The DOI matches its Crossref record; 3 of the 3 references it cites were found in a registry or an index.
A Dataset to Support Research in the Design of Secure Water Treatment Systems
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Citations
Cites
The 1999 DARPA off-line intrusion detection evaluation
Lippmann, R. P., Haines, J. W., Fried, D. J., Korba, J., & Das, K. (2000) · Computer Networks · doi:10.1016/s1389-1286(00)00139-0 · Cited by 877
The UCI KDD archive of large data sets for data mining research and experimentation
Bay, S. D., Kibler, D. F., Pazzani, M. J., & Smyth, P. (2000) · ACM SIGKDD Explorations Newsletter · doi:10.1145/380995.381030 · Cited by 234
An Investigation into the Response of a Water Treatment System to Cyber Attacks
Adepu, S., & Mathur, A. P. (2016) · Proceedings - IEEE International Symposium on High-Assurance Systems Engineering/Proceedings · doi:10.1109/hase.2016.14 · Cited by 88
Self-citation
Cited by
Sorted by citations
Graph Neural Network-Based Anomaly Detection in Multivariate Time Series
Deng, A., & Hooi, B. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i5.16523 · Cited by 1,413
“Since the systems took 5-6 hours to reach stabilization when first turned on (Goh et al. 2016), we eliminate the first 2160 samples for both datasets.”
BackgroundMAD-GAN: Multivariate Anomaly Detection for Time Series Data with Generative Adversarial Networks
Li, D., Chen, D., Jin, B., Shi, L., Goh, J., & Ng, S.-K. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-30490-4_56 · Cited by 1,323
“ys. For both of these datasets, we eliminated the rst 21;600 samples from the training data (normal data) since it took 5-6 hours to reach stabilization when the system was rst turned on according to [26]. In the anomaly detection process, we subdivide the original long multiple sequences into smaller time series by t…”
BackgroundMethodInfluentialSelf-citationUSAD: UnSupervised Anomaly Detection on Multivariate Time Series
Audibert, J., Michiardi, P., Guyard, F., Marti, S., & Zuluaga, M. A. (2020) · Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining · doi:10.1145/3394486.3403392 · Cited by 1,094
“The SWaT dataset 1 is a scaled down version of a real-world industrial water treatment plant producing filtered water [4].”
BackgroundDetecting Cyber Attacks in Industrial Control Systems Using Convolutional Neural Networks
Kravchik, M., & Shabtai, A. (2018) · Workshop on Cyber-Physical Systems Security and PrivaCy (CPS-SPC) · doi:10.1145/3264888.3264896 · Cited by 414
“Recently, unsupervised machine learning was shown to be effective [7] [19] for detecting cyber attacks using data obtained from a dedicated water plant testbed (SWaT) [6] which was built to support research related to the design of secure cyber physical systems (CPSs).”
BackgroundMethodInfluentialAnomaly Detection for a Water Treatment System Using Unsupervised Machine Learning
Inoue, J., Yamagata, Y., Chen, Y., POSKITT, C. M., & Sun, J. (2017) · IEEE ... International Conference on Data Mining workshops · doi:10.1109/icdmw.2017.149 · Cited by 372
“They use stacked LSTMs to detect anomalies, and the same SWaT dataset in their evaluation [12].”
MethodInfluentialCyber risk and cybersecurity: a systematic review of data availability
Cremer, F., Sheehan, B., Fortmann, M., Kia, A. N., Mullins, M., Murphy, F., & Materne, S. (2022) · The Geneva Papers on Risk and Insurance Issues and Practice · doi:10.1057/s41288-022-00266-6 · Cited by 497
MST-GAT: A multimodal spatial–temporal graph attention network for time series anomaly detection
Ding, C., Sun, S., & Zhao, J. (2022) · Information Fusion · doi:10.1016/j.inffus.2022.08.011 · Cited by 332
“Secure Water Treatment (SWaT) [50] dataset is collected from the scaleddown water treatment testbed with 51 sensors, consisting of seven days of normal operation and four days of simulated attack scenarios.”
