEE X-bus [4] (e.g., 9-bus, 14-bus) power test system is employed to simulate attacks and collect data. There are various evaluation metrics, e.g., precision, recall, F 1 , and accuracy. As shown in Figure 5, we present representative new techniques in smart grid.

Representative new techniques.
Deep learning aided state estimator. In the smart grid, a state estimator is utilized to monitor the running state of the grid [71], which is a key component to protect the power system. The input data of one state estimator is usually collected from SCADA systems, which obtain measurements from sensors and field devices. A bad data detector or filter [53] is connected to the state estimator to eliminate false or injected data, which usually utilizes normalized residuals of measurements [42]. However, attacks such as false data injection (FDI) and PMU data manipulation attack (PDMA) can evade the detection of conventional state estimators. These attacks deliberately mimic legitimate state variables and thus evade the detection. To thwart these attacks, several deep learning-based methods are proposed to improve state estimator, which adopt three strategies: (1) Remove false data before bad data detectors. Basumallik et al. [6] added a filter, which is based on deep learning techniques, to eliminate false data, which then could transfer sanitized data to the bad data detector. This filter contains two convolutional layers and takes voltage values as input. The output is the probabilities of various attacks (e.g., FDI attack). If attacks are detected, the false data is removed to protect the state estimator. (2) Improve bad data detectors via joint detection. Wang et al. [99] utilized a deep autoencoder with RBM layers to form a joint detection framework with the bad data detector. The input of the autoencoder is extracted 108 features from PMU measurements, e.g., the three-phase magnitude, angles, and voltages. If the reconstruction error is above a pre-defined threshold, then attacks are detected from the raw data. Only attacks that are identified by both the autoencoder and bad data detector will be flagged as alerts in the management system, which significantly reduces false positives of conventional bad data detector.
(3) Improve state estimators via predicting precise state variables. Wang et al. [98] proposed a DBN network with ten hidden layers to take generator and market time-series information as input and predict electric load in real-time. The predicted electric load intervals are the normal range of state variables. The method pinpoints precise state variables, thus attacks that cause abnormal states are detected.
Combining characteristics from sensors and network layers. Most existing studies adopt the threat model that a limited number of data points (i.e., point anomalies) are manipulated by FDI attacks. Niu et al. [74] indicated that sophisticated attackers can inject multivariate malicious data points in a period (i.e., collective and contextual anomalies). Since such FDI attacks are more stealthy, inspecting measurement data alone may fail to detect such stealthy attacks. They proposed a mixed neural network architecture that combines sensor measurements and network packets. First, the one-dimension convolutional layer is utilized to extract features from the source data.
Originally, raw data of the two sources are in different dimensions, which is further transformed into the same dimension by the convolution operation. Then, the features of two sources from past values are fully connected and fed to a 3-layer LSTM network to predict the next data point. Data points that generate large prediction errors are classified as anomalies. The method is evaluated on an IEEE 39-bus system. Overall, the accuracy of the method is above 0.8. Detecting anomalies both in the market and physical system. Most existing methods concentrate on ensuring the stability of the running status of physical systems in the smart grid. However, considering merely sensor measurement and traffic packets data may fail to secure the robustness.
In modern transactive power systems, the market plays an important role in adjusting the state of the system. Specifically, the electricity price and consumption also impact the grid by affecting the workload. Indeed, FDI attacks have already targeted markets [100,107]. We believe that it is closer to reality to consider cyberattacks in the market utilities and networks. Zhang et al. [115] studied measurements of both the electricity market and the physical system. In particular, price, voltage magnitude, and power consumption are monitored. The proposed framework utilizes a stacked autoencoder and generates reconstruction errors of the market and physical system separately. If anomalies are detected in the market, network traffic and server logs are checked to locate the error. The framework is evaluated on a 9 bus bulk system modeled in MATPOWER [66]. Results show that 79% of outages and 96.9% of attacks can be detected.

DLAD methods in ITSs
Characteristics of DLAD methods in ITSs. Most studies in ITS aim to detect attacks on the CAN bus [47,84,94,116], which is responsible for the communication between devices (e.g., airbags) and Electronic Control Units (ECUs) [19]. Khanapuri Figure 6.

