A Dataset to Support Research in the Design of Secure Water Treatment Systems
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Cites
The 1999 DARPA off-line intrusion detection evaluation
Lippmann, R. P., Haines, J. W., Fried, D. J., Korba, J., & Das, K. (2000) · Computer Networks · doi:10.1016/s1389-1286(00)00139-0 · Cited by 877 · see citing works
The UCI KDD archive of large data sets for data mining research and experimentation
Bay, S. D., Kibler, D. F., Pazzani, M. J., & Smyth, P. (2000) · ACM SIGKDD Explorations Newsletter · doi:10.1145/380995.381030 · Cited by 234 · see citing works
An Investigation into the Response of a Water Treatment System to Cyber Attacks
Adepu, S., & Mathur, A. P. (2016) · Proceedings - IEEE International Symposium on High-Assurance Systems Engineering/Proceedings · doi:10.1109/hase.2016.14 · Cited by 88 · see citing works
Self-citation
Flagged first, then by citations
Cited by
Sorted by citations
Graph Neural Network-Based Anomaly Detection in Multivariate Time Series
Deng, A., & Hooi, B. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i5.16523 · Cited by 1,413 · see citing works
“Since the systems took 5-6 hours to reach stabilization when first turned on (Goh et al. 2016), we eliminate the first 2160 samples for both datasets.”
BackgroundMAD-GAN: Multivariate Anomaly Detection for Time Series Data with Generative Adversarial Networks
Li, D., Chen, D., Jin, B., Shi, L., Goh, J., & Ng, S.-K. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-30490-4_56 · Cited by 1,323 · see citing works
“ys. For both of these datasets, we eliminated the rst 21;600 samples from the training data (normal data) since it took 5-6 hours to reach stabilization when the system was rst turned on according to [26]. In the anomaly detection process, we subdivide the original long multiple sequences into smaller time series by t…”
BackgroundMethodInfluentialSelf-citationUSAD: UnSupervised Anomaly Detection on Multivariate Time Series
Audibert, J., Michiardi, P., Guyard, F., Marti, S., & Zuluaga, M. A. (2020) · Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining · doi:10.1145/3394486.3403392 · Cited by 1,094 · see citing works
“The SWaT dataset 1 is a scaled down version of a real-world industrial water treatment plant producing filtered water [4].”
BackgroundDetecting Cyber Attacks in Industrial Control Systems Using Convolutional Neural Networks
Kravchik, M., & Shabtai, A. (2018) · Workshop on Cyber-Physical Systems Security and PrivaCy (CPS-SPC) · doi:10.1145/3264888.3264896 · Cited by 393 · see citing works
“Recently, unsupervised machine learning was shown to be effective [7] [19] for detecting cyber attacks using data obtained from a dedicated water plant testbed (SWaT) [6] which was built to support research related to the design of secure cyber physical systems (CPSs).”
BackgroundMethodInfluentialAnomaly Detection for a Water Treatment System Using Unsupervised Machine Learning
Inoue, J., Yamagata, Y., Chen, Y., POSKITT, C. M., & Sun, J. (2017) · IEEE ... International Conference on Data Mining workshops · doi:10.1109/icdmw.2017.149 · Cited by 372 · see citing works
“They use stacked LSTMs to detect anomalies, and the same SWaT dataset in their evaluation [12].”
MethodInfluentialCyber risk and cybersecurity: a systematic review of data availability
Cremer, F., Sheehan, B., Fortmann, M., Kia, A. N., Mullins, M., Murphy, F., & Materne, S. (2022) · The Geneva Papers on Risk and Insurance Issues and Practice · doi:10.1057/s41288-022-00266-6 · Cited by 437 · see citing works
MST-GAT: A multimodal spatial–temporal graph attention network for time series anomaly detection
Ding, C., Sun, S., & Zhao, J. (2022) · Information Fusion · doi:10.1016/j.inffus.2022.08.011 · Cited by 319 · see citing works
“Secure Water Treatment (SWaT) [50] dataset is collected from the scaleddown water treatment testbed with 51 sensors, consisting of seven days of normal operation and four days of simulated attack scenarios.”
