CoChat
Sign Up
Cited by 279Smart Grid Security and ResilienceWater Systems and OptimizationNetwork Security and Intrusion Detection

Battle of the Attack Detection Algorithms: Disclosing Cyber Attacks on Water Distribution Networks

Open access
Taormina, Riccardo, Galelli, Stefano, Tippenhauer, Nils Ole, Salomons, Elad, Ostfeld, Avi, Eliades, Demetrios G., Aghashahi, Mohsen, Sundararajan, Raanju +28 more·2018·Journal of Water Resources Planning and Management
DOI 10.1061/(asce)wr.1943-5452.0000969
Open this paper in CoChat — free accountOpen PDF

Abstract

The BATtle of the Attack Detection ALgorithms (BATADAL) is the most recent competition on planning and management of water networks undertaken within the Water Distribution Systems Analysis Symposium. The goal of the battle was to compare the performance of algorithms for the detection of cyber-physical attacks, whose frequency has increased in the last few years along with the adoption of smart water technologies. The design challenge was set for the C-Town network, a real-world, medium-sized water distribution system operated through programmable logic controllers and a supervisory control and data acquisition (SCADA) system. Participants were provided with data sets containing (simulated) SCADA observations, and challenged to design an attack detection algorithm. The effectiveness of all submitted algorithms was evaluated in terms of time-to-detection and classification accuracy. Seven teams participated in the battle and proposed a variety of successful approaches leveraging data analysis, model-based detection mechanisms, and rule checking. Results were presented at the Water Distribution Systems Analysis Symposium (World Environmental and Water Resources Congress) in Sacramento, California on May 21–25, 2017. This paper summarizes the BATADAL problem, proposed algorithms, results, and future research directions.

AI snapshot

Written from the paper’s full text.

TL;DR

BATADAL was a competition comparing seven attack-detection algorithms on simulated SCADA data from the C-Town water distribution network under cyber-physical attacks. The winning model-based approach by Housh and Ohar achieved the best overall ranking score (S = 0.970), while most algorithms outperformed naïve detection baselines.

Key findings

  • Seven teams participated; all but one achieved a ranking score S > 0.75, better than naïve detection mechanisms.
  • Housh and Ohar ranked first with S = 0.970, S_TTD = 0.965, S_CLF = 0.975, detecting all 7 test attacks; Abokifa et al. ranked second with S = 0.949.
  • The only model-based approach won: estimating water demands, simulating system dynamics with EPANET, and measuring errors against SCADA readings proved successful.
  • Aghashahi et al. ranked last with S = 0.534 and detected only 3 attacks; Chandy et al. was over-sensitive with many false alarms, while Pasha et al. lacked sensitivity.

Methods

  • Design challenge used the C-Town network: 429 pipes, 388 junctions, 7 storage tanks, 11 pumps, 5 valves, 1 reservoir, and 9 PLCs coordinated by SCADA.
  • Participants received three simulated SCADA datasets: Training dataset 1 with no attacks over 365 days at hourly time steps; Training dataset 2 with seven attacks over 492 hourly time steps; and a Test dataset with seven attacks over 407 hourly time steps.
  • Algorithms were evaluated by time-to-detection (S_TTD), classification performance (S_CLF = mean of TPR and TNR), and overall ranking score S = 0.5·S_TTD + 0.5·S_CLF.

Limitations

  • The paper states the evaluation was deterministic on three specific datasets representing only a small portion of possible cyber-attacks; robustness would require stochastic scenarios with varying hydraulic conditions and multiple attack sequences.
  • The paper states a major limitation is the absence of detailed real SCADA data on cyber attacks to water utilities, and that BATADAL relied on data generated with a demand-driven engine.
  • Evident from the text: participants were given the same computational model of C-Town used to generate the SCADA data, and demand patterns were fairly regular and consistent across datasets, which may limit real-world applicability.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1061/(asce)wr.1943-5452.0000969

Cites

36 of 36 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 34 cited sources checked · 0 supported · 0 flagged

  • Findingreasoning

    The BATADAL was won by the only model-based approach.

    “Interestingly, the BATADAL was won by the only model-based approach.”
    Quote in the paperNot a substantial claim
  • Findingown data

    The algorithm proposed by Brentan et al. (2017) achieved a score S equal to 0.896.