Input data
Neural network design

Environment information embedding
Kieu et al. [51] Study basic models on the CAN bus data Taylor et al. [94] Jichici et al. [47] Filters to improve robustness Wyk et al. [96] Utilize mobile edge devices Zhu et al. [116] Fig. 6. An illustration of representative new techniques in ITS.

Representative new techniques.
The embedding of contextual information. Smart vehicles interact with the surrounding environment constantly. Cameras, radars, speed sensors are utilized to obtain the position, velocity, status of on-going vehicles. Existing studies use data from the above sensors and devices to ensure that vehicles perform in normal behaviors. However, the influence of environments is not captured if DLAD methods merely detect the condition of vehicles. Indeed, the environment information (i.e., context) is also important to decide the status of vehicles. For example, the same physical status can be classified as normal or anomalous depending on different weather, road, and traffic information. Kieu et al. [51] utilized an embedding method to encode context information into matrixes. Further, context embedding matrixes are concatenated with feature-enriched time-series matrixes. Such enriched features contribute to higher precision and recall. This work aims to detect anomalies in time-series data and validates it on a driving behavior dataset. Thus, it can be used to identify reckless driving. The concatenated matrixes are fed to 2D CNN and LSTM autoencoders, which produce reconstruction errors to recognize outliers. The method outperforms two baseline methods (i.e., Local Outlier Factor [9], One-Class Support Vector Machines [65]) in precision, recall, and F 1 score. Utilizing mobile edge devices to boost computing. Control commands are sent from ECUs to physical devices and mechanical parts of vehicles. With all these traffic transmitted on the CAN bus, a short delay of messages could cause severe casualties when users respond to sudden incidents. Meanwhile, DLAD methods typically consume a large number of computing resources. Restricted computing power on vehicles could add delay to send out benign commands when conducting the anomaly detection process. To this end, Zhu et al. [116] proposed the multi-dimension LSTM framework to allow the parallel computing of certain LSTM layers, which can speed up the computing process. Also, part of the computing is delegated to mobile edge devices. In particular, two hidden layers are adopted to adjust the dimensions of input data, which are located at on-board computers. Further, data-based and time-based features are fed separately and simultaneously to two LSTM layers on edge devices. This work targets spoof, replay, flood, drop and tamper attacks to CAN bus messages. The cross entropy of the predicted message and the next message is calculated to detect the anomaly. With the accuracy reaching 90%, the detection only takes about 0.61 milliseconds.
Applying filters after DLAD methods to improve robustness. DLAD methods are used to remove anomalous measurements so that control systems can generate correct responses to environmental changes. Thus, DLAD methods on ITS systems must be robust and work in real-time. To achieve robustness, Wyk et al. [96] adopted a mixed framework. This work applies a three-layer CNN-based model first to eliminate false sensor readings. Then, scrutinized data is fed to Kalman filters (KF) to further remove anomalies that are undetected by the CNN model. The authors find that the CNN-KF model surpasses the KF-CNN model in general. Also, they observe that deploying a Kalman filter as the last layer makes the detecting process more reliable [86]. This work aims to detect and remove false sensor readings caused by both false injection attacks and failures. The sensors include speed, acceleration, and GPS speed sensors. The CNN model consists of three CNN layers and two fully connected layers. Benign sensor readings are transferred to the control system from the CNN-KF model. The method is validated on a two-year real-world dataset obtained from the Safety Pilot Model Deployment (SPMD) program [8]. Accuracy, precision, and F 1 are used to measure the performance, which outperforms two baseline (i.e., KF, CNN) methods.
Studying the performance of basic models on the CAN bus data. As an important part of the communication system, the CAN bus has attracted most of the research efforts as we have shown in this section. With various heterogeneous neural network models introduced, the performance of basic neural networks is not clear. Serving as building blocks of sophisticated models, these basic architectures of neural networks have to be fully explored to better build and tune complex models. To this end, Taylor