MethodAn Evaluation of Anomaly Detection and Diagnosis in Multivariate Time Series
Garg, A., Zhang, W., Samaran, J., Ramasamy, S., & Foo, C.-S. (2021) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2021.3105827 · Cited by 318
“Based on author descriptions of anomalies for SWaT [37], WADI [38], DMDS [39], MSL [5] and SMAP [5] datasets, and our own visualizations (e.”
MethodThe rise of traffic classification in IoT networks: A survey
Tahaei, H., Afifi, F., Asemi, A., Zaki, F., & Anuar, N. B. (2020) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2020.102538 · Cited by 278
Self-Supervised Learning for Time Series Analysis: Taxonomy, Progress, and Prospects
Zhang, K., Wen, Q., Zhang, C., Cai, R., Jin, M., Liu, Y., Zhang, J. Y., Liang, Y., Pang, G., Song, D., et al. (2024) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2024.3387317 · Cited by 295
A Survey on Industrial Control System Testbeds and Datasets for Security Research
Conti, M., Donadel, D., & Turrin, F. (2021) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2021.3094360 · Cited by 284
Anomaly Detection with Generative Adversarial Networks for Multivariate Time SeriesPreprint
Li, D., Chen, D., Goh, J., & Ng, S.-K. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1809.04758 · Cited by 233
“5The raw data are not plotted in this paper due to page limit—please refer to [37] for more information.”
BackgroundMethodInfluentialSelf-citationTowards a Rigorous Evaluation of Time-Series Anomaly Detection
Kim, S., Choi, K., Choi, H.-S., Lee, B., & Yoon, S. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i7.20680 · Cited by 275
“In this section, we introduce a list of the five most widely used TAD benchmark datasets as follows: Secure water treatment (SWaT) (Goh et al. 2016): the SWaT dataset was collected over 11 days from a scaled-down water treatment testbed comprising 51 sensors (Mathur and Tippenhauer 2016).”
MethodA stacking ensemble of deep learning models for IoT intrusion detection
Lazzarini, R., Tianfield, H., & Charissis, V. (2023) · Knowledge-Based Systems · doi:10.1016/j.knosys.2023.110941 · Cited by 225
A survey on deep learning for cybersecurity: Progress, challenges, and opportunities
Macas, M., Wu, C., & Fuertes, W. (2022) · Computer Networks · doi:10.1016/j.comnet.2022.109032 · Cited by 202
Umer, M., Junejo, K. N., Jilani, M. T., & Mathur, A. P. (2022) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2022.100516 · Cited by 204
“Following the publication of the dataset in [61], iTrust has made public several other datasets collected from the SWaT testbed [77].”
MethodSelf-citationLin, Q., Adepu, S., Verwer, S., & Mathur, A. P. (2018) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3196494.3196546 · Cited by 157
“SWaT dataset [19] was collected over 11 days of continuous operation.”
BackgroundMethodInfluentialSelf-citationSánchez, P. M. S., Valero, J. M. J., Celdrán, A. H., Bovet, G., Pérez, M. G., & Pérez, G. M. (2021) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2021.3064259 · Cited by 156
“Similarly, the Water Distribution (WADI) dataset [170] contains 575 MB of labeled sensor and actuator logs collected in the same water treatment plant.”
BackgroundMethodMacas, M., Wu, C., & Fuertes, W. (2023) · Expert Systems with Applications · doi:10.1016/j.eswa.2023.122223 · Cited by 175
Intrusion Detection Systems: A Cross-Domain Overview
Tidjon, L. N., Frappier, M., & Mammar, A. (2019) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2019.2922584 · Cited by 141
“InIndustrial and Control Systems, Feng et al. [110] proposed a real-time GAN-based learning method to conduct stealthy attacks using a Secure Water Treatment (SWaT) testbed [208].”
MethodDAEMON: Unsupervised Anomaly Detection and Interpretation for Multivariate Time Series
Chen, X., Deng, L., Huang, F., Zhang, C., Zhang, Z., Zhao, Y. L., & Zheng, K. (2021) · IEEE International Conference on Data Engineering (ICDE) · doi:10.1109/icde51399.2021.00228 · Cited by 141
“…real applications, the devices being monitored generate large amount of multivariate time series, such as spacecraft-s [4], server machines [2], water treatment system [5], etc. Operators mainly care about entity-level anomalies, instead of metric-level anomalies based on univariate time series.”
