## 5 Analysis of Co-Occurrence
### Author's Keyword-Based Co-Occurrence Analysis  
This subsection outlines the analysis of keyword co-occurrence as used by authors in publications focused on intrusion detection in OT security. VosViewer identified 1169 keywords, of which 54 met the specific criteria. Among these, the 15 keywords with the top TLS values are listed in Table 7. According to Table 7, the keyword 'Industrial Control System' was mentioned in 167 articles (Np). In these articles, 'Industrial Control System' appeared alongside 90 other OT security keywords. It has a TLS of 144, representing the total instances it co-appeared with each of the other keywords, each appearing at least five times. In this scenario, the connection strength between each pair of co-occurring keywords was determined by 1/n (because of the citing article) if an article had 'n' author keywords. For instance, if an article contains ten co-occurring terms, the link strength for each term would be calculated as 1/10. TLS reflects the aggregate strength of a keyword's association with all other keywords that occur together in all listed publications. The cumulative fractional link strengths of a keyword in any published article will consistently sum up to one, ensuring that the TLS for keyword co-occurrences is invariably a whole number and never a fractional value. Consequently, the count of these published articles (Np) should match the overall co-occurrence link strength of a term throughout all articles. Nevertheless, this trend is absent in Table 7, where the TLS is persistently lower than the true number of publications (Np), even though it remains a whole number. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Rank** & **Keyword** & **Np** & **Links** & **TLS** \\ \hline
1 & Industrial Control System & 167 & 90 & 144 \\
2 & Anomaly Detection & 150 & 82 & 142 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: The top 15 keywords with the maximum co-occurrence TLS values for author keywords. Figure 18: The co-occurrence network encompasses all keywords within the realm of OT security from the Web of Science. From Table 7 it can be seen that keywords can be roughly divided into two groups by popularity with Np's more or less than 100. Among the most popular would be the previously mentioned 'Industrial Control System' along with its plural version, 'Anomaly Detection' with 'Intrusion Detection' and 'Machine Learning'. Lower-rank keywords sometimes \"overlap\" with high-ranked words, e.g., 'ICS', 'Industrial Controls System (ISC)', etc. The domination of \"general\" keywords in the table that simply define the research area demonstrates that still a lot of research just marks the importance of the area rather than suggesting a specific solution, maybe except the topic on attack/intrusion detection. The co-occurrence network map created using VosViewer, shown in Figure 19, demonstrates the connections between the author's keywords. Similarly to Figure 18, there is no clear domination of specific keywords, and relatively bigger nodes of 'Industrial Control Systems', 'Scada', and 'Anomaly Detection' are just slightly bigger than outsiders. OT is on the net, but its popularity is much lower than more common SCADA/ICS/PLC terms. As an interesting point, we can note some relatively distinct but topic-specific nodes, not typical for other information technology security areas: 'ensemble learning', 'hardware trojan' and their detection, 'federated learning', and 'transfer learning'. These nodes, although weakly connected to other nodes, demonstrate area-specific problems, specifics of OT architectural solutions, and possible directions for research widening.