DLAD methods in aerial systems
Characteristics of DLAD methods in aerial systems. There are methods studying faults in aircraft [72] and spacecraft [37,44,92]. The faults consist of point and contextual anomalies in sensor and communication data. Some research efforts are on attacks in unmanned aerial vehicles (UAVs) [27,28] and aircraft [38]. The attacks include malicious code in control systems, eavesdropping, and spoofing in the communication network, etc. With network and sensor data as conventional input data, two studies [27,28] investigate attacks to control systems and utilize kernel events and logs as input. Most approaches use LSTMs and variants to generate prediction errors. Most aircraft and spacecraft data are collected from real airplanes and satellites. Although running data is obtained from real UAVs, attacks are simulated and injected into normal traces. It is hard to find a commonly used platform in aerial systems. Precision, recall, F 1 , true positives and false positives are calculated to measure the performance. As shown in Figure 7, we present the details of representative techniques in aerial systems as follows. We argue that these methods can be used in other domains as well. Hundman et al. [44] Tariq et al. [92] Ezeme et al. [27,28] Su et al. [91] Habler et al. [38]  The unsupervised thresholding method outperforms Gaussian tail-based methods and can be used in other DLAD methods as well. This work utilizes the LSTM model to detect faults in the telemetry data of the spacecraft. Precision, recall, F 0.5 scores are computed to measure the performance. Input data sampling and reduction. Spacecrafts generate a large quantity of telemetry data when operating at space. The size and noise of the data could reduce the efficiency and accuracy of DLAD models. Conventional average sampling methods adopt a time window to compress a sequence of data into a data point. But the disadvantage is that the anomalous data is also shifted into the normal range. Tariq et al. [92] proposed an archive sampling method to reduce the data amount while maintaining the characteristics of raw data. To this end, a list is used to record each telemetry in one component. For each row data in the original dataset, different values are saved in the new database. In other words, rows with the same value will not be saved. With archive sampling, the characteristics have not been changed and remain the same with raw telemetry data. The method utilizes ConvLSTM and Mixtures of Probabilistic PCA (MPPCA) jointly to detect anomalies, where a higher error will be accepted as the final error score. The model is evaluated on a real-world satellite dataset with 22 million telemetry data points. The precision and F 1 score of the method outperforms four baseline methods (e.g., One-Class Support Vector Machines, Isolation Forest) to a large extent. But the recall is at a similar level with baseline methods. Protecting the control system. Attacks targeting control systems are covert and devastating, which do not necessarily change the values of sensors and network traffic. Detection methods rely on sensor measurements and communication patterns may fail to identify such attacks. Typically, malicious code that injected into control systems intentionally changes the running logic of controllers (e.g., PLCs), hence it can potentially cause physical damage to CPSs. However, conventional methods may fail to identify elaborate attacks that generate similar sequences of events to that of normal code blocks. Ezeme et al. [27,28] utilize system calls and kernel events to ensure the running status of control systems. Concretely, through log preprocessing, features (e.g., events) are extracted from raw log traces. Further, an LSTM model with an attention layer is adopted to predict subsequent event sequences. The prediction error is measured to identify the anomaly. Four scenarios (i.e., full-while, ffo-ls, hilRF-InFin, and sporadic) are used to simulate the status of a UAV, where the data is retrieved. The method outperforms three approaches [25,26,85] by evaluating true positives and false positives. Capture the stochasticity and temporal dependence. The multivariate time series data is produced widely in CPSs (e.g., spacecraft, ICS), which contains both stochasticity and temporal dependence. To better learn the patterns of normal data, capturing both characteristics can improve the accuracy of the detection. To this end, Su et al. [91] adopts a deep Bayesian model (named VAE) [52] to map input data into stochastic variables. Further, to learn temporal dependence, these variables are connected to hidden Gated recurrent units (GRUs) representations. Finally, planar NF [79] is used to learn non-Gaussian distributions of input data from hidden variables of the previous step, the output of which is fed to consecutive layers to reconstruct the original input data point. Reconstruction errors are utilized to detect anomalies in time-series data. The method outperforms three baseline methods (LSTM-NDT [44], DAGMM [118], LSTM-VAE [76]) in F 1 , precision, and recall when evaluated on three datasets. Detecting anomalies in the ADS-B system. As a key component of the air traffic control management, the Automatic dependent surveillanceâĂŞbroadcast (ADSâĂŞB) system is utilized to notify the position of an airplane to ground stations and other aircraft. However, attackers could eavesdrop messages to learn activities and position of aircraft or spoof messages to disturb the air traffic. Also, DoS attacks can cause airplanes to fail to report and receive information. Existing countermeasures require additional sensors to send signals or modification of the ADS-B protocol to provide authentication and encryption, which may not be possible due to the strict regulation. To detect the above attacks, Habler et al. [38] used ADS-B messages as the data source to detect anomalies. They utilized an LSTM autoencoder to reconstruct features of a window of messages. The input features include speed, latitude, longitude, altitude and distance delta. Reconstruction errors are used to detect the anomaly. The method is evaluated on a large-scale flight tracking dataset from Flightradar24 [33], which outperforms five baseline methods (e.g., Hidden Markov model with Gaussian mixture emissions (GMM-HMM) [40], one-class SVM, Isolation Forest, DBSTREAM [5]) when measured by true positives and false positives.