MethodAn Evaluation of Anomaly Detection and Diagnosis in Multivariate Time Series
Garg, A., Zhang, W., Samaran, J., Ramasamy, S., & Foo, C.-S. (2021) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2021.3105827 · Cited by 293 · see citing works
“Based on author descriptions of anomalies for SWaT [37], WADI [38], DMDS [39], MSL [5] and SMAP [5] datasets, and our own visualizations (e.”
MethodThe rise of traffic classification in IoT networks: A survey
Tahaei, H., Afifi, F., Asemi, A., Zaki, F., & Anuar, N. B. (2020) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2020.102538 · Cited by 278 · see citing works
Self-Supervised Learning for Time Series Analysis: Taxonomy, Progress, and Prospects
Zhang, K., Wen, Q., Zhang, C., Cai, R., Jin, M., Liu, Y., Zhang, J. Y., Liang, Y., Pang, G., Song, D., et al. (2024) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2024.3387317 · Cited by 295 · see citing works
A Survey on Industrial Control System Testbeds and Datasets for Security Research
Conti, M., Donadel, D., & Turrin, F. (2021) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2021.3094360 · Cited by 284 · see citing works
Anomaly Detection with Generative Adversarial Networks for Multivariate Time SeriesPreprint
Li, D., Chen, D., Goh, J., & Ng, S.-K. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1809.04758 · Cited by 233 · see citing works
“5The raw data are not plotted in this paper due to page limit—please refer to [37] for more information.”
BackgroundMethodInfluentialSelf-citationTowards a Rigorous Evaluation of Time-Series Anomaly Detection
Kim, S., Choi, K., Choi, H.-S., Lee, B., & Yoon, S. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i7.20680 · Cited by 219 · see citing works
“In this section, we introduce a list of the five most widely used TAD benchmark datasets as follows: Secure water treatment (SWaT) (Goh et al. 2016): the SWaT dataset was collected over 11 days from a scaled-down water treatment testbed comprising 51 sensors (Mathur and Tippenhauer 2016).”
MethodA stacking ensemble of deep learning models for IoT intrusion detection
Lazzarini, R., Tianfield, H., & Charissis, V. (2023) · Knowledge-Based Systems · doi:10.1016/j.knosys.2023.110941 · Cited by 199 · see citing works
A survey on deep learning for cybersecurity: Progress, challenges, and opportunities
Macas, M., Wu, C., & Fuertes, W. (2022) · Computer Networks · doi:10.1016/j.comnet.2022.109032 · Cited by 192 · see citing works
Umer, M., Junejo, K. N., Jilani, M. T., & Mathur, A. P. (2022) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2022.100516 · Cited by 172 · see citing works
“Following the publication of the dataset in [61], iTrust has made public several other datasets collected from the SWaT testbed [77].”
MethodSelf-citationLin, Q., Adepu, S., Verwer, S., & Mathur, A. P. (2018) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3196494.3196546 · Cited by 157 · see citing works
“SWaT dataset [19] was collected over 11 days of continuous operation.”
BackgroundMethodInfluentialSelf-citationSánchez, P. M. S., Valero, J. M. J., Celdrán, A. H., Bovet, G., Pérez, M. G., & Pérez, G. M. (2021) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2021.3064259 · Cited by 149 · see citing works
“Similarly, the Water Distribution (WADI) dataset [170] contains 575 MB of labeled sensor and actuator logs collected in the same water treatment plant.”
BackgroundMethodMacas, M., Wu, C., & Fuertes, W. (2023) · Expert Systems with Applications · doi:10.1016/j.eswa.2023.122223 · Cited by 160 · see citing works
Intrusion Detection Systems: A Cross-Domain Overview
Tidjon, L. N., Frappier, M., & Mammar, A. (2019) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2019.2922584 · Cited by 136 · see citing works
“InIndustrial and Control Systems, Feng et al. [110] proposed a real-time GAN-based learning method to conduct stealthy attacks using a Secure Water Treatment (SWaT) testbed [208].”
MethodDAEMON: Unsupervised Anomaly Detection and Interpretation for Multivariate Time Series
Chen, X., Deng, L., Huang, F., Zhang, C., Zhang, Z., Zhao, Y. L., & Zheng, K. (2021) · IEEE International Conference on Data Engineering (ICDE) · doi:10.1109/icde51399.2021.00228 · Cited by 133 · see citing works
“…real applications, the devices being monitored generate large amount of multivariate time series, such as spacecraft-s [4], server machines [2], water treatment system [5], etc. Operators mainly care about entity-level anomalies, instead of metric-level anomalies based on univariate time series.”