    “With a value of S equal to 0.896, the algorithm proposed by Brentan et al. (2017) can also be regarded as a strong performer.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Brentan et al. (2017) source
  • Findingnone given

    BATADAL demand patterns were fairly regular and consistent across the three datasets.

    “In this regard, it is important to note that BATADAL demand patterns were fairly regular and consistent across the three datasets.”
    Quote in the paperNot a substantial claim
  • Findingreasoning

    A naïve detection mechanism that predicts the system to be always in safe conditions gets a score S equal to 0.25.

    “Note that a naïve detection mechanism that predicts the system to be always in safe conditions gets a score S equal to 0.25 (S T T D = 0, S CLF = 0.5).”
    Quote in the paperNot a substantial claim
  • Findingown data

    The algorithm of Abokifa et al. (2017) comes a close second, with S equal to 0.949.

    “The algorithm ofAbokifa et al. (2017) comes a close second, with S equal to 0.949.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Abokifa et al. (2017) source
  • May combine two claims. 20
  • Classified as probably not a substantial claim. 20

  • May combine two claims.

    Findingown data

    Brentan et al. (2017) algorithm consistently and accurately detected most of the attacks, but failed to identify the last one.

    “As shown in Figure 4(d), this algorithm was able to consistently and accurately detect most of the attacks, but it failed to identify the last one.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Brentan et al. (2017) source

  • May combine two claims.

    Findingown data

    Giacomoni et al. (2017) algorithm is less sensitive, resulting in a higher number of false negatives and minor timing errors, leading to a score S equal to 0.927.

    “However, Giacomoni et al. (2017) algorithm is less sensitive, resulting in a higher number of false negatives and minor timing errors (see Figure 4(c)) that lead to a score S equal to 0.927.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites Giacomoni et al. (2017) source

  • May combine two claims.

    Findingown data

    The score S for Chandy et al. (2017) is 0.802 and for Pasha et al. (2017) is 0.773.

    “Their score S is equal to 0.802 and 0.773, respectively.”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites Chandy et al. (2017) source
    • cites Pasha et al. (2017) source

  • May combine two claims.

    Findingcitation

    The algorithm of Pasha et al. (2017) issued just a few false alarms but lacked sensitivity, failing to flag the system as under attack for the entire duration of the events.

    “On the other hand, the algorithm of Pasha et al. (2017) issued just a few false alarms, but it lacked sensitivity, thus failing to flag the system as under attack for the entire duration of the events.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites Pasha et al. (2017) source

  • May combine two claims.

    Findingcitation

    The detection trajectory of the Housh and Ohar (2017b) algorithm shows that all attacks were immediately detected, with the exception of the last one, which was disclosed a few hours after its starting time.

    “Indeed, the detection trajectory depicted in Figure4(a) shows that all attacks were immediately detected, with the exception of the last one, which was disclosed a few hours after its starting time.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Housh and Ohar (2017b)

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Findingown data

    The algorithm proposed by Giacomoni et al. (2017) has the same number of false positives and true negatives as that of Housh and Ohar (2017b), meaning that both algorithms were the most successful in avoiding false alarms.

    “The algorithm proposed by Giacomoni et al. (2017) has the same number of false positives and true negatives as that of Housh and Ohar (2017b)-meaning that both algorithms were the most successful in avoiding false alarms.”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites Giacomoni et al. (2017) source
    • cites Housh and Ohar (2017b)

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Findingown data

    The algorithm proposed by Housh and Ohar (2017b) is the top scorer in terms of both time-to-detection S_TTD and classification score S_CLF.

    “Note that this algorithm is the top scorer in terms of both time-to-detection S T T D and classification score S CLF .”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites Housh and Ohar (2017b)

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S4 (based).

    Findingnone given

    The number of attacks in the available data is generally limited.

    “since the number of attacks in the available data is generally limited.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    The algorithm of Chandy et al. (2017) was over-sensitive, identifying most attack instances but issuing numerous false alarms.

    “The algorithm of Chandy et al. (2017) turned out to be over-sensitive-meaning that it was able to identify most of the attack instances, but at the cost of issuing numerous false alarms.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Chandy et al. (2017) source

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingown data

    Seven teams participated in BATADAL.

    “Seven teams participated in the battle and proposed a variety of successful approaches leveraging data analysis, model-based detection mechanisms, and rule checking.”
    • Also stated in: § ATTACK DETECTION ALGORITHMS · plain
      “Seven teams participated in BATADAL.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    All algorithms but one achieved a ranking score S larger than 0.75, meaning that they performed better than naïve detection mechanisms.