BackgroundA Systematic Review of the State of Cyber-Security in Water Systems
Tuptuk, N., Hazell, P., Watson, J., & Hailes, S. (2021) · Water · doi:10.3390/w13010081 · Cited by 138
“One of the widely studied datasets in cyber-security research is the SWaT dataset [50] containing normal data streams collected from 51 sensors and actuators collected over 7 days, and attack data consisting of 41 attacks carried out over a period of 4 days.”
BackgroundMethodChen, Y., POSKITT, C. M., & Sun, J. (2018) · Singapore Management University Institutional Knowledge (InK) (Singapore Management University) · Cited by 129
Koay, A. M. Y., Ko, R. K. L., Hettema, H., & Radke, K. (2023) · Journal of Intelligent Information Systems · doi:10.1007/s10844-022-00753-1 · Cited by 131
“Newer datasets have been introduced for ICS research such as the Missis-sippi State University (MSU) Power, Gas, and Water datasets (Morris, 2018) and Singa-pore University of Technology and Design’s Secure Water Treatment (SWaT) dataset (Goh et al., 2016).”
BackgroundMethodA Systematic Framework to Generate Invariants for Anomaly Detection in Industrial Control Systems
Feng, C., Palleti, V. R., Mathur, A. P., & Chana, D. (2019) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23265 · Cited by 129
“The SWaT data log is collected by running SWaT nonstop from its empty state to a fully operational state for a total of 11-days, and is originally reported in [41].”
MethodInfluentialSelf-citationToward Detection and Attribution of Cyber-Attacks in IoT-Enabled Cyber–Physical Systems
Jahromi, A. N., Karimipour, H., Dehghantanha, A., & Choo, K. R. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3067667 · Cited by 125
Kheddar, H., Himeur, Y., & Awad, A. I. (2023) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2023.103760 · Cited by 138
“SWaT includes both normal and attack scenarios, making it suitable for use in research on intrusion detection and cybersecurity for ICSs [65].”
BackgroundAnomaly detection in Industrial Control Systems using Logical Analysis of Data
Das, T. K., Adepu, S., & Zhou, J. (2020) · Computers & Security · doi:10.1016/j.cose.2020.101935 · Cited by 124
Self-citationBelay, M. A., Blakseth, S. S., Rasheed, A., & Rossi, P. S. (2023) · Sensors · doi:10.3390/s23052844 · Cited by 153
“A min-max scaling was considered for feature normalization and stable training of the models, i.e., where x is the actual measurement and x (cid:48) is the value after scaling.”
MethodFederated Learning-Based Explainable Anomaly Detection for Industrial Control Systems
Hương, T. T., Bac, T. P., Ha, K. N., Việt, N. H., Hoang, N. X., Hung, N. T., & Tran, K. P. (2022) · IEEE Access · doi:10.1109/access.2022.3173288 · Cited by 126
“Recently, in [15], the author proposed a Logical Analysis of Data (LAD-ADS) solution using a rule-based method to detect anomalous behaviours in ICS systems over the Secure Water Treatment (SWaT) dataset [23], which is, in our opinion, not a purely time-series data scenario.”
MethodChen, Y., POSKITT, C. M., & Sun, J. (2018) · Proceedings - IEEE Symposium on Security and Privacy/Proceedings of the ... IEEE Symposium on Security and Privacy · doi:10.1109/sp.2018.00016 · Cited by 118
“Our attacks are from a benchmark of attacks that were performed on the SWaT testbed for the purpose of data collection [12].”
BackgroundMethodInfluentialA Dual-Isolation-Forests-Based Attack Detection Framework for Industrial Control Systems
Elnour, M., Meskin, N., Khan, K. M., & Jain, R. K. (2020) · IEEE Access · doi:10.1109/access.2020.2975066 · Cited by 117
“The network packets were altered to reflect the spoofed values from the sensors [29].”