BackgroundA Systematic Review of the State of Cyber-Security in Water Systems
Tuptuk, N., Hazell, P., Watson, J., & Hailes, S. (2021) · Water · doi:10.3390/w13010081 · Cited by 138 · see citing works
“One of the widely studied datasets in cyber-security research is the SWaT dataset [50] containing normal data streams collected from 51 sensors and actuators collected over 7 days, and attack data consisting of 41 attacks carried out over a period of 4 days.”
BackgroundMethodChen, Y., POSKITT, C. M., & Sun, J. (2018) · Singapore Management University Institutional Knowledge (InK) (Singapore Management University) · Cited by 129 · see citing works
Koay, A. M. Y., Ko, R. K. L., Hettema, H., & Radke, K. (2023) · Journal of Intelligent Information Systems · doi:10.1007/s10844-022-00753-1 · Cited by 131 · see citing works
“Newer datasets have been introduced for ICS research such as the Missis-sippi State University (MSU) Power, Gas, and Water datasets (Morris, 2018) and Singa-pore University of Technology and Design’s Secure Water Treatment (SWaT) dataset (Goh et al., 2016).”
BackgroundMethodA Systematic Framework to Generate Invariants for Anomaly Detection in Industrial Control Systems
Feng, C., Palleti, V. R., Mathur, A. P., & Chana, D. (2019) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23265 · Cited by 129 · see citing works
“The SWaT data log is collected by running SWaT nonstop from its empty state to a fully operational state for a total of 11-days, and is originally reported in [41].”
MethodInfluentialSelf-citationToward Detection and Attribution of Cyber-Attacks in IoT-Enabled Cyber–Physical Systems
Jahromi, A. N., Karimipour, H., Dehghantanha, A., & Choo, K. R. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3067667 · Cited by 125 · see citing works
Kheddar, H., Himeur, Y., & Awad, A. I. (2023) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2023.103760 · Cited by 134 · see citing works
“SWaT includes both normal and attack scenarios, making it suitable for use in research on intrusion detection and cybersecurity for ICSs [65].”
BackgroundAnomaly detection in Industrial Control Systems using Logical Analysis of Data
Das, T. K., Adepu, S., & Zhou, J. (2020) · Computers & Security · doi:10.1016/j.cose.2020.101935 · Cited by 124 · see citing works
Self-citationBelay, M. A., Blakseth, S. S., Rasheed, A., & Rossi, P. S. (2023) · Sensors · doi:10.3390/s23052844 · Cited by 137 · see citing works
“A min-max scaling was considered for feature normalization and stable training of the models, i.e., where x is the actual measurement and x (cid:48) is the value after scaling.”
MethodFederated Learning-Based Explainable Anomaly Detection for Industrial Control Systems
Hương, T. T., Bac, T. P., Ha, K. N., Việt, N. H., Hoang, N. X., Hung, N. T., & Tran, K. P. (2022) · IEEE Access · doi:10.1109/access.2022.3173288 · Cited by 126 · see citing works
“Recently, in [15], the author proposed a Logical Analysis of Data (LAD-ADS) solution using a rule-based method to detect anomalous behaviours in ICS systems over the Secure Water Treatment (SWaT) dataset [23], which is, in our opinion, not a purely time-series data scenario.”
MethodChen, Y., POSKITT, C. M., & Sun, J. (2018) · Proceedings - IEEE Symposium on Security and Privacy/Proceedings of the ... IEEE Symposium on Security and Privacy · doi:10.1109/sp.2018.00016 · Cited by 118 · see citing works
“Our attacks are from a benchmark of attacks that were performed on the SWaT testbed for the purpose of data collection [12].”
BackgroundMethodInfluentialA Dual-Isolation-Forests-Based Attack Detection Framework for Industrial Control Systems
Elnour, M., Meskin, N., Khan, K. M., & Jain, R. K. (2020) · IEEE Access · doi:10.1109/access.2020.2975066 · Cited by 117 · see citing works
“The network packets were altered to reflect the spoofed values from the sensors [29].”
MethodNedeljkovic, D. M., & Jakovljević, Ž. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102585 · Cited by 113 · see citing works
Feng, C., & Tian, P. (2021) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3447548.3467137 · Cited by 112 · see citing works
“scaled down water treatment plant producing filtered water [20].”
