## 6 Citation Analysis
### Documents-Based Citation Analysis  
This subsection presents an analysis of citations of documents in OT security research. The analysis was conducted based on a criterion of a minimum of five citations per document. A VosViewer search identified a total of 922 publications, out of which only 531 met the criteria, with 360 forming the largest set of interconnected documents. Table 8 includes the top ten cited documents from the unconnected group, highlighting that the most influential articles were published between 2018 and 2023, with publications from 2023 being the most dominating. It is, of course, worth mentioning that the absence of the 2024-year publications is not a sign of the decreasing quality/impact, but rather the fact that they are just published and have not been published yet. It is worth noticing that there is no direct correlation between the number of citations and the number of links. Also, an interesting point is that the most cited publication is published in conference proceedings, while all the others are published in journals. This is relatively strange since proceedings are dominated by a total number of publications. This could be a sign that despite conference popularity journal articles allow reaching a wider audience and research visibility. Also, there is a clear visibility of the _'Computers & Security'_ journal domination in publishing highly cited papers.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Rank** & **Title of Article** & **Source** & **Authors** & **Year** & **Citation** & **Link** \\ \hline \multirow{4}{*}{1} & Detecting Cyber Attacks in Industrial & CPS-SPC '18: Proceedings of & & & & \\  & Control Systems Using & the 2018 Workshop on & [PERSON], & & & \\  & Convolutional Neural Networks [26] & Cyber-Physical Systems & [PERSON] & 2018 & 184 & 40 \\  & A Review of Anomaly Detection & Security and Privacy & & & & \\
2 & Strategies to Detect Threats to & _Electronics_ & & 2023 & 16 & 27 \\  & Cyber-Physical Systems [6] & & & & & \\  & Multilayer Data-Driven Cyber-Attack & & & & & \\  & Detection System for Industrial & _IEEE Transactions on_ & _Industrial Informatics_ & 2019 & 201 & 24 \\  & Control Systems Based on Network, & & & & & \\  & System, and Process Data [27] & & & & & \\  & A Survey on Industrial Control & & & & \\
4 & System Tesbeds and Datasets for & _& _& & \\  & Security Research [28] & & _& & \\  & Machine learning in industrial & & & & \\  & control system (ICS) security: & & & & \\
5 & current landscape, opportunities & _Information Systems_ & & & \\  & and challenges [29] & & & & \\  & Cybersecurity for industrial control & & & & \\  & systems: A survey [30] & & & & \\  & & & & \\  & &Figure 20 illustrates the citation networks related to intrusion detection in OT security using published documents in WoS, where nodes and connections are color-coded according to their respective co-citations. Here, once again, we can see the situation that although some stronger nodes, such as [PERSON], [PERSON], and [PERSON] [26; 34; 35], are not much stronger than others. It demonstrates that many researchers have started working on the problem, but there are no dominating groups yet. This is both a good point, since it allows the growth of competing centers, and a bad point, as it shows the absence of outstanding authorities. Authors on the \"orbit\" of this \"universe\" can either enter the \"universe\" center and strengthen their positions or be blown up away. For these less-cited authors, analysis of this diagram can be useful for understanding their real position and taking action to strengthen the research.