MethodNedeljkovic, D. M., & Jakovljević, Ž. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102585 · Cited by 113
Feng, C., & Tian, P. (2021) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3447548.3467137 · Cited by 119
“scaled down water treatment plant producing filtered water [20].”
BackgroundWang, F., Jiang, Y., Zhang, R., Wei, A., Xie, J., & Pang, X. (2025) · Sensors · doi:10.3390/s25010190 · Cited by 119
Aoudi, W., Iturbe, M., & Almgren, M. (2018) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3243734.3243781 · Cited by 110
“The SWaT dataset [16] is a collection of process readings and network traces from the Secure Water Treatment (SWaT) testbed.”
BackgroundMethodAhmed, C. M., Zhou, J., & Mathur, A. P. (2018) · Annual Computer Security Applications Conference · doi:10.1145/3274694.3274748 · Cited by 104
Self-citationA Hardware-in-the-Loop Water Distribution Testbed Dataset for Cyber-Physical Security Testing
Faramondi, L., Flammini, F., Guarino, S., & Setola, R. (2021) · IEEE Access · doi:10.1109/access.2021.3109465 · Cited by 104
“Table 1 summarizes the key features of our dataset in relation to those described in [11] and [12].”
BackgroundGenerative Adversarial Networks for Spatio-temporal Data: A Survey
Gao, N., Xue, H., Shao, W., Zhao, S., Qin, K. K., Prabowo, A., Rahaman, M. S., & Salim, F. D. (2022) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3474838 · Cited by 127
“social networks [40, 97] Yelp [1] Location-based social networks [81, 97, 166] ST events Yellow taxi dataset [2] Taxi demand data [120] CitiBike trip dataset [104] Bike demand data [120] SWaT dataset [43] Attacked data in water system [80] Graphs ArXiv-AstroPh [79] Scientific collaborations data [143] Wikipedia [49] N…”
BackgroundAnomaly Detection for Industrial Control System Based on Autoencoder Neural Network
Wang, C., Wang, B., Liu, H., & Qu, H. (2020) · Wireless Communications and Mobile Computing · doi:10.1155/2020/8897926 · Cited by 99
Local Evaluation of Time Series Anomaly Detection Algorithms
Huet, A., Navarro, J. M., & Rossi, D. (2022) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3534678.3539339 · Cited by 103
“This also holds for the SWaT dataset, for which we give a detailed event level interpretation in Sec.”
BackgroundMethodInfluentialMiao, J., Tao, H., Xie, H., Sun, J., & Cao, J. (2023) · Information Processing & Management · doi:10.1016/j.ipm.2023.103569 · Cited by 99
Robust anomaly detection for multivariate time series through temporal GCNs and attention-based VAE
Shi, Y., Wang, B., Yu, Y., Tang, X., Huang, C., & Dong, J. (2023) · Knowledge-Based Systems · doi:10.1016/j.knosys.2023.110725 · Cited by 102
High-Performance Unsupervised Anomaly Detection for Cyber-Physical System Networks
Schneider, P., & Böttinger, K. (2018) · doi:10.1145/3264888.3264890 · Cited by 95
“The SWaT environment consists of several machines, programmable logic controllers (PLC) and computers, as well as 51 sensors and actuators which mainly use the Common Industrial Protocol (CIP) over EtherNet/IP (EN/IP) [15].”
BackgroundMethodGAN-Based Anomaly Detection for Multivariate Time Series Using Polluted Training Set
Du, B., Sun, X., Ye, J., Cheng, K., Wang, J., & Sun, L. (2021) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2021.3128667 · Cited by 95
“The data was collected from an operational test-bed for water treatment [31].”
MethodAnomaly Detection Dataset for Industrial Control Systems
Dehlaghi-Ghadim, A., Moghadam, M. H., Balador, A., & Hansson, H. (2023) · IEEE Access · doi:10.1109/access.2023.3320928 · Cited by 101
“As pointed out in [28], a combination of unlabeled network traces and the attack log file forms an unsupervised or semi-supervised dataset for attack detection.”