BackgroundWang, F., Jiang, Y., Zhang, R., Wei, A., Xie, J., & Pang, X. (2025) · Sensors · doi:10.3390/s25010190 · Cited by 119 · see citing works
Aoudi, W., Iturbe, M., & Almgren, M. (2018) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3243734.3243781 · Cited by 110 · see citing works
“The SWaT dataset [16] is a collection of process readings and network traces from the Secure Water Treatment (SWaT) testbed.”
BackgroundMethodAhmed, C. M., Zhou, J., & Mathur, A. P. (2018) · Annual Computer Security Applications Conference · doi:10.1145/3274694.3274748 · Cited by 104 · see citing works
Self-citationA Hardware-in-the-Loop Water Distribution Testbed Dataset for Cyber-Physical Security Testing
Faramondi, L., Flammini, F., Guarino, S., & Setola, R. (2021) · IEEE Access · doi:10.1109/access.2021.3109465 · Cited by 104 · see citing works
“Table 1 summarizes the key features of our dataset in relation to those described in [11] and [12].”
BackgroundGenerative Adversarial Networks for Spatio-temporal Data: A Survey
Gao, N., Xue, H., Shao, W., Zhao, S., Qin, K. K., Prabowo, A., Rahaman, M. S., & Salim, F. D. (2022) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3474838 · Cited by 127 · see citing works
“social networks [40, 97] Yelp [1] Location-based social networks [81, 97, 166] ST events Yellow taxi dataset [2] Taxi demand data [120] CitiBike trip dataset [104] Bike demand data [120] SWaT dataset [43] Attacked data in water system [80] Graphs ArXiv-AstroPh [79] Scientific collaborations data [143] Wikipedia [49] N…”
BackgroundAnomaly Detection for Industrial Control System Based on Autoencoder Neural Network
Wang, C., Wang, B., Liu, H., & Qu, H. (2020) · Wireless Communications and Mobile Computing · doi:10.1155/2020/8897926 · Cited by 99 · see citing works
Local Evaluation of Time Series Anomaly Detection Algorithms
Huet, A., Navarro, J. M., & Rossi, D. (2022) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3534678.3539339 · Cited by 103 · see citing works
“This also holds for the SWaT dataset, for which we give a detailed event level interpretation in Sec.”
BackgroundMethodInfluentialMiao, J., Tao, H., Xie, H., Sun, J., & Cao, J. (2023) · Information Processing & Management · doi:10.1016/j.ipm.2023.103569 · Cited by 99 · see citing works
Robust anomaly detection for multivariate time series through temporal GCNs and attention-based VAE
Shi, Y., Wang, B., Yu, Y., Tang, X., Huang, C., & Dong, J. (2023) · Knowledge-Based Systems · doi:10.1016/j.knosys.2023.110725 · Cited by 98 · see citing works
High-Performance Unsupervised Anomaly Detection for Cyber-Physical System Networks
Schneider, P., & Böttinger, K. (2018) · doi:10.1145/3264888.3264890 · Cited by 95 · see citing works
“The SWaT environment consists of several machines, programmable logic controllers (PLC) and computers, as well as 51 sensors and actuators which mainly use the Common Industrial Protocol (CIP) over EtherNet/IP (EN/IP) [15].”
BackgroundMethodGAN-Based Anomaly Detection for Multivariate Time Series Using Polluted Training Set
Du, B., Sun, X., Ye, J., Cheng, K., Wang, J., & Sun, L. (2021) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2021.3128667 · Cited by 95 · see citing works
“The data was collected from an operational test-bed for water treatment [31].”
MethodAnomaly Detection Dataset for Industrial Control Systems
Dehlaghi-Ghadim, A., Moghadam, M. H., Balador, A., & Hansson, H. (2023) · IEEE Access · doi:10.1109/access.2023.3320928 · Cited by 101 · see citing works
“As pointed out in [28], a combination of unlabeled network traces and the attack log file forms an unsupervised or semi-supervised dataset for attack detection.”