PUBLIC DATASETS
DLAD methods usually require a large volume of data to train and test neural models. It is important and essential to collect datasets for DLAD methods. In this section, we present publicly available datasets used in existing work. We summarize the characteristics of these datasets from (1) Systems and devices. The specific systems and devices where data is collected. (2) Period. When and how long the data has been collected. (3) Data types and size. Data types include sensors, actuators, network traffic, control system logs and commands, time series. (4) Attack or fault. We report the characteristics of attack or fault cases (if any). We list all available datasets in Table 3.

Datasets used in ICSs
SWaT. SWaT [46] is a six-stage scale-down water treatment testbed for research purposes, which implements main functionalities in a real-world water treatment plant. The raw water is pumped into the testbed at the first stage. The following four stages utilize chemical and physical processes (e.g., Ultrafiltration (UF) and Reverse Osmosis (RO) systems) to filter and generate pure water. The final stage is a backwash step to the UF system. The physical devices include pumps, sensors (e.g., the level of water, flow speed), tanks, and chemical/physical treatment devices. The cyber systems consist of a communication network, programmable logic controllers (PLCs) and the SCADA system. The dataset collected 7 days of normal data and 4 days of attack cases. The sensor and actuator values are in time-series form and sampled one data point every second, which is 125MB in normal period and 111MB in the attack period. The dataset also provides 50 network traces of normal period (300GB) and two network traces of attack period (104GB). 36 attacks (e.g., false control signals, false sensor readings) are designed to simulate real-world attacks. At Aug. 2019, the dataset updated with three hours of normal and one hour of attack data.
Modbus network data. Modbus is one of the communication protocols used in SCADA systems. Lemay et al. [58] developed a SCADA sandbox to generate normal and attack Modbus network traffic. The sandbox consists of Master Terminal Units (MTUs), controllers and field devices. For each simulated case, the traffic capturing duration varies from 1 minute to 1 hour. The dataset Table 3. Summary of publicly available datasets used in existing work. " ", "-", " " means "Yes", "Does not apply", and "Does not clear but inferred to be Yes" respectively. "D", "H" means "Day" and "Hour". "≈" means "approximately".  The attacks include malware and false control signals. The dataset can be downloaded at [57]. Tennessee Eastman process (TEP) simulation. TEP simulates a realistic setting of a chemical plant, which consists of a reactor, condenser, compressor, separator, and stripper. Totally, 53 measurements are collected from the system, of which 41 are normal values while 12 are manipulated. The normal measurements include temperature, level, pressure, flow, etc. The anomalous readings are feed flow, purge valve, steam valve, cooling water flow, etc. Since this simulation framework has been used in multiple methods [18,62,83,110], we adopt a well-documented version presented in [80]. The dataset includes the fault-free train (23MB), fault-free test (45MB), fault train (471MB), and fault test (798MB) versions of data. The training and testing datasets run for 25 and 48 hours respectively, which are sampled every 3 minutes. Specifically, twenty-one faults are designed to create anomalies in the system, which includes fixed sensor readings, random variation and the slow drift of sensor values, etc. The dataset is available at [81]. The simulator can be obtained at [2].
Gas pipeline testbed. Morris et al. [70] built a laboratory-scale gas pipeline system, where Modbus network traffic data in the SCADA system was generated. The testbed consists of a pump, valve, pipeline, fluid flow, and air compressor. A proportional integral derivative (PID) controller is adopted to manage air pressure. Twenty features are captured from traffic data in the dataset, i.e., the length of the packet, the pressure setpoint, PID related information, pressure, etc. The dataset is 17MB and contains 214580 normal traffic packets and 60048 packets in the attack period. There are three categories of attacks, e.g., packet injection, DoS, MITM. The dataset is available at [69].
Smart Home Technology (REFIT) dataset. REFIT is a research project that studies buildings, users, energy, communication, and design in UK homes [77]. The project carried out surveys and interviews to understand the perceptions of smart homes and qualitative data on electricity and gas usage. Also, measurement data is collected in real-world households from field sensors and devices. Four datasets focus on different aspects of smart homes in the REFIT project. We report the REFIT smart home dataset [21] that is used in one DLAD method [56]. The devices include thermostats, valves, meters and motion, door, window sensors in 20 homes. The data was collected from October 2014 to April 2015. A description of the location, construction details, energy services of homes is provided. Then, power load, gas usage, temperature, user activity sensors are monitored to form the time-series dataset, which is 94MB. There is no attack or fault in the dataset.
PHM 2015 Challenge. This challenge provides the running status of real industrial plants, which includes time-series sensor measurements, control signals data, and fault events. The devices mainly comprise Heating, ventilation, and air conditioning (HAVC) and some electricity meters. The data sampling frequency is 15 minutes and the collection lasts around three years, which ranges from 2010 to 2012. For each HAVC, sensors 1 to 4 (no details) and control status 1 to 4 are recorded. Meanwhile, the instant power and electricity consumption of each zone are reported. Totally, the dataset contains 70 plants, whose size is about 390MB. Five types of faults are produced in each plant, which covers abnormal temperature, wrong temperature setpoint, wrong cooling zone, etc. The dataset is available at [90].