    “All algorithms but one achieved a ranking score S larger than 0.75, meaning that they performed better than naïve detection mechanisms.”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim.

    Findingreasoning

    Flagging the system as always under attack yields a value of S equal to 0.75.

    “On the other hand, flagging the system as always under attack yields a value of S equal to 0.75 (S T T D = 1, S CLF = 0.5).”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim.

    Findingcitation

    The definition of the cut-off criteria defining outliers regulates the trade-off between True Positive and True Negative Rate for most of the algorithms.

    “The definition of the cut-off criteria defining outliers regulates the trade-off between True Positive and True Negative Rate for most of the algorithms”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingcitation

    The contribution of Aghashahi et al. (2017) detected only three attacks, leading to a score S equal to 0.534.

    “Finally, the contribution of Aghashahi et al. (2017) detected only three attacks, leading to a score S equal to 0.534.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Aghashahi et al. (2017) source

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given

    Most teams presented multi-stage detection methods.

    “Most teams presented multi-stage detection methods.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Protecting water distribution systems from cyber attacks requires a combination of proactive and reactive mechanisms.

    “Protecting water distribution systems from cyber attacks requires (as with other cyberphysical systems) a combination of proactive and reactive mechanisms (Cardenas et al. 2008).”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Cardenas et al. 2008 source

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    The number of reported attacks on water infrastructures has been growing steadily, making them the third highest targeted sector after critical manufacturing and energy.

    “according to which the number of reported attacks on water infrastructures has been growing steadily (ICS-CERT 2014; ICS-CERT 2015; ICS-CERT 2016)-making them the third highest targeted sector after critical manufacturing and energy (ICS-CERT 2016).”
    Quote in the paperNot a substantial claim0 of 3 sources checked
    • cites ICS-CERT 2014

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites ICS-CERT 2015

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites ICS-CERT 2016

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    The adoption of smart water technologies enhances the reliability and autonomy of water distribution systems.

    “The adoption of such smart water technologies plays a pivotal role in enhancing the reliability and autonomy of water distribution systems, but simultaneously exposes them to cyber-physical attacks (Rasekh et al. 2016)”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Rasekh et al. 2016 source

  • Classified as probably not a substantial claim.

    Interpretationreasoning

    The information provided by SCADA systems may not be fully reliable.

    “This means that the information provided by SCADA systems may not be fully reliable.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: All networked devices, including SCADA systems, represent potential targets.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationreasoning

    Comparing and confirming the detection issued by different modules can help decrease classification errors.

    “Comparing and confirming the detection issued by different modules can help decrease classification errors.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning

    Both model-based and data-driven approaches are suitable for attack detection problems, although their performance would probably vary with the modelling context at hand.

    “We can probably conclude that both model-based and data-driven approaches are suitable for attack detection problems, although their performance would probably vary with the modelling context at hand.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing). May combine two claims.

    Study design and conductnone given

    The data and algorithms presented here provide a first step towards an objective comparison of attack detection algorithms for water distribution systems, but they do not represent the entire spectrum of modelling contexts that practitioners and researchers would encounter.

    “While the data and algorithms presented here provide a first step towards an objective comparison of attack detection algorithms for water distribution systems, they do not represent the entire spectrum of modelling contexts that practitioners and researchers would encounter.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning

    Attack detection mechanisms may accidentally disclose anomalous behaviors that are not necessarily caused by cyber attacks.

    “Since attack detection mechanisms aim to disclose outliers and contextual anomalies in the system behavior, they may accidentally disclose anomalous behaviors that are not necessarily caused by cyber attacks.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Deception attacks were aimed at manipulating the information sent or received by sensors and PLCs, with the ultimate goal of affecting the operations of an actuator.

    “The latter were aimed at manipulating the information sent or received by sensors and PLCs, with the ultimate goal of affecting the operations of an actuator (Urbina et al. 2016).”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Urbina et al. 2016 source

  • Classified as probably not a substantial claim. May combine two claims.

    Study design and conductnone given

    The evaluation of BATADAL algorithms can be seen as a deterministic analysis carried out on three specific datasets, which represent only a small portion of the entire set of cyber-attacks that could threaten a water distribution system.