APAD: Autoencoder-based Payload Anomaly Detection for industrial IoE
Kim, S.-J., Jo, W., & Shon, T. (2019) · Applied Soft Computing · doi:10.1016/j.asoc.2019.106017 · Cited by 91
Multivariate Abnormal Detection for Industrial Control Systems Using 1D CNN and GRU
Xie, X., Wang, B., Wan, T., & Tang, W. (2020) · IEEE Access · doi:10.1109/access.2020.2993335 · Cited by 91
“, P1 through P6 [31].”
Catillo, M., Pecchia, A., & Villano, U. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103210 · Cited by 96
Saheed, Y. K., Omole, A. I., & Sabit, M. O. (2025) · Sensors International · doi:10.1016/j.sintl.2024.100297 · Cited by 88
S., P., Krithivasan, K., S., P., & Sriram V.S., S. (2020) · IEEE Transactions on Industry Applications · doi:10.1109/tia.2020.2977872 · Cited by 88
“SWaT is a completely downsized water treatment plant built by the Singapore University of Technology and Design [38].”
BackgroundGRELEN: Multivariate Time Series Anomaly Detection from the Perspective of Graph Relational Learning
Zhang, W., Zhang, C., & Tsung, F. (2022) · Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2022/332 · Cited by 99
Advanced Intrusion Detection Combining Signature-Based and Behavior-Based Detection Methods
Kwon, H.-Y., Kim, T., & Lee, M.-K. (2022) · Electronics · doi:10.3390/electronics11060867 · Cited by 85
“In this study, we validated the performance of the proposed method using the secure water treatment (SWaT) dataset [25], which comprises data that are representative of those collected by a water treatment ICS.”
InfluentialA feature selection based on genetic algorithm for intrusion detection of industrial control systems
Fang, Y., Yao, Y. K., Lin, X., Wang, J., & Zhai, H. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103675 · Cited by 86
Network Traffic Fingerprinting for IIoT Device Identification: A Survey
Sheng, C., Zhou, W., Han, Q., et al. (2025) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2025.3534441 · Cited by 82
“TheSWaTdataset[99]isgeneratedfromase-curewatertreatmenttestbedconsistingofRemoteInput/Output units,PLCs,HMIs,asupervisorycontrolanddataacquisition (SCADA)workstation,andahistorian.”
MADICS: A Methodology for Anomaly Detection in Industrial Control Systems
Gómez, Á. L. P., Maimó, L. F., Celdrán, A. H., & Clemente, F. J. G. (2020) · Symmetry · doi:10.3390/sym12101583 · Cited by 76
Anomaly Detection in Smart Environments: A Comprehensive Survey
Fährmann, D., Martín, L., Sánchez, L., & Damer, N. (2024) · IEEE Access · doi:10.1109/access.2024.3395051 · Cited by 89
“These anomalies could lead to potential safety issues if not detected at an early stage [201].”
BackgroundDeep Learning Advancements in Anomaly Detection: A Comprehensive Survey
Huang, H., Wang, P., Pei, J., Wang, J., Alexanian, S., & Niyato, D. T. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3585884 · Cited by 116
Unsupervised Anomaly Detection in IoT Systems for Smart Cities
Guo, Y., Ji, T., Wang, Q., Yu, L., Min, G., & Li, P. (2020) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2020.3027543 · Cited by 80
Unsupervised Deep Learning for IoT Time Series
Liu, Y., Zhou, Y., Yang, K., & Wang, X. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3243391 · Cited by 81
“Secure water treatment (SWaT) data set [173] and water distribution (WADI) data set [174] are two commonly used IoT time-series data sets for anomaly detection.”
MethodIndustrial Anomaly Detection: A Comparison of Unsupervised Neural Network Architectures
Siegel, B. (2020) · IEEE Sensors Letters · doi:10.1109/lsens.2020.3007880 · Cited by 72
“The SWAT dataset [16] appears in a few anomaly detection studies including Inoue et al.”
