## 2 Related Work
### Defense Mechanisms in Cloud-Edge Collaboration ICSs  
Current defense mechanisms against security threats in cloud-edge collaboration ICSs can be systematically categorized into two primary approaches: detection mechanisms and response mechanisms [17; 18]. Detection mechanisms focus on identifying potential attack behaviors through various analytical techniques, while response mechanisms aim to enhance system robustness and maintain operational continuity even under attack conditions. Detection mechanisms in cloud-edge collaboration ICSs primarily operate through systematic monitoring and analysis of network traffic, system behaviors, and operational patterns to identify potential security threats. These approaches can be fundamentally categorized into three distinct methodologies: signature-based detection, which relies on predefined attack pattern databases to recognize known threats; anomaly-based detection, which establishes baseline behavioral profiles and identifies deviations that may indicate malicious activities; and hybrid detection systems that combine multiple techniques to enhance overall effectiveness [19; 20]. Contemporary detection strategies increasingly leverage machine learning algorithms, including support vector machines, random forests, convolutional neural networks, and recurrent neural networks such as LSTM and GRU, to process high-dimensional feature spaces and identify complex attack patterns in real-time [21; 22]. Furthermore, the distributed nature of cloud-edge architectures has prompted the development of federated learning-based detection mechanisms, where multiple edge nodes collaboratively perform anomaly detection while preserving data privacy through  
Figure 1: Cloud–edge collaboration ICS architecture. parameter sharing rather than raw data exchange. These distributed approaches address the scalability and fault tolerance requirements of modern ICS deployments while maintaining computational efficiency through lightweight model architectures and efficient data preprocessing techniques. Although these detection methodologies have achieved significant advances in identifying various attack vectors, including false data injection [23; 24; 25; 26], denial of service [27; 28], and unauthorized access attempts [29; 30], they often struggle to cope with sophisticated stealth attacks that employ evasion techniques or mimic normal operational behaviors, highlighting the inherent limitations of purely detection-based defensive strategies. Response mechanisms in cloud-edge collaboration ICSs encompass a comprehensive array of defensive strategies designed to maintain system resilience and operational continuity under adversarial conditions. Redundancy techniques constitute the cornerstone of these response mechanisms, functioning as fundamental countermeasures against false data injection attacks and other security threats by implementing multi-layered protective architectures across communication, software, and hardware domains [31; 32; 33]. Contemporary industrial control systems extensively deploy redundancy solutions such as Control-Logix redundant systems at the programmable logic controller (PLC) level and controller development system (CODESYS) redundancy toolkits at the compiler level, which collectively enhance system robustness through real-time cross-validation, voting mechanisms, and standby system configurations [34; 35; 36; 37]. Building upon these foundational approaches, advanced defensive paradigms including moving target defense (MTD) [38; 39; 40] and heterogeneous redundancy [41; 42; 43; 44] have emerged to further strengthen protective capabilities by dynamically modifying system parameters, communication protocols, and architectural configurations, thereby significantly increasing the complexity and unpredictability of attack surfaces.