    “The evaluation of BATADAL algorithms can be seen as a deterministic analysis carried out on three specific datasets, which represent only a small portion of the entire set of cyber-attacks that could threaten a water distribution system.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Study design and conductnone given

    The first two datasets were provided at the beginning of the competition, while the third dataset was subsequently used to evaluate and rank the attack detection algorithms.

    “The first two datasets, hereafter named Training dataset 1 and Training dataset 2, were provided at the beginning of the competition, while the third one (Test dataset) was subsequently used to evaluate and rank the attack detection algorithms.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim. May combine two claims.

    Interpretationnone given

    Both time-to-detection and classification score are important aspects of performance.

    “Both time-to-detection and classification score are important aspects of performance.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    Attack localization is a rather challenging task due to the intrinsic correlation among the hydraulic variables.

    “This is a rather challenging task due to the intrinsic correlation among the hydraulic variables.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning

    The solutions provided by seven teams suggest that timely and accurate detection can be obtained by both model-based and data-driven approaches, usually made of multiple sequential stages.

    “The solutions provided by seven teams suggest that timely and accurate detection can be obtained by both modelbased and data-driven approaches, usually made of multiple sequential stages.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Premisecitation

    SCADA concealment was performed by either replacing actual traffic information between PLCs and SCADA with previously-recorded data (replay attacks) or adding an offset to the transmitted sensor readings.

    “SCADA concealment was performed by either replacing actual traffic information between PLCs and SCADA with previously-recorded data (replay attacks) or adding an offset to the transmitted sensor readings (Urbina et al. 2016).”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites Urbina et al. 2016 source

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Study design and conductcitation

    A limitation of this battle is its reliance on data generated with a demand-driven engine.

    “A limitation of this battle is its reliance of data generated with a demand-driven engine (Taormina et al. 2017).”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Taormina et al. 2017 source

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

    Interpretationnone given

    Consistency checks and the analysis of control rules should lead to the identification of the simplest attacks.

    “It appears that consistency checks and the analysis of control rules should lead to the identification of the simplest attacks.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Study design and conductown data

    Training dataset 1 contained no cyber attacks, making it suitable for studying normal operating conditions.

    “A key aspect of the dataset is the absence of cyber attacks, which made it suitable for studying the operations of the water distribution system under normal operating conditions.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Premisecitation

    The operations of the water system were altered through malicious activation of hydraulic actuators, change of actuator settings, and deception attacks.

    “The operations of the water system were altered through malicious activation of hydraulic actuators, change of actuator settings, and deception attacks-amongst the most common for cyber-physical systems (Cardenas et al. 2009).”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites Cardenas et al. 2009

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Classified as probably not a substantial claim.

    Interpretationreasoning

    The inherent interdependence of the elements in the water network should theoretically allow for the detection of anomalies, even when the adversary tries to conceal actions by altering the SCADA readings of one or a few deployed sensors.

    “The inherent interdependence of the elements in the water network should theoretically allow for the detection of anomalies, even when the adversary tries to conceal his (her) actions by altering the SCADA readings of one or a few deployed sensors.”
    Quote in the paperSubstantial claim
35 of 35

  • The paper relies on this without support.

    All networked devices, including SCADA systems, represent potential targets.

    “Third, all networked devices, including SCADA systems, represent potential targets.”

  • The paper relies on this without support.

    It is not possible to rule out all attacks.

    “Since it is not possible to rule out all attacks, cyber-physical systems should also be equipped with intrusion detection schemes that assist with the recovery phase (Anderson 2010).”

  • The paper relies on this without support.

    The simulated SCADA data and attacks in the BATADAL datasets adequately represent real-world cyber-physical attacks on water distribution networks.

    “Participants were provided with datasets containing (simulated) SCADA observations, and challenged with the design of an attack detection algorithm.”
    “The datasets were generated via simulation with epanetCPA, a Matlab toolbox that allows to design a variety of cyber attacks and simulate, with EPANET2 (version 2.0.12), the hydraulic response of a water distribution network; see Taormina et al. (2017) for further details.”
3 of 3

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Brentan et al. ranking score differs between text and Table 4

    Minor

    The results text gives Brentan et al. a ranking score of 0.896, while Table 4 reports 0.894.