APAD: Autoencoder-based Payload Anomaly Detection for industrial IoE
Kim, S.-J., Jo, W., & Shon, T. (2019) · Applied Soft Computing · doi:10.1016/j.asoc.2019.106017 · Cited by 91 · see citing works
Multivariate Abnormal Detection for Industrial Control Systems Using 1D CNN and GRU
Xie, X., Wang, B., Wan, T., & Tang, W. (2020) · IEEE Access · doi:10.1109/access.2020.2993335 · Cited by 91 · see citing works
“, P1 through P6 [31].”
Catillo, M., Pecchia, A., & Villano, U. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103210 · Cited by 96 · see citing works
Saheed, Y. K., Omole, A. I., & Sabit, M. O. (2025) · Sensors International · doi:10.1016/j.sintl.2024.100297 · Cited by 88 · see citing works
S., P., Krithivasan, K., S., P., & Sriram V.S., S. (2020) · IEEE Transactions on Industry Applications · doi:10.1109/tia.2020.2977872 · Cited by 88 · see citing works
“SWaT is a completely downsized water treatment plant built by the Singapore University of Technology and Design [38].”
BackgroundGRELEN: Multivariate Time Series Anomaly Detection from the Perspective of Graph Relational Learning
Zhang, W., Zhang, C., & Tsung, F. (2022) · Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2022/332 · Cited by 99 · see citing works
Advanced Intrusion Detection Combining Signature-Based and Behavior-Based Detection Methods
Kwon, H.-Y., Kim, T., & Lee, M.-K. (2022) · Electronics · doi:10.3390/electronics11060867 · Cited by 85 · see citing works
“In this study, we validated the performance of the proposed method using the secure water treatment (SWaT) dataset [25], which comprises data that are representative of those collected by a water treatment ICS.”
InfluentialA feature selection based on genetic algorithm for intrusion detection of industrial control systems
Fang, Y., Yao, Y. K., Lin, X., Wang, J., & Zhai, H. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103675 · Cited by 86 · see citing works
Network Traffic Fingerprinting for IIoT Device Identification: A Survey
Sheng, C., Zhou, W., Han, Q., et al. (2025) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2025.3534441 · Cited by 82 · see citing works
“TheSWaTdataset[99]isgeneratedfromase-curewatertreatmenttestbedconsistingofRemoteInput/Output units,PLCs,HMIs,asupervisorycontrolanddataacquisition (SCADA)workstation,andahistorian.”
MADICS: A Methodology for Anomaly Detection in Industrial Control Systems
Gómez, Á. L. P., Maimó, L. F., Celdrán, A. H., & Clemente, F. J. G. (2020) · Symmetry · doi:10.3390/sym12101583 · Cited by 76 · see citing works
Anomaly Detection in Smart Environments: A Comprehensive Survey
Fährmann, D., Martín, L., Sánchez, L., & Damer, N. (2024) · IEEE Access · doi:10.1109/access.2024.3395051 · Cited by 80 · see citing works
“These anomalies could lead to potential safety issues if not detected at an early stage [201].”
BackgroundDeep Learning Advancements in Anomaly Detection: A Comprehensive Survey
Huang, H., Wang, P., Pei, J., Wang, J., Alexanian, S., & Niyato, D. T. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3585884 · Cited by 95 · see citing works
Unsupervised Anomaly Detection in IoT Systems for Smart Cities
Guo, Y., Ji, T., Wang, Q., et al. (2020) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2020.3027543 · Cited by 73 · see citing works
Unsupervised Deep Learning for IoT Time Series
Liu, Y., Zhou, Y., Yang, K., & Wang, X. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3243391 · Cited by 78 · see citing works
“Secure water treatment (SWaT) data set [173] and water distribution (WADI) data set [174] are two commonly used IoT time-series data sets for anomaly detection.”
MethodIndustrial Anomaly Detection: A Comparison of Unsupervised Neural Network Architectures
Siegel, B. (2020) · IEEE Sensors Letters · doi:10.1109/lsens.2020.3007880 · Cited by 71 · see citing works
“The SWAT dataset [16] appears in a few anomaly detection studies including Inoue et al.”