MethodAnomaly Detection for Industrial Control Systems Using Sequence-to-Sequence Neural Networks
Kim, J., Yun, J.-H., & Kim, H. C. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-42048-2_1 · Cited by 78
ConAML: Constrained Adversarial Machine Learning for Cyber-Physical Systems
Li, J., Yang, Y., Sun, J., Tomsovic, K. L., & Qi, H. (2021) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3433210.3437513 · Cited by 67
“ced. 5.2 Case Study: Water Treatment System 5.2.1 Background: SWaT Dataset. In this section, we study the linear inequality physical constraints based on the Secure Water Treatment (SWaT) proposed in [15]. SWaT is a scaled-down system but with fully operational water treatment functions. The testbed has six main proce…”
BackgroundInfluentialDetecting Multivariate Time Series Anomalies with Zero Known Label
Zhou, Q., Chen, J., Liu, H., He, S., & Meng, W. (2023) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v37i4.25623 · Cited by 74
“2019), PSM (Pooled Server Metrics) (Abdulaal, Liu, and Lancewicki 2021), SWaT (Secure Water Treatment) (Goh et al. 2016) and WADI (Water Distribution) (Ahmed, Palleti, and Mathur 2017).”
MethodAhmed, C. M., Raman, M. R. G., & Mathur, A. P. (2020) · doi:10.1145/3384941.3409588 · Cited by 68
“The dataset available in [22], represents only one of the SWaT’s operational modes.”
MethodSelf-citationNetwork Anomaly Detection With Temporal Convolutional Network and U-Net Model
Mezina, A., Bürget, R., & Travieso, C. M. (2021) · IEEE Access · doi:10.1109/access.2021.3121998 · Cited by 67
“…datasets, which are used for evaluation of anomaly detection: Aegean WiFi Intrusion Dataset (AWID), which contains real flows of normal and intrusive 802.11 traffic [34], Secure Water Treatment (SWaT) dataset [35], Water Distribution (WADI) [36], which are testbeds for security research and training.”
MethodInfluentialShalyga, D., Filonov, P., & Lavrentyev, A. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1807.07282 · Cited by 103
“Results for SVM and DNNmodels were taken from [13].”
MethodIntrusion and anomaly detection for the next-generation of industrial automation and control systems
Rosa, L., Cruz, T., de Freitas, M. B., Quitério, P., Henriques, J., Caldeira, F., Monteiro, E., & Simões, P. (2021) · Future Generation Computer Systems · doi:10.1016/j.future.2021.01.033 · Cited by 63
“It successfully detected 32 out of 36 attacks in a public industrial water treatment dataset [41], processing physical process parameters in time windows of 200 seconds.”
BackgroundSurvey of federated learning in intrusion detection
Zhang, H., Ye, J., Huang, W. X., Liu, X., & Gu, J. J. (2024) · Journal of Parallel and Distributed Computing · doi:10.1016/j.jpdc.2024.104976 · Cited by 74
Studies on the GAN-Based Anomaly Detection Methods for the Time Series Data
Lee, C., Cheon, Y.-J., & Hwang, W. (2021) · IEEE Access · doi:10.1109/access.2021.3078553 · Cited by 62
“During this period, any attacks had not been detected for the first seven days, while certain cyber and physical attacks were launched for the remaining four days [44].”
BackgroundAn ensemble deep federated learning cyber-threat hunting model for Industrial Internet of Things
Jahromi, A. N., Karimipour, H., & Dehghantanha, A. (2022) · Computer Communications · doi:10.1016/j.comcom.2022.11.009 · Cited by 63
Huang, J., Zeng, G., Geng, G., Weng, J., Lu, K., & Zhang, Y. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103310 · Cited by 65
Learning-Guided Network Fuzzing for Testing Cyber-Physical System Defences
Chen, Y., POSKITT, C. M., Sun, J., Adepu, S., & Zhang, F. (2019) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase.2019.00093 · Cited by 62
“Furthermore, it covered six unsafe states beyond those in an established expert-crafted benchmark [29].”
BackgroundMethodResultInfluentialSelf-citationTushkanova, O. N., Levshun, D., Branitskiy, A. A., Владимировна, Ф. Е., Novikova, E. S., & Kotenko, I. V. (2023) · Algorithms · doi:10.3390/a16020085 · Cited by 61
“The analysis of the research papers showed that currently, the most commonly used CPS dataset is SWAT dataset [9].”