Datasets used in smart grid
New York Independent System Operator (NYISO). NYISO is responsible for managing the power grid and marketplace in New York, while it does not operate or own the infrastructure. It publishes the market and operational data (i.e., pricing, power grid transmission, load data) every day. The load data is used by one work [23] to simulate a more real power grid. Researchers could also get pricing and transmission data. The dataset begins in May 2001 and keeps updating daily. Power load data of 11 areas in New York are recorded every five seconds, whose size is about 160KB each day. There is no attack or fault data in the dataset. The dataset is available at [75]. IEEE X-bus system. IEEE X-bus test system [10,12] is an approximation of the American Electric Power system, which is developed to simulate the power grid system in the U.S. Depending on the bus quantity and network topologies, there are 14, 24, 30, 39, 57, 118-bus systems. The devices include buses, generators, transformers, synchronous condensers, lines. Since it is a simulation platform, researchers can collect simulated data for any period. Voltage, current, and frequency measurements can be recorded in the system. Typically, data from a real power grid can be loaded into the system to generate more realistic scenarios. Though the system does not provide attack or fault cases, users can inject manually created attacks and faults (e.g., FDI) to simulate anomalies.

Datasets used in ITSs
Safety Pilot Model Deployment (SPMD) program. The SPMD program is to advance vehicle-to-vehicle (V2V) and vehicle-to-infrastructure (V2I) communications with a real environment, equipment, and deployment, which is performed by the University of Michigan. Vehicle awareness devices (VADs) and aftermarket safety devices (ASDs) are installed on over 2500 real passenger vehicles to support safety-ensuring communication messages. From August 2012 to February 2014, the V2V data was collected. Brake events, basic safety messages (BSM), front targets, GPS, radar and network traffic statistics information are published. The sensor data is about 3.2GB (e.g., brake, GPS, radar) and the network traffic is about 16GB (e.g., BSM). There are no attack or fault cases in the dataset. The description of the program is at [1] and the dataset is available at [20].
UAH-DriveSet driver behaviour data. UAH-DriveSet utilizes six different types of passenger vehicles and six different drivers to perform driving behaviors on motorway and secondary road. Three driving strategies (i.e., normal way, drowsy or aggressive mode) are adopted. Real vehicles with multiple sensors are applied to capture data, which are used in the Naturalistic Driving Study [7]. Over 500 minutes of driving performance data are collected in 36 tests. Speed, altitude, acceleration, latitude, and longitude coordinate information are stored in the dataset, which is 3.3GB. Aggressive driving behaviors are considered anomalies, which will cause sensor measurements to be different from the normal driving period. The description is at [82] while the dataset can be downloaded at [95].
CAN Dataset for intrusion detection (OTIDS). OTIDS provides CAN bus traffic that is generated during in-vehicle communication between different nodes. The attack-free dataset includes 2.3 million messages. DoS attack (656K messages), fuzzy attack (591K messages), impersonation attack (1.6 million messages) messages are injected in a real vehicle. The description is at [55] and the dataset can be downloaded at [39].