MethodAnomaly Detection for Industrial Control Systems Using Sequence-to-Sequence Neural Networks
Kim, J., Yun, J.-H., & Kim, H. C. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-42048-2_1 · Cited by 72 · see citing works
ConAML: Constrained Adversarial Machine Learning for Cyber-Physical Systems
Li, J., Yang, Y., Sun, J., Tomsovic, K. L., & Qi, H. (2021) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3433210.3437513 · Cited by 67 · see citing works
“ced. 5.2 Case Study: Water Treatment System 5.2.1 Background: SWaT Dataset. In this section, we study the linear inequality physical constraints based on the Secure Water Treatment (SWaT) proposed in [15]. SWaT is a scaled-down system but with fully operational water treatment functions. The testbed has six main proce…”
BackgroundInfluentialDetecting Multivariate Time Series Anomalies with Zero Known Label
Zhou, Q., Chen, J., Liu, H., He, S., & Meng, W. (2023) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v37i4.25623 · Cited by 70 · see citing works
“2019), PSM (Pooled Server Metrics) (Abdulaal, Liu, and Lancewicki 2021), SWaT (Secure Water Treatment) (Goh et al. 2016) and WADI (Water Distribution) (Ahmed, Palleti, and Mathur 2017).”
MethodAhmed, C. M., Raman, M. R. G., & Mathur, A. P. (2020) · doi:10.1145/3384941.3409588 · Cited by 68 · see citing works
“The dataset available in [22], represents only one of the SWaT’s operational modes.”
MethodSelf-citationNetwork Anomaly Detection With Temporal Convolutional Network and U-Net Model
Mezina, A., Bürget, R., & Travieso, C. M. (2021) · IEEE Access · doi:10.1109/access.2021.3121998 · Cited by 64 · see citing works
“…datasets, which are used for evaluation of anomaly detection: Aegean WiFi Intrusion Dataset (AWID), which contains real flows of normal and intrusive 802.11 traffic [34], Secure Water Treatment (SWaT) dataset [35], Water Distribution (WADI) [36], which are testbeds for security research and training.”
MethodInfluentialShalyga, D., Filonov, P., & Lavrentyev, A. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1807.07282 · Cited by 64 · see citing works
“Results for SVM and DNNmodels were taken from [13].”
MethodIntrusion and anomaly detection for the next-generation of industrial automation and control systems
Rosa, L., Cruz, T., de Freitas, M. B., Quitério, P., Henriques, J., Caldeira, F., Monteiro, E., & Simões, P. (2021) · Future Generation Computer Systems · doi:10.1016/j.future.2021.01.033 · Cited by 63 · see citing works
“It successfully detected 32 out of 36 attacks in a public industrial water treatment dataset [41], processing physical process parameters in time windows of 200 seconds.”
BackgroundSurvey of federated learning in intrusion detection
Zhang, H., Ye, J., Huang, W. X., Liu, X., & Gu, J. J. (2024) · Journal of Parallel and Distributed Computing · doi:10.1016/j.jpdc.2024.104976 · Cited by 74 · see citing works
Studies on the GAN-Based Anomaly Detection Methods for the Time Series Data
Lee, C., Cheon, Y.-J., & Hwang, W. (2021) · IEEE Access · doi:10.1109/access.2021.3078553 · Cited by 59 · see citing works
“During this period, any attacks had not been detected for the first seven days, while certain cyber and physical attacks were launched for the remaining four days [44].”
BackgroundAn ensemble deep federated learning cyber-threat hunting model for Industrial Internet of Things
Jahromi, A. N., Karimipour, H., & Dehghantanha, A. (2022) · Computer Communications · doi:10.1016/j.comcom.2022.11.009 · Cited by 63 · see citing works
Huang, J., Zeng, G., Geng, G., Weng, J., Lu, K., & Zhang, Y. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103310 · Cited by 62 · see citing works
Learning-Guided Network Fuzzing for Testing Cyber-Physical System Defences
Chen, Y., POSKITT, C. M., Sun, J., Adepu, S., & Zhang, F. (2019) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase.2019.00093 · Cited by 62 · see citing works
“Furthermore, it covered six unsafe states beyond those in an established expert-crafted benchmark [29].”
BackgroundMethodResultInfluentialSelf-citationTushkanova, O. N., Levshun, D., Branitskiy, A. A., Владимировна, Ф. Е., Novikova, E. S., & Kotenko, I. V. (2023) · Algorithms · doi:10.3390/a16020085 · Cited by 61 · see citing works
“The analysis of the research papers showed that currently, the most commonly used CPS dataset is SWAT dataset [9].”
