This systematic literature review examines the intersection of Graph Neural Networks (GNN) for threat detection and Reinforcement Learning (RL) for automated response in Cyber-Physical Systems (CPS). The survey traces the evolution from separate detection and response paradigms to emerging hybrid approaches, identifying only 2-3 papers at this intersection as of 2025. The authors present a hierarchical taxonomy of methods, analyze performance benchmarks (92-97% detection rates, sub-second response latency), and highlight critical challenges including state representation mapping and safety-critical constraints. Findings reveal a significant research gap in tightly coupled detection-response pipelines despite mature component technologies.
Key findings
Only 2-3 papers currently exist at the GNN-RL intersection despite mature standalone technologies, indicating a major research frontier.
GNN detection methods achieve 92-97% detection rates with 10-100ms inference, while RL responses reduce containment time by 30-50%.
Critical unsolved challenges include converting dynamic graph embeddings to RL state spaces and handling safety-critical action constraints.
No standardized benchmarks or public datasets exist for evaluating integrated GNN-RL systems in CPS environments.
The field is transitioning from separate detection/response eras (2019-2024) to an integrated hybrid era (2025+).
Limitations & open questions
Limited to survey analysis without proposing or validating a novel experimental framework.
Heavy focus on smart grid and water systems with limited coverage of other CPS domains.
Citations include future dates (2025-2026) that may represent preprints or projections rather than established work.