Datasets used in aerial systems
Soil Moisture Active Passive (SMAP) satellite. SMAP is a satellite developed to monitor the soil moisture and freeze on Earth. The telemetry data between the satellite and control center is published by [44]. Time information is anonymized and data is scaled between -1 and 1. There are 55 telemetry channels in the dataset and each channel represents one aspect of a spacecraft, e.g., power. For each channel, there can be multiple sensors to measure the status. Totally, the dataset is 86MB. 43 point anomalies and 26 contextual anomalies are also given in the dataset, but the details are not presented. The dataset is available at [43].
Mars Science Laboratory (MSL) rover, Curiosity. The curiosity's mission is to investigate whether there is evidence on Mars that the environment is habitable for humans. Telemetry data is transmitted to send control commands and receive measurement data. In the work [44], this data is published along with the SMAP project. The data is also scaled to (-1,1) and time values are deleted, where 27 telemetry channels are recorded. A telemetry stream consists of several control commands and a telemetry value. Also, 19 point anomalies and 17 contextual anomalies are used as anomalous data. The details of the anomalies are not shown in the paper. Researchers can download the dataset at [43].
Logs from a UAV platform. This dataset offers kernel event logs from QNX RTOS operating system traces on a UAV platform. The UAV is operated in four modes, which are full-while, fifo-ls, hilRF-InFin, and sporadic. Each scenario contains training samples, validation cases, and anomalies. Multiple traces of a scenario are generated when experimenting, each of which contains 50000 samples. Four types of attacks are introduced. The first attack runs a loop to exhaust CPU computing resources. The other two attacks schedule interfering tasks to interrupt normal operations. The last attack runs in a normal mode but deviates from training samples. The description of the dataset is at [85].
Flightradar24. ADS-B messages, which are used by aircraft to broadcast position and running status information, are utilized in the work [38] to build an LSTM-based anomaly detection method. Aircraft identification, position, velocities, status information can be contained in the message. In the work [38], over 800 flights from 14 airports are adopted, which range from March 2017 to April 2018. No anomaly cases are in the dataset, while the authors manually injected abnormal messages. ADS-B messages can be accessed at Flightradar24 [33].

DISCUSSION
In this section, we first present several findings based on the summary of current research studies (Section 6.1), which concludes the characteristics of contemporary DLAD methods from the aspect of our taxonomy. Further, we conclude several limitations of existing research (Section 6.2).

Our findings
(1) Most studies do not explicitly present a clear threat model. Although these methods usually claim to target either attacks or faults, they do not provide types and details of specific threats that they tend to detect. Also, in different CPSs, prevalent anomalies are usually different.
For example, most studies in the smart grid aim to detect the false data injection attack. (2) Sensor measurements in time-series form are the most adopted training and testing data source. First, almost all CPSs contain sensors, hence sensor readings can be easily obtained. Furthermore, sensor values reflect the working status of CPSs reasonably well. Last, sensor values can be accumulated in large quantities, which makes them perfect for deep learningbased methods. Meanwhile, network traffic is the second utilized data source. (3) RNNs (especially LSTMs) and autoencoders are the most commonly adopted architectures in DLAD methods (and their variants). RNNs are leveraged to capture temporal relation contained in univariate and even multivariate data. Autoencoders are employed to conduct unsupervised learning, which overcomes the absence of labeled data. A mixture of RNN and autoencoder is also adopted to exploit both advantages. In particular, RNN plus CNN combined networks are usually utilized to capture both temporal and context relations. (4) Prediction and reconstruction errors are equally employed to construct the loss function. All autoencoder-based DLAD methods utilize reconstruction error to build loss functions, which computes the difference between values reconstructed by the model and origin values. Other architectures tend to use prediction error, which computes the difference between values predicted by the model and real values. Prediction labels are typically adopted when labeled data is sufficient. (5) Depending on different CPSs, different implementation strategies are selected. For methods that work on industrial control systems, scale-down yet fully functional testbeds are often used to collect data. For example, SWaT is a popular water treatment testbed, which contains sensors, actuators, control PLCs, and network traffic. For the smart grid, simulation is most frequently used. In fact, the IEEE X-bus system is the de facto evaluation platform. Meanwhile, for intelligent transportation systems, real-world datasets are applied. Typically, CAN bus data is entirely obtained from real vehicles. In terms of aerial systems, real-world datasets are also preferred. Satellite, UAV, ADS-B data are all collected from real devices. (6) Precision, recall, F 1 are the most used evaluation metrics. In some cases, baseline methods are also presented to emphasize improvement. Note that these metrics are also commonly used in conventional statistical and machine-learning based methods. In particular, false positives and false negatives are balanced through the F 1 score. However, there is no specialized metric to measure the performance of DLAD methods. For example, training time and updating frequency are not considered at present. The computing and storage overhead has not been adequately evaluated.