BackgroundMethodInfluentialMachine Learning Approaches for Anomaly Detection in IoT: An Overview and Future Research Directions
Alghanmi, N., Alotaibi, R., & Buhari, S. M. (2021) · Wireless Personal Communications · doi:10.1007/s11277-021-08994-z · Cited by 58 · see citing works
Fährmann, D., Damer, N., Kirchbuchner, F., & Kuijper, A. (2022) · Sensors · doi:10.3390/s22082886 · Cited by 59 · see citing works
“In the last four days of data collection, 36 attack scenarios were executed [48].”
InfluentialAlimi, O. A., Ouahada, K., Abu-Mahfouz, A. M. I., Rimer, S., & Alimi, K. O. A. (2021) · Sustainability · doi:10.3390/su13179597 · Cited by 58 · see citing works
“UNSW-NB15 dataset [39], iTrust SWAT dataset [40,41], etc.”
MethodLevshun, D., & Kotenko, I. V. (2023) · Artificial Intelligence Review · doi:10.1007/s10462-022-10381-4 · Cited by 62 · see citing works
Industrial cyber-physical systems protection: A methodological review
Canonico, R., & Sperlí, G. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103531 · Cited by 62 · see citing works
Lu, K., Huang, J., Zeng, G., Chen, M.-R., Geng, G., & Weng, J. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3545363 · Cited by 58 · see citing works
“To identify the anomaly activates on smart sensors, Priyanga et al. [26] proposed a hybrid deep learning framework that combines enhanced principal component analysis and hypergraph-based CNN (EPCA-HG-CNN) and showed promising results on the SWaT dataset [27].”
An explainable multi-modal model for advanced cyber-attack detection in industrial control systems
Bahadoripour, S., Karimipour, H., Jahromi, A. N., & Islam, A. (2024) · Internet of Things · doi:10.1016/j.iot.2024.101092 · Cited by 59 · see citing works
Makris, I., Karampasi, A. S., Grammatikis, P. I. R., Episkopos, N., Iturbe, E., Rios, E., Piperigkos, N., Lalos, A. S., Xenakis, C., Λάγκας, Θ., et al. (2024) · Computer Science Review · doi:10.1016/j.cosrev.2024.100717 · Cited by 61 · see citing works
Adversarial attacks and mitigation for anomaly detectors of cyber-physical systems
Jia, Y., Wang, J., POSKITT, C. M., Chattopadhyay, S., Sun, J., & Chen, Y. (2021) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2021.100452 · Cited by 52 · see citing works
“Furthermore, data sets [18] are available containing several days of physical data resulting from subjecting the testbeds to these at-”
InfluentialAbid, A., Jemili, F., & Korbaa, O. (2023) · Cluster Computing · doi:10.1007/s10586-023-04087-7 · Cited by 52 · see citing works
Evasion Attack and Defense on Machine Learning Models in Cyber-Physical Systems: A Survey
Wang, S., Ko, R. K. L., Bai, G., Dong, N., Choi, T., & Zhang, Y. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2023.3344808 · Cited by 55 · see citing works
Deep autoencoders as anomaly detectors: Method and case study in a distributed water treatment plant
Raman, M. R. G., Dong, W., & Mathur, A. P. (2020) · Computers & Security · doi:10.1016/j.cose.2020.102055 · Cited by 52 · see citing works
Self-citationAdversarial Attacks on Time-Series Intrusion Detection for Industrial Control Systems
Zizzo, G., Hankin, C., Maffeis, S., & Jones, K. (2020) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom50675.2020.00121 · Cited by 53 · see citing works
“Full details on the dataset can be found [31] and [32].”
BackgroundMethodDeep Learning-Based Anomaly Detection in Cyber-Physical Systems: Progress and OpportunitiesPreprint
Luo, Y., Xiao, Y., Cheng, L., Peng, G., & Yao, D. D. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2003.13213 · Cited by 52 · see citing works
“Testbeds are usually used to evaluate proposed methods and the SWaT testbed [35] is a popular platform to conduct the evaluation.”
MethodAn Unsupervised Framework for Anomaly Detection in a Water Treatment System
Macas, M., & Wu, C. (2019) · International Conference on Machine Learning and Applications · doi:10.1109/icmla.2019.00212 · Cited by 51 · see citing works
“[12] employed the deep LSTM-RNN method and Cumulative Sum (CUSUM) to detect anomalies on the first stage of the SWAT dataset.”