1 of 1

Cites

Flagged first, then by citations

Research works printed but not linked: 2

  1. Cardenas A. S. Amin B. Sinopoli A. Giani A. Perrig and S. Sastry. 2009. “Challenges for securing cyber physical systems.” In Vol. 5 of Proc. Workshop on Future Directions in Cyber-Physical Systems Security. Washington DC: Department of Homeland Security.
  2. Rossman L. A., 2000, EPANET 2 users manual

Cited by

Sorted by citations

Related

Authors
Taormina, R., Galelli, S., Tippenhauer, N. O., Salomons, E., Ostfeld, A., Eliades, D. G., Aghashahi, M., Sundararajan, R., Pourahmadi, M., Banks, M. K., Brentan, B. M., Campbell, E., Lima, G., Manzi, D., Ayala-Cabrera, D., Herrera, M., Montalvo, I., Izquierdo, J., Luvizotto, E., Chandy, S. E., Rasekh, A., Barker, Z. A., Campbell, B., Shafiee, M. E., Giacomoni, M., Gatsis, N., Taha, A., Abokifa, A. A., Haddad, K., Lo, C. S., Biswas, P., Pasha, M. F. K., Kc, B., Somasundaram, S. L., Housh, M., & Ohar, Z.
Affiliations
  • Singapore University of Technology and Design (SG)
  • Independent Water Resources Consultant, OptiWater, 6 Amikam Israel St., Haifa 3438561, Israel.
  • Technion – Israel Institute of Technology (IL)
  • University of Cyprus (CY)
  • Texas A&M University (US)
  • CRAN (FR)
  • Berliner Wasserbetriebe (Germany) (DE)
  • Universidade Estadual de Campinas (UNICAMP) (BR)
  • Research Fellow, Dept. of Water, Irstea, BP 5095, 34196 Cestas, France.
  • University of Bath (GB)
  • Research Engineer, Ingeniousware GmbH, 76137 Karlsruhe, Germany.
  • Universitat Politècnica de València (ES)
  • Data Scientist, Sensus, Inc., 8601 Six Forks Rd., Suite 700, Raleigh, NC 27615.
  • Lead R&D Engineer, Sensus, Inc., 8601 Six Forks Rd., Suite 700, Raleigh, NC 27615.
  • Water Resources Engineer, Sensus, Inc., 8601 Six Forks Rd., Suite 700, Raleigh, NC 27615.
  • Chief Data Scientist, Sensus, Inc., 8601 Six Forks Rd., Suite 700, Raleigh, NC 27615.
  • The University of Texas at San Antonio (US)
  • Washington University in St. Louis (US)
  • California State University, Fresno (US)
  • University of Haifa (IL)
Corresponding author
Galelli, Stefano
ORCID
Venue
Journal of Water Resources Planning and Management
Publisher
American Society of Civil Engineers (ASCE)
Published
2018-08
Volume
144
Issue
8
ISSN
  • 0733-9496 (ISSN-L)
  • 1943-5452
DOI
10.1061/(asce)wr.1943-5452.0000969
OpenAlex
W2807219356
Semantic Scholar
64815d88bf9bfb49e6e9e2bb9be6eac3d56ea7f6
Cited by
277
References
33
Citations by year
2026: 49 · 2025: 45 · 2024: 38 · 2023: 31 · 2022: 29 · 2021: 36 · 2020: 25 · 2019: 19 · 2018: 5
FWCI
13.14
Type
journal article
Language
en
Open access
Locations
  • Journal of Water Resources Planning and Management (publishedVersion)
  • Pure (University of Bath) (submittedVersion, other-oa)
  • RiuNet (Universitat Politècnica de València) (submittedVersion, cc-by-nc-nd)
  • Cambridge University Engineering Department Publications Database (submittedVersion)
  • Zenodo (CERN European Organization for Nuclear Research) (submittedVersion, cc-by)
  • Greater South Information System
Funders
  • Washington University in St. Louis
  • European Commission (739551, HORIZON2020)
  • National Research Foundation (NRF2014NCR-NCR001-40)
  • Fonds National de la Recherche Luxembourg
  • Coordenação de Aperfeiçoamento de Pessoal de Nível Superior
  • Conselho Nacional de Desenvolvimento Científico e Tecnológico
  • Qatar National Research Fund (NPRP8-1292-2-548)
Topics
  • Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
  • Physical Sciences › Engineering › Civil and Structural Engineering › Water Systems and Optimization
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
Keywords
cyberattack detection, water distribution systems, cyber-physical attacks, SCADA, programmable logic controller, attack detection algorithm, algorithm comparison, detection time, classification accuracy

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-21.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-21.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review