Limitations of current methods
Manually created anomalous cases. As we can see from However, we argue that these synthetic anomalies either may not happen in the real world or obey a certain statistical distribution, which, unfortunately, may not represent the characteristics of threats in the real world. Hence, a well-designed DLAD method may not detect attacks or faults well when deployed on real CPSs. Moreover, based on different anomaly-creation methods, it is difficult to compare the performance of different methods even they tend to solve the same problem.
No running performance evaluation. We observe that almost all studies have not evaluated the running performance of DLAD models. To avoid catastrophic events, CPSs such as smart vehicles and aerial systems operate in real-time and need to respond to attacks or faults immediately. In this case, response time is an important factor to measure. For example, DLAD methods startup time and prediction time can be calculated. Furthermore, the computing power of certain CPSs is limited. Or, the computing resources that left to the DLAD methods are constrained at least. Typically, RAM on a commodity UAV is about 2 GB. Hence running costs like RAM usage and CPU overhead can be assessed.
No updating or online learning mechanism. Existing research efforts mainly focus on developing new models to improve detecting performance (e.g., reducing false positives and false negatives). However, the deployment of these methods has not been studied yet. Specifically, there is no updating mechanism of trained models to thwart new attacks. Meanwhile, time-series streaming data keeps being generated all the time, which can be utilized to enhance the model constantly.
When design one DLAD method, we can consider how to update the model (e.g., updating frequency and time) and keep learning from new data. The threshold is empirically selected. As a key part of DLAD methods, the number of layers and the sliding window size are hyperparameters that researchers have to decide. Such parameters can be empirically selected to design the network. However, once the network architecture (e.g., layers) is determined, the anomaly threshold needs to be resolved. Since it is the boundary of anomalies, the threshold plays an important role in the performance of DLAD models. Currently, the threshold is empirically set or selected in a brute force way. The value may not be optimized due to various reasons (e.g., weak validation process, the lack of experience), which could be time-consuming and error-prone. Also, the threshold is fixed and not adaptive, which may not suitable for new data.

TAKEAWAYS & CONCLUSION
In this section, we highlight several future research directions to improve deep anomaly detection methods. Based on our findings, these opportunities are proposed to solve the limitations of current DLAD methods.