BackgroundMethodInfluentialMachine Learning Approaches for Anomaly Detection in IoT: An Overview and Future Research Directions
Alghanmi, N., Alotaibi, R., & Buhari, S. M. (2021) · Wireless Personal Communications · doi:10.1007/s11277-021-08994-z · Cited by 64
Fährmann, D., Damer, N., Kirchbuchner, F., & Kuijper, A. (2022) · Sensors · doi:10.3390/s22082886 · Cited by 74
“In the last four days of data collection, 36 attack scenarios were executed [48].”
InfluentialAlimi, O. A., Ouahada, K., Abu-Mahfouz, A. M. I., Rimer, S., & Alimi, K. O. A. (2021) · Sustainability · doi:10.3390/su13179597 · Cited by 72
“UNSW-NB15 dataset [39], iTrust SWAT dataset [40,41], etc.”
MethodLevshun, D., & Kotenko, I. V. (2023) · Artificial Intelligence Review · doi:10.1007/s10462-022-10381-4 · Cited by 67
Industrial cyber-physical systems protection: A methodological review
Canonico, R., & Sperlí, G. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103531 · Cited by 62
Lu, K., Huang, J., Zeng, G., Chen, M.-R., Geng, G., & Weng, J. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3545363 · Cited by 60
“To identify the anomaly activates on smart sensors, Priyanga et al. [26] proposed a hybrid deep learning framework that combines enhanced principal component analysis and hypergraph-based CNN (EPCA-HG-CNN) and showed promising results on the SWaT dataset [27].”
An explainable multi-modal model for advanced cyber-attack detection in industrial control systems
Bahadoripour, S., Karimipour, H., Jahromi, A. N., & Islam, A. (2024) · Internet of Things · doi:10.1016/j.iot.2024.101092 · Cited by 62
Makris, I., Karampasi, A. S., Grammatikis, P. I. R., Episkopos, N., Iturbe, E., Rios, E., Piperigkos, N., Lalos, A. S., Xenakis, C., Λάγκας, Θ., et al. (2024) · Computer Science Review · doi:10.1016/j.cosrev.2024.100717 · Cited by 67
Adversarial attacks and mitigation for anomaly detectors of cyber-physical systems
Jia, Y., Wang, J., POSKITT, C. M., Chattopadhyay, S., Sun, J., & Chen, Y. (2021) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2021.100452 · Cited by 54
“Furthermore, data sets [18] are available containing several days of physical data resulting from subjecting the testbeds to these at-”
InfluentialAbid, A., Jemili, F., & Korbaa, O. (2023) · Cluster Computing · doi:10.1007/s10586-023-04087-7 · Cited by 52
Evasion Attack and Defense on Machine Learning Models in Cyber-Physical Systems: A Survey
Wang, S., Ko, R. K. L., Bai, G., Dong, N., Choi, T., & Zhang, Y. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2023.3344808 · Cited by 63
Deep autoencoders as anomaly detectors: Method and case study in a distributed water treatment plant
Raman, M. R. G., Dong, W., & Mathur, A. P. (2020) · Computers & Security · doi:10.1016/j.cose.2020.102055 · Cited by 52
Self-citationAdversarial Attacks on Time-Series Intrusion Detection for Industrial Control Systems
Zizzo, G., Hankin, C., Maffeis, S., & Jones, K. (2020) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom50675.2020.00121 · Cited by 53
“Full details on the dataset can be found [31] and [32].”
BackgroundMethodDeep Learning-Based Anomaly Detection in Cyber-Physical Systems: Progress and OpportunitiesPreprint
Luo, Y., Xiao, Y., Cheng, L., Peng, G., & Yao, D. D. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2003.13213 · Cited by 52
“Testbeds are usually used to evaluate proposed methods and the SWaT testbed [35] is a popular platform to conduct the evaluation.”
MethodAn Unsupervised Framework for Anomaly Detection in a Water Treatment System
Macas, M., & Wu, C. (2019) · International Conference on Machine Learning and Applications · doi:10.1109/icmla.2019.00212 · Cited by 51
“[12] employed the deep LSTM-RNN method and Cumulative Sum (CUSUM) to detect anomalies on the first stage of the SWAT dataset.”