BackgroundMethodInfluentialA cyber-security methodology for a cyber-physical industrial control system testbed
Noorizadeh, M., Shakerpour, M., Meskin, N., Unal, D., & Khorasani, K. (2021) · IEEE Access · doi:10.1109/access.2021.3053135 · Cited by 48 · see citing works
A survey of methods supporting cyber situational awareness in the context of smart cities
Neshenko, N., Nader, C., Bou‐Harb, E., et al. (2020) · Journal Of Big Data · doi:10.1186/s40537-020-00363-0 · Cited by 48 · see citing works
“2016 SWaT dataset [98] supports research in the design of secure Cyber-Physical Systems (CPS).”
MethodA Threat Hunting Framework for Industrial Control Systems
Jadidi, Z., & Lu, Y. (2021) · IEEE Access · doi:10.1109/access.2021.3133260 · Cited by 48 · see citing works
“to the physical and control components of a water treatment facility [33].”
BackgroundTinyAD: Memory-Efficient Anomaly Detection for Time-Series Data in Industrial IoT
Sun, Y., Chen, T., Nguyen, Q. V. H., & Yin, H. (2023) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2023.3254668 · Cited by 46 · see citing works
“(cid:2) Secure Water Treatment testbed (SWaT) [16]: SWaT is a industrial water treatment plant, which records network data by second.”
BackgroundSTAGED: A Spatial-Temporal Aware Graph Encoder–Decoder for Fault Diagnosis in Industrial Processes
Li, S., Meng, W., He, S., Bi, J., & Liu, G. (2023) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2023.3281083 · Cited by 45 · see citing works
“SWaT processes overview [23]. devisedsubmodules.”
MethodLabel-Free Multivariate Time Series Anomaly Detection
Zhou, Q., He, S., Liu, H., Chen, J., & Meng, W. (2024) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2024.3349613 · Cited by 46 · see citing works
“The commonly used public datasets for MTS anomaly detection in OCC are as follows: (cid:2) SWaT [63] is a collection of 51 sensor data from a real-world industrial water treatment plant, at the frequency of one second.”
MethodVávra, J., Hromada, M., Lukáš, L., & Dworzecki, J. (2021) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2021.100446 · Cited by 50 · see citing works
Critical Information Infrastructures Security
Wolthusen, S. D. B., Nassopoulos, H., Setola, R., et al. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-71368-7 · Cited by 45 · see citing works
A data balancing approach based on generative adversarial network
Yuan, L., Yu, S., Yang, Z., et al. (2022) · Future Generation Computer Systems · doi:10.1016/j.future.2022.12.024 · Cited by 44 · see citing works
Landauer, M., Skopik, F., Stojanović, B., Flatscher, A., & Ullrich, T. (2024) · International Journal of Information Security · doi:10.1007/s10207-024-00921-0 · Cited by 61 · see citing works
“A common use case in ICS intrusion detection is that of Secure Water Treatment (SWaT) [43], which is a well-known data set collected in a simulation testbed.”
Clotet, X., Moyano, J. M. D., & León, G. (2018) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2018.08.002 · Cited by 44 · see citing works
- Authors
- Goh, J., Adepu, S., Junejo, K. N., & Mathur, A.
- Affiliations
- Singapore University of Technology and Design (SG)
- Corresponding author
- Goh, Jonathan
- Venue
- Lecture Notes in Computer Science
- Publisher
- Springer International Publishing
- Published
- 2017
- Pages
- 88-99
- ISSN
- 0302-9743 (ISSN-L)
- 1611-3349
- OpenAlex
- W2768947629
- Semantic Scholar
- 26f058a2aedf8bd24ad5cb97170173b5124dbbf8
- Cited by
- 729
- References
- 3
- Citations by year
- 2026: 109 · 2025: 122 · 2024: 122 · 2023: 115 · 2022: 72 · 2021: 76 · 2020: 54 · 2019: 33 · 2018: 20 · 2017: 6
- FWCI
- 47.22
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- Lecture notes in computer science (publishedVersion)
- Topics
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Engineering › Control and Systems Engineering › Fault Detection and Control Systems
- Keywords
- cyber-physical systems, water treatment plant, cyberattacks, physical assault, network traffic, ultrafiltration, reverse osmosis, industrial control security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