Improving deep anomaly detection methods
Determine the anomaly threshold automatically and adaptively. We argue that the threshold should be decided: (1) Automatically. The conventional threshold tuning process is not efficient and error-prone. To this end, Su et al. [91] utilize the Extreme Value Theory (EVT) [89] to learn the threshold automatically. The key idea is to use a generalized Pareto distribution (GPD) to fit extreme values. Prediction errors of training datasets are used to optimize the threshold. No data distribution assumption is needed. Another method is to test a series of threshold values at a fixed interval and check the performance. Intuitively, the value that produces the best result can be selected.
(2) Adaptively. A threshold is decided and fixed when a model is trained on a known dataset. However, with the development of CPSs, the boundary of anomalies is changing. The threshold should evolve as new data comes. A naive strategy is to update the model regularly based on newly collected data. Then, a threshold is generated according to the data. Moreover, online learning could be adopted to let models learn from recent incremental data. Meanwhile, when each time the model is updated, a new threshold is calculated to replace the old one. Benchmarks with sufficient labeled and real-world anomalous data. To date, we have not found many benchmarks in CPSs that can be used to compare different DLAD methods. Although there exist some frequently used datasets (e.g., SWaT), different DLAD methods tend to tailor the dataset and adopt the processed data on their own. We suppose that benchmarks in each CPS domain (e.g., aerial systems) can help to improve the evaluation process. Different methods may compare performances on the same benchmark. Specifically, we conclude several requirements for benchmarks. (1) Cover enough data types. Ideally, sensor, actuator, network, and control system logs data can be provided. DLAD methods can choose any type of data based on their design goals. Also, some models tend to work better on specific data types (e.g., sensor time-series data), which could be produced separately. (2) Include labeled anomalous data. One challenge to evaluate DLAD methods is the lack of labeled anomalies. Researchers have to design and simulate attack or fault cases. Standard and rich attack data and cases can improve detection performance and reduce data-processing efforts. (3) Collect from the real world. Although simulation is widely adopted in certain domains (e.g., smart grid) due to hardware constraints, real measurements and anomalies can represent the status of systems better. For example, the sequential order and interval of packets in CAN bus traffic in a smart vehicle can be utilized as factors to decide whether there is an anomaly. Simulation may not fully contain and represent these important factors.
Enhance the running performance to a real-time level. We observe that many studies [11,84,96] in the smart vehicle domain discussed the running performance of DLAD methods. This is because the response time is critical to avoid devastating accidents in smart cars. To make DLAD methods more practical, we argue that running performance is important in other CPS systems as well. Concretely, the design can be improved from two aspects. (1) Accept real-time input measurements. Instead of using data from offline datasets, DLAD methods could obtain online real-time measurements and traffic from host systems. The data amount, sampling rate and format can be decided based on computing resources and network architectures. For example, DLAD methods that run on edge devices can achieve a high detection speed, which is owing to powerful computing ability. (2) Take real-time actions. While it is essential to detect anomalies, actions to prevent catastrophic losses can also be adopted. In some sense, actions should be taken into account when design and train DLAD models. For example, when designing the loss function, we could study how to choose appropriate actions in terms of different anomalies.
Locate the anomalous device or root cause. The detection performance (e.g., true positives, precision) is high in current DLAD methods. However, the location and the root cause of the anomaly is usually not identified. Users still do not know where an anomaly is from and how to handle the anomaly even DLAD methods detect anomalous status. Moreover, anomalies in different parts of CPSs present different impacts. We argue that DLAD methods could improve the detection granularity to component level. For example, Zhang et al. [112] adopt ConvLSTM to detect anomalies in each sensor or actuator. Once an anomaly is identified, the compromised device is also recognized. Then certain actions could be taken to prevent the loss. Further, this process can be automatically conducted without the intervene of users.
For different CPSs and problems, different compatible neural network architectures can be adopted. We observe that there exist typical data types and anomalies in different CPSs. In ICS, sensor time-series measurement data is commonly collected. Gradual sensor and sudden actuator change anomalies will break time relations in the data. LSTM-based models and variants are utilized to capture such time relation. Meanwhile, FDI attacks are prevalent in the smart grid. We find that DLAD methods are used to aid conventional state estimator methods. LSTM and autoencoder can both be adopted. Moreover, attacks on the CAN bus system in ITS are mostly seen. Thus LSTM and CNN are used to capture both time relation and context information (e.g., packet order and content). In aerial systems, most anomalies are injected. LSTM-based methods are utilized to capture time relations. We suggest that researchers custom their models based on these findings.

Conclusion
In this work, we systematically reviewed the current research efforts on deep learning-based anomaly detection methods in cyber-physical systems. To this end, we first propose a taxonomy to recognize the key properties of DLAD methods. Further, we highlight prevailing new DLAD methods and research findings under the light of our taxonomy. We also collect publicly available datasets that can be used in DLAD methods. To motivate future research in this area, we present our findings, limitations of existing work, and possible future directions to improve DLAD methods. Our study contributes guidance to design practical DLAD methods and understanding of the current research trend.