BackgroundMethodInfluentialA cyber-security methodology for a cyber-physical industrial control system testbed
Noorizadeh, M., Shakerpour, M., Meskin, N., Unal, D., & Khorasani, K. (2021) · IEEE Access · doi:10.1109/access.2021.3053135 · Cited by 48
A survey of methods supporting cyber situational awareness in the context of smart cities
Neshenko, N., Nader, C., Bou‐Harb, E., et al. (2020) · Journal Of Big Data · doi:10.1186/s40537-020-00363-0 · Cited by 48
“2016 SWaT dataset [98] supports research in the design of secure Cyber-Physical Systems (CPS).”
MethodA Threat Hunting Framework for Industrial Control Systems
Jadidi, Z., & Lu, Y. (2021) · IEEE Access · doi:10.1109/access.2021.3133260 · Cited by 48
“to the physical and control components of a water treatment facility [33].”
BackgroundTinyAD: Memory-Efficient Anomaly Detection for Time-Series Data in Industrial IoT
Sun, Y., Chen, T., Nguyen, Q. V. H., & Yin, H. (2023) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2023.3254668 · Cited by 46
“(cid:2) Secure Water Treatment testbed (SWaT) [16]: SWaT is a industrial water treatment plant, which records network data by second.”
BackgroundSTAGED: A Spatial-Temporal Aware Graph Encoder–Decoder for Fault Diagnosis in Industrial Processes
Li, S., Meng, W., He, S., Bi, J., & Liu, G. (2023) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2023.3281083 · Cited by 45
“SWaT processes overview [23]. devisedsubmodules.”
MethodLabel-Free Multivariate Time Series Anomaly Detection
Zhou, Q., He, S., Liu, H., Chen, J., & Meng, W. (2024) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2024.3349613 · Cited by 50
“The commonly used public datasets for MTS anomaly detection in OCC are as follows: (cid:2) SWaT [63] is a collection of 51 sensor data from a real-world industrial water treatment plant, at the frequency of one second.”
MethodVávra, J., Hromada, M., Lukáš, L., & Dworzecki, J. (2021) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2021.100446 · Cited by 54
Critical Information Infrastructures Security
Wolthusen, S. D. B., Nassopoulos, H., Setola, R., et al. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-71368-7 · Cited by 45
A data balancing approach based on generative adversarial network
Yuan, L., Yu, S., Yang, Z., et al. (2022) · Future Generation Computer Systems · doi:10.1016/j.future.2022.12.024 · Cited by 44
Landauer, M., Skopik, F., Stojanović, B., Flatscher, A., & Ullrich, T. (2024) · International Journal of Information Security · doi:10.1007/s10207-024-00921-0 · Cited by 71
“A common use case in ICS intrusion detection is that of Secure Water Treatment (SWaT) [43], which is a well-known data set collected in a simulation testbed.”
Clotet, X., Moyano, J. M. D., & León, G. (2018) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2018.08.002 · Cited by 44
Metadata
- Authors
- Goh, J., Adepu, S., Junejo, K. N., & Mathur, A.
- Affiliations
- Singapore University of Technology and Design (SG)
- Corresponding author
- Goh, Jonathan
- Venue
- Lecture Notes in Computer Science
- Publisher
- Springer International Publishing
- Published
- 2017
- Pages
- 88-99
- ISSN
- 0302-9743 (ISSN-L)
- 1611-3349
- OpenAlex
- W2768947629
- Semantic Scholar
- 26f058a2aedf8bd24ad5cb97170173b5124dbbf8
- Cited by
- 729
- References
- 3
- Citations by year
- 2026: 109 · 2025: 122 · 2024: 122 · 2023: 115 · 2022: 72 · 2021: 76 · 2020: 54 · 2019: 33 · 2018: 20 · 2017: 6
- FWCI
- 47.22
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- Lecture notes in computer science (publishedVersion)
- Topics
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Engineering › Control and Systems Engineering › Fault Detection and Control Systems
- Keywords
- cyber-physical systems, water treatment plant, cyberattacks, physical assault, network traffic, ultrafiltration, reverse osmosis, industrial control security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
